U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

22–293 PDF 2005

S. HRG. 109–60

SECURING ELECTRONIC PERSONAL DATA: STRIKING A BALANCE BETWEEN PRIVACY AND COMMERCIAL AND GOVERNMENTAL USE

HEARING

BEFORE THE

COMMITTEE ON THE JUDICIARY 

UNITED STATES SENATE

ONE HUNDRED NINTH CONGRESS

FIRST SESSION

APRIL 13, 2005

Serial No. J–109–11

Printed for the use of the Committee on the Judiciary

(

(II)

COMMITTEE ON THE JUDICIARY 

ARLEN SPECTER, Pennsylvania, Chairman 

ORRIN G. HATCH, Utah 

CHARLES E. GRASSLEY, Iowa 

JON KYL, Arizona 

MIKE DEWINE, Ohio 

JEFF SESSIONS, Alabama 

LINDSEY O. GRAHAM, South Carolina 

JOHN CORNYN, Texas 

SAM BROWNBACK, Kansas 

TOM COBURN, Oklahoma 

PATRICK J. LEAHY, Vermont 

EDWARD M. KENNEDY, Massachusetts 

JOSEPH R. BIDEN, JR., Delaware 

HERBERT KOHL, Wisconsin 

DIANNE FEINSTEIN, California 

RUSSELL D. FEINGOLD, Wisconsin 

CHARLES E. SCHUMER, New York 

RICHARD J. DURBIN, Illinois 

DAVID BROG, Staff Director 

MICHAEL O’NEILL, Chief Counsel 

BRUCE A. COHEN, Democratic Chief Counsel and Staff Director 

(III)

C O N T E N T S 

STATEMENTS OF COMMITTEE MEMBERS 

Page

Feingold, Hon. Russell D., a U.S. Senator from the State of Wisconsin ............. 24

prepared statement .......................................................................................... 142

Feinstein, Hon. Dianne, a U.S. Senator from the State of California ................. 4

prepared statement .......................................................................................... 145

Leahy, Hon. Patrick J., a U.S. Senator from the State of Vermont .................... 2

prepared statement .......................................................................................... 155

Schumer, Charles E., a U.S. Senator from the State of New York ..................... 26

prepared statement .......................................................................................... 181

Specter, Hon. Arlen, a U.S. Senator from the State of Pennsylvania ................. 1

WITNESSES 

Barrett, Jennifer, Chief Privacy Officer, Acxiom Corporation, Little Rock, 

Arkansas ............................................................................................................... 33

Curling, Douglas C. President and Chief Operating Officer, ChoicePoint, 

Alpharetta, Georgia ............................................................................................. 31

Dempsey, James X., Executive Director, Center for Democracy & Technology, 

Washington, D.C. ................................................................................................. 35

Douglas, Robert, Chief Executive Officer, PrivacyToday.Com, Steamboat 

Springs, Colorado ................................................................................................. 7

Johnson, Larry, Special Agent in Charge, Criminal Investigative Division, 

U.S. Secret Service, Washington, D.C. ............................................................... 13

Majoras, Deborah Platt, Chairman, Federal Trade Commission, Washington, 

D.C. ........................................................................................................................ 9

Sanford, Kurt P., President and Chief Executive Officer, U.S. Corporate and 

Federal Markets, LexisNexis, Miamisburg, Ohio .............................................. 29

Sorrell, William H., Attorney General, State of Vermont, and President, National Association of Attorneys General, Montpelier, Vermont ........................ 15

Swecker, Chris, Assistant Director, Criminal Investigative Division, Federal 

Bureau of Investigation, Washington, D.C. ....................................................... 11

QUESTIONS AND ANSWERS 

Responses of Jennifer T. Barrett to questions submitted by Senator Leahy ..... 49

Responses of Douglas Curling to questions submitted by Senators Specter 

and Leahy ............................................................................................................. 52

Responses of Deborah Platt Majoras to questions submitted by Senators 

Leahy and Biden .................................................................................................. 66

Responses of Kurt P. Sanford to questions submitted by Senators Specter 

and Leahy ............................................................................................................. 79

SUBMISSIONS FOR THE RECORD 

Barrett, Jennifer, Chief Privacy Officer, Acxiom Corporation, Little Rock, 

Arkansas, prepared statement ............................................................................ 87

Consumers Union, Gail Hillebrand, San Francisco, California, prepared statement ...................................................................................................................... 95

Curling, Douglas C. President and Chief Operating Officer, ChoicePoint, 

Alpharetta, Georgia, prepared statement .......................................................... 97

Dempsey, James X., Executive Director, Center for Democracy & Technology, 

Washington, D.C., prepared statement .............................................................. 103

Douglas, Robert, Chief Executive Officer, PrivacyToday.Com, Steamboat 

Springs, Colorado, prepared statement and attachments ................................ 120

Page

IV

Johnson, Larry, Special Agent in Charge, Criminal Investigative Division, 

U.S. Secret Service, Washington, D.C., prepared statement ............................ 148

Kuhlmann, Arkadi, Cheif, Executive Officer, ING Direct, Wilmington, Delaware, prepared statement .................................................................................... 153

Majoras, Deborah Platt, Chairman, Federal Trade Commission, Washington, 

D.C., prepared statement .................................................................................... 160

Sanford, Kurt P., President and Chief Executive Officer, U.S. Corporate and 

Federal Markets, LexisNexis, Miamisburg, Ohio, prepared statement ........... 184

Sorrell, William H., Attorney General, State of Vermont, and President, National Association of Attorneys General, Montpelier, Vermont, prepared 

statement .............................................................................................................. 198

Swecker, Chris, Assistant Director, Criminal Investigative Division, Federal 

Bureau of Investigation, Washington, D.C., prepared statement .................... 214

(1)

SECURING ELECTRONIC PERSONAL DATA: 

STRIKING A BALANCE BETWEEN PRIVACY 

AND COMMERCIAL AND GOVERNMENTAL 

USE 

WEDNESDAY, APRIL 13, 2005

UNITED STATES SENATE, COMMITTEE ON THE JUDICIARY, Washington, D.C. 

The Committee met, pursuant to notice, at 9:30 a.m., in room 

SD–226, Dirksen Senate Office Building, Hon. Arlen Specter, 

Chairman of the Committee, presiding. 

Present: Senators Specter, Coburn, Leahy, Kohl, Feinstein, Feingold, and Schumer. 

OPENING STATEMENT OF HON. ARLEN SPECTER, A U.S. 

SENATOR FROM THE STATE OF PENNSYLVANIA 

Chairman SPECTER. It is 9:30 and our practice is to begin these 

hearings precisely on time. We have a long list of witnesses today, 

ten in number. We have a vote scheduled for 11:15, and once Senators disperse to go to vote, it is pretty hard to get the attention 

of the Senators after that. So we are going to be operating under 

our usual time limit of five minutes for statements by witnesses. 

All statements will be made a part of the record in full and that 

will be our method of proceeding. 

First, on a brief personal note, I was stopped coming over by a 

young woman who told me her father has a situation similar to 

mine. And I get a tremendous number of questions and I am glad 

to report that I am doing fine with certain treatments. I have a 

new hair stylist. That is the most marked change in my situation. 

I have been on the job. We have had the hearings, persevering with 

the work of the Senate. Some days are better than others, but it 

is all fine. 

Our subject matter today is an issue of great importance on 

breaches of data security involving the invasion of privacy. The statistics show that—you can start to run the clock now that I am on 

the subject matter. I adhere to the strict time limits myself. 

The statistics show that there were 10 million victims of identity 

theft and identity fraud in the year 2003, at a cost to those individuals of some $5 billion, $50 billion in business losses; very extensive participation by the Government on data, with the Department 

of Justice having paid some $75 million to ChoicePoint last year on 

data processing. 

2

We are in a field of phenomenal electronic advances. Chief Justice Warren was prescient back in 1963 in a decision on Lopez v. 

United States, saying that, quote, ‘‘The fantastic advances in the 

field of electronic communications constitute a great danger to the 

privacy of the individual.’’ And where we have moved from 1963 is 

enormous and we now see the breaches in security and it is a matter of serious consequences for our individual privacy and also for 

law enforcement, which is relying upon these electronic mechanisms to identify suspects and pursue legitimate law enforcement 

interests. 

There has been an entire industry which has grown up on this 

subject providing very, very important services, having databanks 

which enable applicants for mortgages to get them the same day, 

applicants for leases on apartments to get them the same day, 

credit card applications being processed, so that it has facilitated 

our lives, but it has had the corollary problem of the invasions of 

privacy. 

There has been limited governmental response. Some States 

have laws. There is no Federal legislation on the issue. The United 

States General Accounting Office reports that, quote, ‘‘Criminal law 

has thus far proven to be quite ineffective in grappling with identity theft in that States devote insufficient attention and resources 

to prosecuting identity theft.’’ The major companies who are represented here today—ChoicePoint, LexisNexis and Acxiom—have 

personal data on millions of Americans, including the identity as 

to name, address, Social Security numbers, insurance claims history, credit history, vehicle ownership, military service, educational 

history, outstanding liens or judgments, fingerprints, and even 

DNA. So it is a very, very wide array of information which is available. 

There is no Federal legislation on the subject, and after the review for this hearing it is my conclusion that we do need Federal 

legislation, that there needs to be uniformity as we approach an 

enormous problem of this sort. 

I took about a minute before the clock went on, so I am going 

to stop at this juncture and yield to my distinguished ranking 

member, Senator Leahy. 

STATEMENT OF HON. PATRICK J. LEAHY, A U.S. SENATOR 

FROM THE STATE OF VERMONT 

Senator LEAHY. That is a hint for the ranking member not to go 

overly long, too, but I want to thank the Chairman for doing this 

hearing. I wrote to him earlier this year and asked that we do it. 

I know that we both share this concern about privacy and this 

helps a great deal. 

I am glad to see Senator Feinstein here, who has been a leader 

on this, and Senator Schumer and other members of the Committee, and Senator Nelson from Commerce. I am glad to see a fellow Vermonter, Bill Sorrell, who is the Attorney General of 

Vermont and President of the National Association of Attorneys 

General. 

I think of all the major security breaches involving large firms 

such as ChoicePoint, Bank of America and Seisint, a LexisNexis 

subsidiary, and it shows the susceptibility of our most personal 

3

data to relatively unsophisticated scams. These are not major 

things where somebody went in with some major, high-tech hacking. This was something where they used basically con games and 

got so much of this information. 

It raises broader concerns, like industry’s failure to know its own 

customers by properly screening the buyers of consumers’ data. Advanced technology, combined with the realities of the post-9/11 digital era, have created strong incentives and opportunities for collecting and selling personal information about each and every 

American. Every single American in this room, as well as every 

American throughout the country—there is an incentive to collect 

the data about them and then to sell it. 

All types of corporate entities routinely traffic in billions of 

digitized personal records to move commerce along. Our Government is using it now to know its residents. There is a certain Orwellian twist to this. I can make a lot of arguments of why business needs it, but I can also make a strong argument why if business is not careful with their trust or Government is not careful 

with their trust, we Americans are severely damaged and the country is severely damaged. Our privacy and our security is damaged. 

Increasingly, those who trade in data have no direct relationship 

with the individuals and faces behind the numbers or letters that 

identify them. So the normal market discipline of disgruntled consumers does not save the companies from themselves. 

We had one major company that sent the most personal data 

about their consumers on an airplane just to ship it off to another 

area. All of us who fly very much, we know our suitcases get lost. 

This was a case, and they were cavalier about that, where they just 

sent it out, showing absolutely no concern for their customers. And 

then I read in the paper two days ago that their former president 

is given, even though he is retired, lifetime use of the corporate jet. 

No wonder they treated it so cavalierly. They don’t have to worry 

about lost luggage. If they did, maybe they would be concerned 

about the lost data of their customers. Frankly, if I were a customer of that company, I would change companies. 

The case of Amy Boyer is a poignant reminder. In 1999, a man 

who had been obsessed with her since high school bought Amy’s 

Social Security number, work address and other information from 

data broker Docusearch for $154. He used that information to track 

her down, and one day as she was leaving work he fatally shot her 

just before killing himself. For $154, he could track her down. 

For others, inaccurate or misused data has meant job refusals or 

in many cases a life-consuming cycle of watching their credit unravel and undoing the damage caused by security breaches and 

identity theft. Individuals working for an Indian data processor 

stole personal information of Citibank customers, along with 

$350,000 just to make it worthwhile. 

Last year, a Pakistani transcriber of medical files from a San 

Francisco hospital threatened to post that information on the Internet unless she received back pay. We outsource this to other countries anyway. They are holding our information in other countries 

and if they want to blackmail us with it, there is not much we can 

do. 

4

I think weaknesses in the data industry can jeopardize our law 

enforcement and our homeland security. Government contracts 

that provide critical data and processing tools have to get it right. 

Our hearing today is not about shutting down these data brokers 

or abandoning their services. It is about shedding a little sunshine 

on current practices and weaknesses, and frankly, in my estimation, some very, very sloppy, sloppy business practices by some 

of these companies, and then to establish a sound legal framework 

to ensure that privacy, security and civil liberties will not be 

pushed aside. 

Industry leaders like ChoicePoint, Acxiom and LexisNexis play a 

legitimate and a valuable role in the information economy. But because they are so valuable, they also need to treat these more carefully. 

I will put the rest of my statement in the record, Mr. Chairman, 

but I am extremely concerned that we are not protecting customers 

and consumers around this country in the way we should. The companies get the benefit of having the data, but they also have a responsibility. We have to also consider some of the privacy issues 

that should affect every single one of us. 

Chairman SPECTER. Without objection, Senator Leahy’s full 

statement will be made a part of the record, as will my full statement. 

[The prepared statement of Senator Leahy appears as a submission for the record.] 

Chairman SPECTER. We turn now to a distinguished member of 

this panel who has taken initiative in introducing legislation in the 

field, as has Senator Schumer and some other Senators, but I think 

Senator Feinstein has put in the lead legislation, with some substantial experience from her home State of California. 

We are going to waive the oath for you, Senator Feinstein, but 

everybody else is going to be put under oath. 

STATEMENT OF HON. DIANNE FEINSTEIN, A U.S. SENATOR 

FROM THE STATE OF CALIFORNIA 

Senator FEINSTEIN. Thank you very much, Mr. Chairman, and 

because you referred to what you have been going through in your 

opening statement, I just want to say how much personal respect 

I have for you for doing what you are doing in the way in which 

you are doing it. You have been an extraordinarily fair Chairman 

and this Senator really appreciates it. I think your vigor and your 

ability to carry out this work is truly amazing. 

Chairman SPECTER. Thank you very much. Thank you. 

Senator FEINSTEIN. You are welcome. 

Chairman SPECTER. Start Senator Feinstein’s clock at five minutes. 

Senator FEINSTEIN. Thank you. 

[Laughter.] 

Chairman SPECTER. And anything else she may care to say about 

me, we will restart it at five minutes, so long as it is similarly 

laudatory. 

Senator FEINSTEIN. Thank you very much. 

I think most people don’t understand that when they shop, when 

they buy a car, when they buy a home, what they buy, when they 

5

buy out of a catalog, when they use a credit card, all bits and 

pieces about their personal data are collated and put together—

their Social Security number, their driver’s license, their personal 

financial data, their personal health data. 

And it is used; it is used by banks who sell to subsidiaries. I am 

told Citibank sells to 2,000 different companies. There are companies that put this data together that are here today that also sell 

it, and the individual has no knowledge of this, has not given their 

permission, knows nothing about it, until one day they are a victim 

of identity theft. 

And this is not a small thing. There were 9 million victims this 

last year alone. Of the 12 big breaches of databases that took place 

this year and during last year, the personal data of 10.7 million 

Americans has been put in jeopardy of identity theft. That is where 

we are going. It is huge and it is large. 

This is the third Congress in which I have introduced bills, bills 

to give an individual some control. You have to give your permission before your personal data is sold. That is called opt-in. For less 

personal data, it is opt-out. To restrict use of Social Security numbers, to require that they be redacted from public documents—that 

is a second bill, and so on. 

This bill, S. 115, is patterned after the California law. We would 

not have known of these breaches had it not been for California 

law. As a matter of fact, I am told that ChoicePoint—and I am sure 

if this is not correct, they will say so when they testify—had a prior 

breach and didn’t notify anyone until the California law required 

them to notify Californians, and then others protested and they notified more people. So we have a bill that follows California law. 

On Monday, I introduced a new bill after working with consumer 

advocates to broaden the scope, and the new bill’s number is 751. 

This bill will ensure that Americans are notified when their most 

sensitive personal information—their Social Security number, their 

driver’s license or State identification number, their bank account 

and credit card information—is part of a data breach, putting them 

at risk of identity theft. 

This bill would require a business or government entity to notify 

an individual in writing or e-mail when it is believed that personal 

information such as a Social Security number, driver’s license, 

credit card number has been compromised. Only two exceptions 

exist: first, upon the written request of law enforcement—that is 

obviously pending an investigation—for purposes of criminal investigation, and, second, for national security purposes. 

The bill is based on California law, but California law really 

opened our eyes to the breadth and depth of the problem. This bill 

covers both electronic and non-electronic data, as well as encrypted 

and unencrypted data. California law only includes unencrypted 

electronic data. 

This new bill would allow individuals to put a seven-year fraud 

alert on their credit report. The California law doesn’t address 

fraud alerts. It doesn’t include a major loophole allowing companies 

to follow weaker notification requirements, as the California law 

does. Our bill lays out specific requirements for what must be included in notices, including a description of the data that may have 

been compromised, a toll-free number to learn what information 

6

and which individuals have been put at risk, and the numbers and 

addresses for the three major credit reporting agencies. By contrast, California law is silent on what should be in notices. 

This bill has tougher civil penalties—$1,000 per individual they fail to notify, or not more than $50,000 a day while the failure to 

notify continues or exists. In California, a victim may bring a civil 

action to recover damages or the company may be enjoined from 

further violations. And most importantly, this bill sets a national 

standard so that individuals in Iowa, Oklahoma and Maine have 

the same protection as consumers in California. 

The law would be enforced by the Federal Trade Commission or 

other relevant regulators, or by a State attorney general who could 

file a civil suit. And because the bill is stronger than California 

law, leading privacy groups, including Consumers Union and Privacy Rights Clearinghouse, have endorsed this legislation. 

I would like, if I might, to put these letters in the record, Mr. 

Chairman. 

Chairman SPECTER. Without objection, they will be made part of 

the record. 

Senator FEINSTEIN. I would like to end with one case that I think 

depicts what has happened. You can’t tell the true impact of identity theft by looking at numbers. Let me give you the case of Rebecca Williams. She lived in San Diego in 2000. A thief was using 

her Social Security number, her birth date and her name to establish a parallel identity thousands of miles away in the Chicago 

area. 

The thief opened a phone line and utilities, obtained a driver’s 

license and signed up for credit cards in her name. He even tried 

to use her identity to purchase a car. In all, the thief used Ms. Williams’ identity to open more than 30 accounts, accruing tens of 

thousands of dollars’ worth of goods and services. Sometimes, accounts were opened despite the fact that fraud alerts had been 

issued. 

Ms. Williams said that restoring her identity is like a full-time 

job, and estimates that she spent the equivalent of eight hours a 

day for three full months working with credit bureaus, credit card 

companies and various government agencies. 

Chairman SPECTER. Senator Feinstein, I note you have considerably more text. Could you summarize? 

Senator FEINSTEIN. I certainly will. The point is that five years 

later, she has not fully restored her identity. That is how serious 

this is. 

So I thank you for holding this hearing, and I would ask that my 

full statement be entered into the record. 

Chairman SPECTER. Without objection, it will be made a part of 

the record in full. Again, thank you, Senator Feinstein for your 

leadership and your early leadership in this field. 

[The prepared statement of Senator Feinstein appears as a submission for the record.] 

Chairman SPECTER. We are going to start the hearing today with 

a video demonstration on what the impact is of knowing someone’s 

Social Security number. We all know that the Social Security number is an entry point to a great deal of information about people, 

and we similarly know that we are frequently asked to give our SoVerDate 0ct 09 2002 14:25 Jul 12, 2005 Jkt 022293 PO 00000 Frm 00010 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\22293.TXT SJUD4 PsN: CMORC
7

cial Security number in contexts where we question the necessity 

for it. It may well be that Congress will consider prohibitions 

against disclosure of Social Security numbers and some very heavy 

tightening up of this very basic point of identification which we all 

necessarily have. 

We have with us Mr. Robert Douglas, who is the CEO of 

PrivacyToday.com. His full background will be made a part of the 

record, but in the interest of brevity I want to turn to him right 

now for his video demonstration. 

STATEMENT OF ROBERT DOUGLAS, CHIEF EXECUTIVE OFFICER, PRIVACYTODAY.COM, STEAMBOAT SPRINGS, COLORADO 

Mr. DOUGLAS. Thank you, Chairman Specter, ranking member 

Leahy, distinguished members of the Committee. My name is Robert Douglas. 

Chairman SPECTER. Excuse me. Do you have similar screens for 

Senator Feinstein and Senator Feingold so they can follow this? 

Senator FEINSTEIN. It is right over there. 

Chairman SPECTER. Can you see it? 

Senator FEINSTEIN. No, but it is there. 

[Laughter.] 

Chairman SPECTER. Let the record show it is there. 

Proceed, Mr. Douglas.

Mr. DOUGLAS. We do have hard copies of these available for the 

members. 

My name is Robert Douglas. I have been a private investigator 

and security consultant for the last 22 years, the last 8 years of 

which I have specialized in identity crimes and fraud. This is my 

fifth appearance before the United States Congress testifying on 

these types of crimes. 

I have provided expert testimony to the Federal Trade Commission in Operation Detect Pretext, the Florida statewide grand jury 

on identity theft, and on the murder case of Amy Boyer that Senator Leahy—

Chairman SPECTER. Your credentials as an expert are taken. On 

to the issue. 

Mr. DOUGLAS. Thank you, sir. I have been asked to provide a 

brief demonstration of how it is to obtain a Social Security number, 

the other types of information that are available, and what harm 

can come from that information. 

The first screen up is a website called SecretInfo.com, which 

when asked by the Washington Post to obtain a Social Security of 

one of their reporters, I was able to do so on this search right here, 

locate a Social Security in 36 hours. I would note that from another 

company, U.S. Records Search, I received it in two hours telephonically. 

To place the search online, all I did was go to the order page. 

I put in the name of the reporter, Jonathan Krim. I provided his 

current address, which we won’t do for obvious reasons in the presentation here, and no other information. I scrolled down. I entered 

my name in the appropriate spot, entered my address information, 

which once again we won’t share, and phone numbers that I could 

be contacted at. 

8

I scrolled down a little further, provided a credit card number to 

make payment, hit the ‘‘I agree’’ button, and in 36 hours back came 

a very brief e-mail from Michael at SecretInfo.com providing the 

search results, the charge that had been applied to my credit card, 

the company that had applied the charge, and at the bottom Jonathan Krim, and obviously we have redacted his Social Security 

number for the presentation this morning. I would once again say 

that the other company, in two hours—they called me on my cell 

phone while I was driving home two hours afterwards. 

This is another company that gives a very good example of the 

scope of the information that is available on the Internet—name 

and address information, phone record information, Social Security 

numbers, post office box—I would much of this already protected 

by Federal law—utility information, DMV information. I am sure 

the Senators are familiar with the Driver’s Privacy Protection Act. 

This is another search site that gives descriptions of the types of 

searches available. I would point out once again driving records, 

credit reports, and they often will have language that qualifies who 

they will sell this to. But the experience in the FTC operation when 

we called more than a hundred of these companies is if they trusted you, they would sell anything to anybody over the phone—credit 

card activity, including specific details of purchases; telephone 

records, including specific numbers that have been called; bank account information which, depending on how it is obtained, is in violation of Gramm-Leach-Bliley; airline travel records, which is a terrorist’s dream. 

Finally, I would like to just mention—and Senator Leahy mentioned the Amy Boyer case. That is the case that I worked on in 

New Hampshire. This is the firm that sold Amy’s information, 

Docusearch.com. They are still in business today. In fact, Forbes 

magazine lists them as number one, and ChoicePoint is number 

two, of the firms that they recommend that people go to to buy information. 

Why is that dangerous? In Amy’s case, it ended up in this gentleman’s hands, and I use the term ‘‘gentleman’’ quite loosely. This is 

Liam Youens standing in the corner of his bedroom with an AK–

47. That is the gentleman that killed Amy Boyer once he bought 

her Social Security number, data of birth and place of employment. 

That is the conclusion of my presentation, Mr. Chairman. 

Chairman SPECTER. Thank you very much, Mr. Douglas. That is 

very informative. 

We will now turn to our first panel—the Honorable Deborah 

Platt Majoras, Mr. Chris Swecker, Mr. Larry Johnson and Mr. Bill 

Sorrell. Would you all please step forward? 

As a matter of practice, the Committee will swear in all witnesses. We are non-discriminatory. We had the Attorney General 

in last week and the Director of the FBI, so we want you to know 

that regardless of rank, station, et cetera, we think this is a preferred policy. 

If you would all rise and raise your right hands, do you swear 

that the testimony you will provide to the Senate Judiciary Committee will be the truth, the whole truth and nothing but the truth, 

so help you God? 

Ms. MAJORAS. I do. 

9

Mr. SWECKER. I do. 

Mr. JOHNSON. I do. 

Mr. SORRELL. I do. 

Chairman SPECTER. May the record show that all of the witnesses answered in the affirmative. 

Our first witness is the Honorable Deborah Platt Majoras, Chairman of the Federal Trade Commission. Prior to her service at the 

FTC, she practiced law with the prestigious firm of Day Jones in 

Washington. In 2001, she was appointed Deputy Assistant Attorney General for the Antitrust Division, and Principal Deputy in 

2002. She has an excellent academic record, summa cum laude 

from Westminster and a law degree from the University of Virginia. 

Thank you for joining us, Madam Chairman, Madam Chairwoman, Madam Chairperson, and you have five minutes. We look 

forward to your testimony. 

STATEMENT OF HON. DEBORAH PLATT MAJORAS, CHAIRMAN, 

FEDERAL TRADE COMMISSION, WASHINGTON, D.C. 

Ms. MAJORAS. Thank you very much, Mr. Chairman, ranking 

member Leahy, Members of the Committee. I am Deborah Majoras, 

Chairman of the Federal Trade Commission. I am grateful for the 

opportunity to testify today about securing personal information 

collected by data brokers and reducing the risks of identity theft. 

Although the views expressed in my written testimony represent 

the views of the Commission, my oral presentation and responses 

to your questions are my own and do not necessarily reflect the 

views of the Commission or any individual commissioner. 

Recent revelations about security breaches that resulted in disclosure of sensitive personal information about thousands of consumers have put the spotlight on data brokers like ChoicePoint and 

LexisNexis which collect and sell this information. This data broker 

industry includes many types of businesses providing a variety of 

services to an array of commercial and government entities. 

The information they sell is used for many purposes, from marketing to assisting in law enforcement. Despite the potential benefits of these services, the data broker industry is the subject of both 

privacy and information security concerns. As recent events demonstrate, if the sensitive information they collect gets into the 

wrong hands, it can cause serious harm to consumers, including 

identity theft. 

As the FTC is well aware, identity theft is a pernicious problem. 

Our 2003 survey estimated that almost 10 million consumers discovered that they were victims of some form of identity theft in the 

preceding 12 months, costing consumers $5 billion in out-of-pocket 

losses and American businesses $48 billion in losses. 

The survey looked at two major categories of identity theft—the 

misuse of existing accounts and the creation of new accounts in the 

victim’s name. Not surprisingly, the survey showed a direct correlation between the type of identity theft and its cost to victims in 

both time and money spent solving the problem. So, of course, people who had new accounts opened in their names, while they made 

up only one-third of the victims, nonetheless suffered two-thirds of 

the direct financial harm. Our survey also found that victims spent 

10

almost 300 million hours correcting their records and reclaiming 

their good names. That is a substantial toll and we take seriously 

the need to reduce it. 

There is no single Federal law governing data brokers. There are, 

however, some statutes and regulations that address the security 

of access to the information they maintain, depending on how the 

information is collected and used. 

The Fair Credit Reporting Act, for example, makes it illegal to 

disseminate consumer report information like credit reports to 

someone who does not have a permissible purpose; that is, a legitimate business need for the information. Similarly, the GrammLeach-Bliley Act imposes restrictions on the extent to which financial institutions may disclose consumer information related to financial services and products. 

Under that Act, the Commission issued its Safeguards Rule, 

which imposes security requirements on a broadly defined group of 

financial institutions that hold customer information. The Commission recently brought two cases in which we alleged that the companies there had not taken reasonable precautions to safeguard 

consumer information. 

Finally, Section 5 of the FTC Act prohibits unfair or deceptive 

practices by a broad spectrum of businesses, including those involved in the collection and use of personal information. Using this 

authority, the Commission has brought a number of actions against 

companies that made false promises to consumers about how they 

would use or secure their sensitive personal information. 

These cases make clear that an actual breach of security is not 

necessary for us to enforce under Section 5 if we determine that a 

company’s security procedures were not reasonable in light of the 

sensitivity of the information the company maintains. Evidence of 

a breach, of course, however, may indicate that the company’s procedures were not adequate, and our Commission staff monitors reports of breaches and initiates investigations where appropriate. 

The Commission, consistent with the role Congress delegated in 

1998, has worked hard to educate consumers and businesses about 

the risks of identity theft, as well as to assist victims and law enforcement officials. The Commission maintains a website and a tollfree hotline staffed with trained counselors to advise victims on 

how to reclaim their identities. We receive roughly 15,000 to 20,000 

contacts per week on our hotline or through our website or from 

mail from consumers who want to avoid becoming victims and from 

victims themselves. The Commission also facilitates cooperation, 

information-sharing and training among Federal, State and local 

law enforcement authorities. 

Although data brokers are currently subject to a patchwork of 

laws, depending on the nature of their operations, recent events 

raise the issue of whether these laws are sufficient. Although several alternatives have been proposed and we are considering each 

very carefully, the most immediate need is to address the risks to 

security. 

One sensible step would be to mandate security requirements for 

sensitive personal information collected by data brokers much like 

the Commission’s Safeguards Rule imposes on certain companies. 

It also is appropriate—

11

Chairman SPECTER. Chairman Majoras, could you summarize at 

this point? 

Ms. MAJORAS. Yes, I will. 

Finally, it is also appropriate to consider a workable Federal requirement for notice to consumers when there has been a security 

breach that raises significant risks to consumers. 

Mr. Chairman, members of the Committee, thank you very 

much. I look forward to working with all of you. 

[The prepared statement of Ms. Majoras appears as a submission 

for the record.] 

Chairman SPECTER. Thank you. 

We turn now to Mr. Chris Swecker, who is the Assistant Director 

of the Criminal Division of the Federal Bureau of Investigation. 

Mr. Swecker has a very extensive background in field work, has 

been with the FBI since 1982. His academic record is a bachelor’s 

degree from Appalachian State University and a law degree from 

Wake Forest. He also served as—this is the highlight of your resume, Mr. Swecker. You were an assistant district attorney. People 

sometimes ask me what is the best job I ever held and expect to 

hear Senator, maybe D.A. And I say, no, assistant D.A. 

Start the clock at five minutes for Mr. Swecker.

STATEMENT OF CHRIS SWECKER, ASSISTANT DIRECTOR, 

CRIMINAL INVESTIGATIVE DIVISION, FEDERAL BUREAU OF 

INVESTIGATION, WASHINGTON, D.C. 

Mr. SWECKER. Good morning, Mr. Chairman and members of the 

Committee. I want to thank you for the opportunity to testify today 

on the FBI’s efforts to combat identity theft, as well as the FBI’s 

use of public source data. 

The FBI views identity theft as a significant and growing crime 

problem, especially as it relates to the theft of consumer information from large wholesale data companies. The FBI opened 1,081 

investigations related to identity theft in fiscal year 2003, and 889 

in fiscal year 2004. I might add that a case that involves the theft 

of 1,000 identities would only be counted as one investigation within the FBI’s structure. 

That number is expected to increase as identity thieves become 

more sophisticated and as the technique is further embraced by 

large criminal organizations, placing more identity theft crime 

within the FBI’s investigative priorities. At present, we have over 

1,600 active investigations involving some aspect of identity theft. 

The FBI does not specifically track identity theft convictions and 

indictments, as identity theft crosses all program lines and is usually perpetrated to facilitate other crimes such as credit card fraud, 

check fraud, mortgage fraud and health care fraud. 

Armed with a person’s identifying information, an identity thief 

can open new accounts in the name of a victim, borrow funds in 

the victim’s name, or take over and withdraw funds from existing 

accounts of the victim, such as their checking account or their 

home equity line of credit. Although by far the most prevalent, 

these financial crimes are not the only criminal uses of identity 

theft information, which can even include evading detection by law 

enforcement in the commission of violent crimes. 

12

Identity theft takes many forms, but generally includes the acquiring of an individual’s personal information such as Social Security number, date of birth, mother’s maiden name, et cetera. Identity theft has emerged as one of the dominant white collar crime 

problems of the 21st century. Estimates vary regarding the true 

impact of the problem, but agreement exists that it is pervasive 

and growing. 

In addition to the significant monetary harm caused to the victims of the frauds, often by providers of financial, government or 

other services, the individual victim of the identity theft may experience a severe loss in their ability to utilize their credit and their 

financial identity. 

In a May 2003 survey commissioned by the FTC, they estimated 

that the number of consumer victims of identity theft over the year 

prior to the survey at 4.6 percent of the population of U.S. consumers over the age of 19, or 9.9 million individuals, with losses 

totaling $52.6 billion. Half of these individuals experienced the 

takeover of existing credit cards, which is generally not considered 

identity theft. New account frauds, more generally considered to be 

identity theft, were estimated to have victimized 3.23 million consumers and to have resulted in losses of $36.7 billion. 

The FBI’s Cyber Division also investigates instances of identity 

theft which occur over the Internet or through computer intrusions 

by hackers. The Internet Crime Complaints Center, also known as 

IC3, is a joint project between the FBI and the National White Collar Crime Center. This joint collaboration serves as a vehicle to receive, develop and refer criminal complaints regarding the rapidly 

expanding arena of cyber crime. 

The IC3 receives an average of 17,000 complaints every month 

from consumers alone, and additionally receives a growing volume 

of referrals from key e-commerce stakeholders. Of the more than 

400,000 complaints referred to IC3 since its opening in May of 

2000, more than 100,000 were either characterized as identity theft 

or involved conduct that could be characterized as identity theft. 

The FBI is developing cooperative efforts to address the identity 

theft crime problem in cities such as Detroit, Chicago, Memphis 

and Mobile. Task forces are currently operating in conjunction with 

our other State, Federal and local partners. 

An example of some of the cases involve a case involving, in September 2004, Phillip Cummings in the theft of over 30,000 consumer credit histories from 2000 to 2002. Losses to financial institutions in this case exceeded $11 million. He was sentenced to 14 

years in Federal prison. 

In January of 2003, another case involved the theft of over 100 

credit reports by someone posing in the account name of NEXTEL. 

The cases go on and on. I won’t belabor you with all of the different 

investigations. There is a case, as you well know, involving 

ChoicePoint, where there wasn’t an IT intrusion. It was actually a 

socially-engineered con effort, as Senator Leahy pointed out, involving a customer who used over 23 business identities to access accounts through ChoicePoint. 

Chairman SPECTER. Mr. Swecker, your red light is on. Time has 

expired. If you could summarize at this point, we would appreciate 

it. 

13

Mr. SWECKER. ChoicePoint information is not considered in a 

vacuum. It is one of the many investigative tools which are used 

in law enforcement by investigators and analysts. As with any 

source of information, it is considered in relation to the totality of 

available information. It is particularly useful in that it allows analysts to inductively and deductively develop information about subjects, their confederates, witnesses and corporations that are associated with an investigation. 

Once again, I appreciate the opportunity to come before you 

today and share the work that the FBI has undertaken involving 

identity theft. The FBI’s efforts in this arena will continue and we 

will continue to keep the Committee informed of our progress. 

[The prepared statement of Mr. Swecker appears as a submission 

for the record.] 

Chairman SPECTER. Thank you very much, Mr. Swecker.

We turn now to Mr. Larry Johnson, who is the Special Agent in 

Charge of the Criminal Investigative Division of the Secret Service. 

Mr. Johnson is a 20-year-plus veteran of the Secret Service, having 

started in 1982. He has worked in quite a number of field offices 

around the country and was the Assistant Special Agent in Charge 

of the Presidential Protective Division. He has a bachelor’s degree 

from Eastern Kentucky. 

Thank you very much for joining us, Mr. Johnson.

STATEMENT OF LARRY JOHNSON, SPECIAL AGENT IN 

CHARGE, CRIMINAL INVESTIGATIVE DIVISION, U.S. SECRET 

SERVICE, WASHINGTON, D.C. 

Mr. JOHNSON. Thank you, Mr. Chairman. In addition to providing the highest level of physical protection to our Nation’s leaders, the Secret Service exercises broad investigative jurisdiction 

over a wide variety of financial crimes. As the original guardian of 

our Nation’s financial payment system, the Secret Service has a 

long history of protecting American consumers and industry from 

financial fraud. 

With the passage of Federal laws in 1984, the Secret Service was 

provided primary authority for the investigation of access device 

fraud, including credit card, debit card fraud, and parallel authority with other law enforcement agencies in identity crime cases. 

In recent years, the combination of the information revolution, 

the effects of globalization and the rise of international terrorism 

have caused the investigative mission of the Secret Service to 

evolve dramatically. With the expanding use of the Internet and 

lower cost of information processing, legitimate companies have 

found it profitable to specialize in data mining, data warehousing 

and information brokering. 

Information collection has become a common by-product of newly 

emerging e-commerce. Internet purchases, credit card sales and 

other forms of electronic transactions are being captured, stored 

and analyzed by businesses seeking to find the best customers for 

their products. 

This has led to a new measure of growth within the data collection industry that promotes the buying and selling of personal information. In today’s markets, consumers routinely provide personal and financial identifiers to companies engaged in business on 

14

the Internet. They may not realize that the information they provide in credit card applications, loan applications or with merchants they patronize are valuable commodities in this new age of 

information trading. 

This wealth of available personal information creates a targetrich environment for today’s sophisticated criminals, many of whom 

will organize and operate across international borders. But legitimate businesses can provide a first line of defense against identity 

crime by safeguarding the information they collect. Creating industry standards in this area can significantly limit the opportunities 

for identity crime even while not limiting its occurrence altogether. 

With the proliferation of computers and the increased use of the 

Internet, high-tech identity criminals began to obtain information 

from company databases and websites. In some cases, the information obtained is in the public domain, while in others it is proprietary and is obtained by means of computer intrusion or by means 

of deceptions such as Web spoofing, phishing and social engineering. 

The method that may be most difficult to prevent is the theft by 

a collusive employee. Individuals or groups who wish to obtain personal or financial identifiers for a large-scale fraud ring will often 

pay or extort an employee who has access to this information 

through their employment. This collusive employee will access the 

proprietary database, or copy or download the information or remove it from the workplace either electronically or simply by walking it out. 

The Secret Service has seen Internet crime increase significantly 

within the last several years. Since the early 1990s, the Eurasiabased computer underground in particular has developed a prodigious record for malicious software development. Starting in the 

late 1990s and increasing over the last few years, the criminal element has used such malicious software to penetrate financial and 

government institutions, extract data and illicitly traffic in stolen 

financial identity information. We believe that the exploitation of 

identity theft information is primarily for financial purposes. 

I would like to talk briefly about agency coordination and criminal sophistication. It has been our experience that criminal groups 

involved in these types of crimes routinely operate in a multi-jurisdictional environment. This has created problems for local law enforcement agencies that generally act as first responders to criminal activity. 

By working closely with other Federal, State and local law enforcement, as well as international police agencies, we are able to 

provide a comprehensive network of intelligence-sharing, resourcesharing and technical expertise that bridges jurisdictional boundaries. This partnership approach to law enforcement is exemplified 

by our financial and electronic crime task forces located throughout 

the country. These task forces primarily target suspects and organized criminal enterprises in financial and electronic criminal activity that fall within the investigative jurisdiction of the Secret 

Service. 

Chairman SPECTER. Mr. Johnson, your time is expired. If you 

would summarize, we would appreciate it. 

15

Mr. JOHNSON. Finally, the best example of agent coordination 

was on October 24, 2004, when the Secret Service arrested 30 individuals across the United States and abroad for credit card fraud. 

The suspects were part of a multi-count jurisdiction investigation 

out of the district in New Jersey. We had 30 arrests, 28 search 

warrants served simultaneously not only in the United States, but 

in 11 different countries throughout the world in conjunction with 

this investigation. 

Thank you. 

[The prepared statement of Mr. Johnson appears as a submission 

for the record.] 

Chairman SPECTER. Thank you very much, Mr. Johnson.

I note that there are still some people in the hall. If there are, 

you ladies and gentlemen are welcome to move into an area here 

where we have some space. Are there others who are still in the 

hall without being able to come into the hearing room? We don’t 

want anybody to miss our hearing. Well, if anybody comes, they are 

welcome to come, and if you folks would move over into some open 

space to give some room, we would appreciate it. 

I want to turn now to the distinguished ranking member to introduce his home State attorney general. 

Senator LEAHY. Well, thank you, Mr. Chairman. I am glad to 

have Bill Sorrell here. He has been Attorney General of Vermont 

since May of 1997—that is an elective office—first appointed when 

the then attorney general went on to become chief justice of the 

State. In elections, he has ended up being basically endorsed by 

both parties. While everybody else worries about reelection, he just 

sort of walks in with the strong support of all Vermonters. 

But I mention that, really, before being attorney general he held 

the best elected job that there has ever been in the State of 

Vermont, and that is he was Chittenden County State’s attorney. 

Anyone who has been Chittenden County State’s attorney will tell 

you that there is no finer job that you could have in the State of 

Vermont, even the United States Senate. So I am glad he is here. 

He is now President of the National Association of Attorneys General, and I think we are fortunate to have him here with us. I 

thank you, Mr. Chairman, for inviting him. 

Chairman SPECTER. Welcome, Mr. Sorrell. Were you ever an assistant prosecutor? 

STATEMENT OF WILLIAM H. SORRELL, ATTORNEY GENERAL, 

STATE OF VERMONT, AND PRESIDENT, NATIONAL ASSOCIATION OF ATTORNEYS GENERAL, MONTPELIER, VERMONT 

Mr. SORRELL. I was, yes, and that was a great job, too. 

Chairman SPECTER. Thank you for joining us and the floor is 

yours. 

Mr. SORRELL. Thank you, Mr. Chairman, Senator Leahy, and 

other members of the Committee, for giving me the opportunity to 

be here and talk about some issues that are of great importance 

to me and my fellow attorneys general. 

I am the President of the National Association of Attorneys General, and I am confident that most of my colleagues, if not all—and 

it could be all—agree with the thoughts that I will present today. 

16

But I would ask the Committee to consider that these are my remarks as the Vermont Attorney General. 

First of all, I want to start, Senator Feinstein, by thanking California for enacting the disclosure law. But for that law, ChoicePoint 

might not have disclosed the security breaches. We might not have 

seen and had the scrutiny we have on these issues. We might well 

not be here today. So my thanks. 

In thinking about my remarks today, I was reminded of the 

quote that is attributed to the famous bank robber Willie Sutton. 

Asked why he robbed banks, he said that is where the money is. 

Unlike the days perhaps when Senator Leahy and I were county 

prosecutors and you were worried about losing your TV or your 

stereo and maybe your money, these days where the money is is 

in the computers of data brokers, credit reporting agencies and 

other large financial institutions, academic institutions and the 

like, the personal information that they have, because if they can 

gain that personal information, they can not only drain your finances from the accounts that you have, but more importantly, and 

in the case of so many Americans, more than the value of what 

they have in accounts is their access to credit. What identity theft 

is about in many, many cases is stealing one’s access to credit. 

I am maybe dating myself a bit, but five or so years ago I was 

here in D.C. speaking to one of the Senate committees on GrammLeach-Bliley issues and saying at that time that with the way the 

economy was changing, with the ability to collect more and more 

information, we might well have been looking back on that time 

someday and saying that was the good old days when privacy was 

privacy. 

Well, here we are today and we see that more information is 

being gathered and that clever criminals are finding more and 

more ways to steal from us, to the tune of what the Chair of the 

FTC indicated to be $50 billion a year, and that number going up. 

We are here to say that the time for Federal action is now. We 

much appreciate the fact several bills are being considered in this 

area of the importance of the privacy and protection of our personal 

information. We hope that the Congress will follow the lead of California, and now up to 30 States that are considering disclosure 

laws, to enact a security breach notification law. 

To the extent that you can take into account the fact that the 

quicker the notification goes out to consumers that their personal 

information has been accessed, then the FTC studies show rather 

dramatically that the amount of the loss can be significantly reduced. So time and effectiveness of the notice are of significant importance. 

We ask you, if you enact such a law, to have your law be a floor 

rather than a ceiling in the same way under Gramm-Leach-Bliley 

the opt-out standard applies nationally. You have allowed States 

like Vermont to go forward and protect our citizens more and to 

adopt an opt-in standard if we wish. And we ask in this arena that 

you do the same thing, that you be respectful of the ability of the 

States; if the State wishes to be more protective, to be able to do 

so. 

The Chair indicated that the regulation of data brokers is sort 

of piecemeal. We ask you to pass a Federal statute that regulates 

17

data brokers, again, not to preempt the States with whatever you 

might do. Finally, we ask you to strengthen the safeguards rules 

under Gramm-Leach-Bliley and to include in those safeguard rules 

data brokers. We trust and hope that you will remain mindful and 

appreciative of the role that the States have played both legislatively and in investigations in this area of personal information, 

the importance of it, and we look forward to working with you 

going forward. 

Thank you for asking me to be here today. 

[The prepared statement of Mr. Sorrell appears as a submission 

for the record.] 

Chairman SPECTER. Thank you very much, Attorney General 

Sorrell. 

Senator Coburn has appropriately noted that some of the testimony was submitted late, and we are going to be enforcing a strong 

rule that where testimony is not submitted in time, then witnesses 

will not be permitted to make opening statements, but only to respond to questions, because it is very important that we get that 

on time. There is a tremendous amount of work to do to collate 

these materials and I thought that cautionary word would be in 

order at this time. 

Thank you, Senator Coburn, for focusing on that. 

Senator LEAHY. Mr. Chairman, I have a question on that. What 

do we do in those cases where testimony is submitted, but then entirely different testimony is given? I am thinking, for example, of 

the Attorney General the other day submitted testimony, but then 

the testimony he gave was considerably different. I wouldn’t to preclude him. 

Chairman SPECTER. Well, that happens from time to time and 

leads to more vigorous cross-examination. I heard you, Senator 

Leahy. He paid the price by offering different testimony from what 

he had submitted in writing. 

Senator LEAHY. Thank you. 

Chairman SPECTER. I don’t think there is any way you can control that. If people have to submit testimony, they will have to 

focus on it and we will have at least that advanced notice. But I 

do agree with you that it is problemsome when you have something 

new that you haven’t been prepared for, but I thought you handled 

it very adroitly. 

Senator LEAHY. We are talking about the U.S. Attorney General, 

not the Vermont Attorney General. 

Mr. SORRELL. I understand that. Thank you. 

Chairman SPECTER. Each member will now have five minutes on 

questioning, and I would ask that the responses be brief. 

Starting with you, Madam Chairwoman Majoras, what kind of 

Federal legislation would you like to see? 

Ms. MAJORAS. Well, as I said briefly in my opening statement, 

Senator, we think that looking at extending our GLB Safeguards 

Rule across a broader spectrum of companies so that companies are 

required by law to have in place security measures would be a terrific first step. And as a second step, we think we ought to look at 

notice provisions where consumers are at risk from breaches. 

Chairman SPECTER. Well, we will be submitting to you the draft 

legislation we have. You have had a lot of experience in the FTC. 

18

I want to address a question to both Mr. Swecker and Mr. Johnson. Both the FBI and the Secret Service has contracted out; the 

FBI paid about $75 million last year. What are you doing, Mr. 

Swecker, to guarantee the security of information which is so critical to law enforcement? 

Mr. SWECKER. Well, the existence of our queries by contractor 

are not known—I mean, the existence is known, but the substance 

of the queries are not known to ChoicePoint or any of the data brokers that we contract with. They collect the number and other information, but they do not collect the subject of the query. 

Chairman SPECTER. Are you saying then that the security 

breaches like we have seen do not impact on the FBI and the security of the information that you deal with? 

Mr. SWECKER. Not in the sense of knowing who we have initiated 

queries on. That data, ChoicePoint and other data brokers tell us, 

is not collected by them, only the number of queries and some 

other basic information for billing purposes. 

Chairman SPECTER. From the point of view of the Secret Service, 

Mr. Johnson, do you face any security problems on breaches that 

we have seen here? 

Mr. JOHNSON. Mr. Chairman, no, we have not. In similar form 

and fashion with the FBI, that is not known to the broker. Other 

things that the Secret Service does is we continuously monitor the 

information. We have assessment teams only looking at the information flow to see if we are vulnerable in any aspect of the information being leaked. 

Chairman SPECTER. Attorney General Sorrell, you have testified 

that you would not like to see the State laws preempted. We have 

now many States which have legislated in the field and we are considering Federal legislation. You have these companies which will 

have to comply with a patchwork of legislation. 

There has been some thought that this ought to be a matter for 

Federal jurisdiction on lawsuits, and at least at this point I have 

grave reservations about that, first, because the Federal courts are 

so heavily burdened at the present time. And, secondly, if you come 

from a rural part illustratively of Pennsylvania, Fulton County, you 

don’t want to go to Harrisburg or Pittsburgh to litigate your case. 

You can litigate Federal claims in the State court. 

I would like you to address the two issues. First, why not preempt State laws so that these companies know what they are dealing with and don’t have to familiarize themselves with the many, 

many differences? 

Mr. SORRELL. First of all, Senator, on this idea of a patchwork 

of different laws, our economy, with globalization, is becoming a 

world economy so that there are clearly differences between countries. We have some States which have economies larger than most 

of the countries of the world, and since we are talking about computers and information, it is really more of a system of programming. 

I mentioned Gramm-Leach-Bliley. We have for our insurance and 

financial services and banking industry in Vermont an opt-in 

standard rather than the national opt-out standard. Our Vermont 

economy has not suffered. Companies want to come in and do business there. It is doable and it is a minimum burden to become 

19

aware of the level of laws in each of the States and to stay in compliance with that. 

Roughly 30 of the States are looking at disclosure laws now and 

many of the States are looking at the security freeze laws. These 

same companies are very mindful of what is going on in the State 

houses and are in there lobbying. They want a single standard 

which would be easier for them. But in our view, in Vermont, 

Vermonters, if they want to go further, should be allowed to do so. 

Chairman SPECTER. My time has expired and I will yield at this 

point to Senator Leahy. 

Senator LEAHY. Well, thank you, Mr. Chairman. 

Madam Chair, we talked about ChoicePoint, LexisNexis, and so 

on. These are well-known, but there are a whole lot of other companies that operate well beneath the radar. Some get even more involved in our personal life and data. 

Does the FTC have any current plans to examine, identity and 

check these other industry players? 

Ms. MAJORAS. Senator Leahy, the FTC has been interested in 

this industry for some time, since before the recent revelations that 

have been in the news. We are working hard to try to get a better 

handle on this industry. It is hard to know at this point whether 

we can even call it just an industry because it seems to have many 

facets, depending on how you define it. 

So in addition to several investigations that we have pending, we 

are, in fact, trying to get our arms around who the players are here 

so that when we are working in law enforcement and when we are 

asked by Congress to help with possible legislation, we have the 

facts and we know what it ought to pertain to. 

Senator LEAHY. Some of the privacy experts suggest applying 

some kind of fair information practices, something similar to the 

Fair Credit Reporting Act, to the data brokers that are not currently subject to such similar protections. Would you support such 

an application? 

Ms. MAJORAS. I think we should look at whether some of those 

provisions should be applied. For example, if we have a data broker 

who is collecting information with respect to marketing practices, 

consumers, for example, may not care very much about the accuracy of that information that is being collected. So that may be an 

area where consumers don’t even want to be bothered with checking the accuracy. So again we want to make sure that if we extend 

these, we extend them in a way that makes sense. 

Senator LEAHY. Thank you, and I may have my staff follow up 

a little bit with yours on that subject. 

Ms. MAJORAS. Yes, sir. 

Senator LEAHY. Mr. Swecker, just to follow up a little bit on 

what the Chairman was asking you, has the FBI audited any of the 

commercial data brokers with whom you have contracts to evaluate 

how they comply with those contracts and security products? I am 

thinking insofar as you use them sometimes for criminal searches. 

Mr. SWECKER. No, Senator, we have not done a formal audit. We 

have looked at their protocols and how they capture our queries 

and the substance of the query is not captured. The way it is explained to me is there is a logging protocol that is used that masks 

the existence or the substance of our query, but does capture other 

20

information just simply for their billing purposes, but no formal 

audit. 

Senator LEAHY. And none planned? 

Mr. SWECKER. I am sorry, sir? 

Senator LEAHY. And none planned that you know of? 

Mr. SWECKER. None planned that I know of. 

Senator LEAHY. We may want to follow up further on that with 

you. 

We also have the whole question of data mining technology. 

There are a lot of different forms of it, algorithms that look for patterns, profiles, and so on. What kind of data mining does the FBI 

utilize, and assuming you can answer this in an open hearing, 

what kinds of protections are in place to prevent abuse? 

Mr. SWECKER. There really isn’t data mining, per se. Each query 

is predicated and connected to an investigation, at least a preliminary inquiry. So we don’t data-mine through the data broker’s information. There are specific queries that are made that are connected to specific investigations that are predicated. 

The closest that you could come to calling it data mining would 

be large-batch queries that are sometimes done with 40, 50 names 

at one time. But as far as just mining through the data, that does 

not occur. 

Senator LEAHY. I will follow up with a further question on that. 

Attorney General Sorrell, you said that many consumers in 

Vermont attempted to obtain a free report under Vermont law after 

learning about the ChoicePoint and the other security breaches. 

And they were told incorrectly, it turned out, by the credit bureau’s 

voice mail systems that they were not eligible for a free credit report. 

Have the credit reporting bureaus since resolved this problem? 

Have you heard from other attorneys general that they have had 

in their State the same kind of problem? 

Mr. SORRELL. I think there are about seven States that, like 

Vermont, had a statute before the Federal statute granting individuals annual access to their credit reports. I haven’t heard from the 

other States. We have communicated with the credit reporting 

agencies reminding them of the Vermont law, quite apart from the 

Federal law which, for Vermont, I don’t think is effective until this 

coming September. 

I don’t have up-to-date information to know whether consumers 

have called in within the last couple of days to complain about 

that. But, again, this is one of those issues where Vermont and 

some other States were ahead of the Federal Government in setting a more protective standard for our consumers and the Congress followed suit, ultimately. 

Senator LEAHY. Thank you. Thank you, Mr. Chairman. 

Chairman SPECTER. Thank you very much, Senator Leahy. 

Senator LEAHY. I have other questions I will submit for the 

record. 

Chairman SPECTER. Fine. 

Senator Coburn.

Senator COBURN. Thank you, Mr. Chairman. 

Attorney General Sorrell, if we were to make changes in terms 

of trying to protect States’ rights and States’ options, can you sugVerDate 0ct 09 2002 14:25 Jul 12, 2005 Jkt 022293 PO 00000 Frm 00024 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\22293.TXT SJUD4 PsN: CMORC
21

gest a way to create an opt-in/opt-out phenomenon in the Bliley bill 

that would incorporate your concerns and still give you the flexibility as a State, but still we could have a more uniform practice 

throughout the country? 

Mr. SORRELL. I would be happy to. This is really an area where 

I would be out in front of my colleagues, since we have not discussed an opt-in/opt-out national standard. I think it would depend 

on the nature of the information that is being collected and for 

what purposes it may be accessed; as the Chair suggested, marketing surveys as opposed to considerations for extension of credit 

and such. 

One thing that a number of the States are doing right now which 

is very effective in terms of combatting identity theft is to be able 

to freeze access to your credit reports. California, Texas, Louisiana 

and Vermont have those laws or they are about to go into effect. 

There is some downside for consumers when you do that because 

if you go to a store and want to open up an instant credit account, 

you can’t get it. If you haven’t thought a little bit ahead that you 

are looking for a mortgage to refinance or a new mortgage, or rent 

an apartment or buy a car or something like that, there is a time 

lag. 

But on the other hand, when it is access to your credit that is 

the main way that you can be the victim of identity theft crimes, 

then you can put a hold on your credit history going out. Four 

States have done it and others are considering it, and it is a very 

effective tool that some of the States have looked at to combat identity theft. And you can do it for periods of time, you can do it on 

an ongoing basis, and it is much more effective than just putting 

a security alert on your credit history. 

Senator COBURN. But for the State of Vermont and your position, 

you can’t see that you would object if you were left with the flexibility to opt in or opt out for Vermont if we were to have Federal 

legislation? 

Mr. SORRELL. I am sorry if I missed the point of your question, 

Senator. What I am asking for is that in this area of privacy, if 

there is Federal legislation that it be a floor as opposed to a ceiling 

and give the laboratory of the States, mindful of their priorities, 

the ability to be more protective if they wish, knowing that there 

might be some downside for individuals or for the economy in those 

States if they are willing to take on those burdens in return for the 

extra protection. 

There is some burden for the companies to be dealing with different rules and regulations, but that is the case environmentally 

with any number of other consumer laws right now and it can be 

the case here. 

Senator COBURN. Mr. Chairman, just for the record I would note 

that I have a great deal of difficulty with my credit card company 

because they are so aggressive, and as much as I travel around the 

country they won’t let me charge until they talk to me on the 

phone. They are not sure I am who I think I am. Sometimes, I am 

not sure I am who I think I am. 

But either way, we have a broad continuum of security checks 

that are going on now by individual businesses who offer credit, 

and I just think that the hearing ought to focus in the future on 

22

how do we create a better climate for the security of consumers in 

terms of their credit, but also leave the States the individual right 

to opt higher. I would agree with you. 

I thank you, Mr. Chairman. 

Chairman SPECTER. Well, those are very important considerations, Senator Coburn. How do they tell it is you? Do they know 

your voice? 

Senator COBURN. They ask for my mother’s maiden name and 

my grandmother’s maiden name. 

Chairman SPECTER. You fellows from Oklahoma don’t have such 

distinct dialects as those of us from Kansas. 

Senator COBURN. We have a twang, Mr. Chairman. 

Chairman SPECTER. Thank you, Senator Coburn. 

Senator Feinstein.

Senator FEINSTEIN. Well, thanks very much. Just quickly in response to Senator Coburn, the legislation that I have introduced in 

terms of protections for people in the opt-in/opt-out is that the optout is for significant personal data—Social Security number, driver’s license, personal health, personal financial data. That would be 

opt-in. Lesser things would be opt-out. That is just for your information. 

Attorney General, thank you very much for your comment about 

California. You mentioned that you thought this legislation should 

be a floor and not a ceiling, and that other States should be able 

to enter the arena. My concern is that if you have a different standard for notification—I am going to talk about that in a minute, but 

a different standard for notification in every State, it makes it very 

difficult. 

It seems to me that the standard for notification should be the 

same; in other words, what kind of information you must notify on, 

what the procedures for notification are, can you do it in e-mail, 

must you do it in writing and e-mail. Those kinds of things should 

be national, and then anything a State wants to do in addition to 

that would be up to the State. 

Could you comment? 

Mr. SORRELL. Do you envision a standard of whether there is 

substantial likelihood of misuse of the information or that it is just 

notification that the information has been accessed? 

Senator FEINSTEIN. Well, this is what I wanted to talk with the 

Chairman about because she has some quotes on this subject. I 

think any time the database is breached, that information is then 

out there. How do you know if it is significant risk, because somebody who gets 100,000 I.D.s about different people can sit back and 

use them in a year, in two years, can sell them? I think it is very 

difficult to determine significant risk. 

Mr. SORRELL. I agree with you, Senator. I am pleased to hear 

you say that. I guess in answer to your other question, it depends 

on what standard you set. In the case of ChoicePoint, and with all 

due respect to ChoicePoint, it is my understanding that the notifications that they sent out originally to California and then, under 

some pressure or encouragement, to other Americans—these notices, or a number of them, when coming through the mail, came 

in envelopes that just said ‘‘ChoicePoint.’’

23

Now, frankly, I had never heard of ChoicePoint until this issue 

broke and if I had received something from ChoicePoint, I would 

have assumed it was just another credit card offer and it would 

have gone in the recycling bin. So, hopefully, to the extent that a 

Federal standard is set, the notification will be such that it will 

prominently let consumers know that this has to do with access to 

your personal information as opposed to something from a company 

maybe they never heard of. 

Senator FEINSTEIN. Thank you. You have made a very good suggestion. We will take you up on it. 

Good morning, Madam Chair. If I may, when you appeared before the Senate Committee on Banking, you stated in response to 

Senator Reed that prompt notification of breaches should be given 

when there is significant risk to consumers. I think this is one of 

the biggest areas in notice, the idea of what triggers notice so as 

to avoid over-notification, but at the same time ensure, just as I 

have pointed out, that individuals are notified because you don’t 

know what might be done with that information. So I would like 

to explore this with you further. 

I would like to know why you take the position that notice should 

only be sent if there is significant risk to consumers and how you 

would define that. 

Ms. MAJORAS. Thank you. That is an excellent question, Senator 

Feinstein, and one that we are currently grappling with at the 

FTC. The issue is exactly the one that you have raised—over-notification. We have a lot of experience in dealing with consumers on 

a lot of different types of security issues and, of course, GrammLeach-Bliley, and what we have learned is that eventually consumers will become numb to notices if they are getting them consistently. 

So, for example, when we have a young hacker who finds it to 

be sport to hack into a significant database and then call the company and say, ‘‘ha, ha,’’ I hacked into your database, but who is 

then investigated and is seen not to have any intention, and indeed 

no longer has access to the information so that the person can commit the crime of identity theft, there isn’t a risk there to consumers. 

There are other types of situations we are envisioning in which, 

if we define breach very, very broadly, companies will have no 

choice but to be sending out constant notices to avoid liability. And 

we are worried that consumers will just think that it is a cry of 

wolf and will stop worrying about it. That is the concern. 

Senator FEINSTEIN. I think your point is well taken if you have 

an opt-in/opt-out situation. Right now, consumers don’t know; they 

don’t know the depth and breadth. For example, the gentleman 

that ran the video—Senator Leahy pointed out health information 

is advertised on that website. They can get your hospital records. 

Now, how they do that I don’t know. 

Does anybody in this room want their hospital records sold or 

available to anybody? I don’t think so, and that is where we are. 

So if we have for significant personal data the individual has to 

say, yes, Wells Fargo Bank, yes, ChoicePoint, yes, LexisNexis, you 

can sell my data, or you cannot sell my data, and for less signifiVerDate 0ct 09 2002 14:25 Jul 12, 2005 Jkt 022293 PO 00000 Frm 00027 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\22293.TXT SJUD4 PsN: CMORC
24

cant data that they must opt in, they must write a letter and I say 

I don’t want any of my personal data sold for commercial profit—

Chairman SPECTER. Senator Feinstein, your time is a bit past. 

Senator FEINSTEIN. It went by fast. Thank you, Mr. Chairman. 

Chairman SPECTER. We are going to be starting a vote in just a 

few minutes. It has been advanced to 10:50 and I want to be sure 

we cover this round. 

Senator Feinstein, have you concluded? 

Senator FEINSTEIN. No, but my time is up. 

Chairman SPECTER. Thank you. 

Senator Feingold.

STATEMENT OF HON. RUSSELL D. FEINGOLD, A U.S. SENATOR 

FROM THE STATE OF WISCONSIN 

Senator FEINGOLD. Thank you, Mr. Chairman. I do want to 

thank you for holding this hearing today and I have benefitted 

from listening to the witnesses. I ask that my full statement be 

printed in the record. 

Chairman SPECTER. Without objection, it will be made part of the 

record. 

[The prepared statement of Senator Feingold appears as a submission for the record.] 

Senator FEINGOLD. Thank you, Mr. Chairman. 

I am concerned about an aspect of the data broker business that 

has not received a lot of attention. The information gathered by 

these companies is sold not just to individuals and businesses, but 

also to law enforcement agencies like the FBI. While the Government should be able to access commercial databases in appropriate 

circumstances, there are no existing rules or guidelines to ensure 

that this information is used responsibly, nor are there restrictions 

on the use of commercial data for powerful, privacy-intrusive data 

mining programs. 

Mr. Chairman, that is why I am planning to reintroduce in the 

next few days my Data Mining Reporting Act which would require 

all Federal agencies to report to Congress on data mining programs 

used to find patterns, including terrorist or other criminal activity. 

I am glad this hearing gives us an opportunity to explore both government and commercial reliance on data brokers, and I look forward to working on Senator Feinstein’s legislation and the other 

legislation that is being introduced to address this issue. 

In terms of my time to question, Mr. Swecker, you testified that 

the FBI subscribes to some of ChoicePoint’s products. No doubt 

that these databases are useful investigative tools and can in appropriate circumstances enhance the efficiency of investigations. 

But it would be helpful to understand more about how the Bureau 

uses information from companies like ChoicePoint. 

So to begin, from what companies besides ChoicePoint does the 

FBI currently subscribe? 

Mr. SWECKER. Senator, we contract with Dun and Bradstreet, 

LexisNexis, Westlaw, the National Insurance Crime Bureau, Credit 

Bureau Reports, as well. I think it is important to emphasize this 

is all publicly available information. It is just a compilation of public source information all in one place. 

25

Twenty-three years ago when I first came to the FBI, I would 

have had to physically walk down to the courthouse to get courthouse records or go places to collect these records. Being able to 

make one query and get all these records at one time saves investigative time and it saves resources. That is why we use it. There 

is no data mining that takes place and I think that is—

Senator FEINGOLD. I am just trying to get some information first. 

Mr. SWECKER. Okay. 

Senator FEINGOLD. You mentioned in your testimony that 

ChoicePoint makes available public record information, but in an 

aggregated form. What type of public record information is contained in the products to which the FBI subscribes, and what other 

types of records are available to the FBI through commercial data 

brokers? 

Mr. SWECKER. Everything from driver’s license information, last 

known addresses, dates of birth, public court records, court filings, 

liens, newspaper records. It runs the whole gamut of public information. 

Senator FEINGOLD. And then how often do investigators use 

these databases? 

Mr. SWECKER. The data that I looked at showed that we conducted somewhere over a million inquires in 2003, I think, or close 

to a million, and possibly about 1.2 million, I think, just with 

ChoicePoint more recently, I think, in 2004. I may have my fiscal 

years mixed up there. 

Senator FEINGOLD. Does the FBI have benchmarks regarding the 

accuracy and security of data that it uses to evaluate whether to 

enter into a contract with information brokers? Do you have a process to review the quality and the accuracy of the data? 

Mr. SWECKER. My understanding is that is why we contract with 

all of these different companies because we are able to compare the 

information that comes in on the same person from four or five different data brokers and actually get to the accurate information. So 

that is why we don’t just contract with one company. We contract 

with four or five different companies. 

Senator FEINGOLD. But do you have a process to sort of compare 

and evaluate the quality of what you are getting? I mean, you are 

talking about contracting, you are talking presumably about spending the taxpayers’ dollars to purchase this ability to do this. Is 

there an accountable and effective way to evaluate the quality and 

accuracy and security of this information? 

Mr. SWECKER. Coming from the data brokers? We compare it to 

our own information as well and we have analysts that go through 

this data. Yes, of course, we try to make sure this is accurate information. 

Senator FEINGOLD. Do you make determinations as to whether 

one is better than the other in terms of who you are going to contract with? I assume you make judgments that some are better 

than others. 

Mr. SWECKER. Each one of these data brokers has a different 

strength in terms of what type of information they provide us and 

a lot of it is lead information that takes us somewhere else and it 

gives us places to start, comparing last known addresses, for example. 

26

Senator FEINGOLD. Mr. Swecker, I understand from your testimony—I think Senator Leahy talked about this—that FBI agents 

use commercial databases to conduct individualized searches to locate people who are already suspects or to further an investigation 

of someone who is already a suspect. Actually, on this one I am interested in hearing from Mr. Johnson. I believe you already covered 

this. 

Mr. Johnson, is the Secret Service also using commercial data to 

run more open-ended data mining searches to look for people who 

might fit a certain pattern of criminal or terrorist activity? 

Mr. JOHNSON. We do. The way the Secret Service is, through 

partnerships and our electronic crimes task forces, most, if not all, 

data brokers are members of our task forces. So in conjunction with 

an investigation, they provide that small part of what we might 

need to further that investigation. Does that answer your question? 

Senator FEINGOLD. So you use it, but you—

Chairman SPECTER. Senator Feingold, your time is expired. If 

you would conclude perhaps with another question—

Senator FEINGOLD. Thank you, Mr. Chairman. I am fine. 

Chairman SPECTER. Senator Schumer has just joined us. His timing is impeccable. Economizing on his own time, he was here at the 

start and now comes right in when he is recognized. 

Senator Schumer.

STATEMENT OF HON. CHARLES E. SCHUMER, A U.S. SENATOR 

FROM THE STATE OF NEW YORK 

Senator SCHUMER. Thank you, Mr. Chairman. I want to thank 

you for holding this hearing and Senator Leahy for requesting that 

the hearing be held. I have a couple of questions, but before I do 

I just want to note that yesterday Senator Nelson, of Florida, and 

I dropped in a comprehensive bill on identity theft and here are 

some of the things it would do. 

It would create an FTC office of identity theft that would help 

millions of victims of I.D. theft each year get their identities back 

through an accessible website, a toll-free phone number and consumer service teams. We all know the hundreds of hours people 

spend trying to get their identities back. 

Second, we would regulate data merchants. It would be similar 

to the regulation we have done in the Banking Committee. I know 

you testified before them, Madam Chairperson. It would be akin to 

what we do with credit bureaus. We would make them register 

with the FTC. We would institute safeguards to prevent fraudulent 

access by unauthorized parties and require them to develop authentication processes. In other words, we would actually regulate 

the use of people’s information. 

We have a tightrope to walk here. On the one hand, in this new 

society with computers we want information to be available. It 

helps commerce. On the other hand, when so much information is 

available, it is part of people’s identity and they have some right 

to be protected. I think our legislation—we have worked long and 

hard at it—does walk that tightrope in terms of accuracy and in 

terms of what can be done. 

We do a disclosure box so that people will know what has happened with their information. It is similar to the Schumer box 

27

which has been on credit cards for a long time, which I had championed while I was in the House. We require companies to take 

reasonable steps to protect sensitive information and we have a 

whole bunch of provisions about Social Security numbers which 

make it much harder, not impossible, but harder, without justification, to use Social Security numbers. 

So this is the basic outline of the legislation, which I think is 

comprehensive. I think we have had lots of pieces out there from 

the States, a few here federally. The notification proposal that Senator Feinstein has championed, I think, is excellent and we want 

to support that as well. But these are things in terms of regulating 

the companies and things like that. 

[The prepared statement of Senator Schumer appears as a submission for the record.] 

Senator SCHUMER. So I want to ask you, Chairwoman Majoras, 

when I talked with you in front of the Senate Banking Committee 

you were unsure whether the FTC had jurisdiction over data brokers like ChoicePoint and some of the others where we have seen 

problems. This lack of clear jurisdiction risks leaving data brokers 

subject to a confusing and incomplete patchwork of laws. In our 

legislation, Senator Nelson and I give the FTC clear jurisdiction to 

regulate data merchants like ChoicePoint. 

Do you agree that a clear mandate for the FTC would go a long 

way in clearing up the confusion about the laws and better protect 

consumers? Do you also agree that it would help stop the situations 

we have seen with many companies like ChoicePoint and 

LexisNexis to have clear jurisdiction over these companies? 

Ms. MAJORAS. Thank you, Senator. The FTC currently does have 

jurisdiction, but it is under a patchwork of a couple of different 

laws. Just to be absolutely clear, I haven’t had an opportunity yet, 

Senator, nor has my staff to review your bill closely. 

Senator SCHUMER. We sent it to you. 

Ms. MAJORAS. Yes, and we appreciate that. We look forward to 

reviewing it very carefully and, where we have found any gaps in 

the law, to work with you on whether this is the right legislation 

to fill those gaps. 

Senator SCHUMER. I would just ask could you respond to us for 

the Committee record about the legislation in, say, within a week? 

Could I ask unanimous consent that we get a response within a 

week, or is that too quick? 

Ms. MAJORAS. It is a bit quick because lots of bills are coming 

in at a rapid rate, and so a couple of—

Senator SCHUMER. Then I will just ask you to get a response to 

us quickly. 

My final question is this: One of the biggest complaints I have 

heard from constituents on identity theft is people don’t know 

where to go or what to do when their identity has been compromised. When your car breaks down, you know where to go. 

When you are the victim of a burglary, you know where to go, the 

local police station. But when you get your identity stolen, you 

don’t know where to go. 

What do you think off the top of your head of the idea of creating 

this office in the FTC of identity theft—we would fund it, obviously; 

28

we would spend $60 million—so that people would have a place to 

go with experts who could help them clear their names? 

Ms. MAJORAS. In my eight months on the job, I don’t think I 

have ever turned down any additional funding, Senator. Thank 

you. It does sound like perhaps—and, of course, I haven’t looked at 

it, so I have to be cautious. 

Senator SCHUMER. Yes, I understand. 

Ms. MAJORAS. But it does sound like an expansion of what we 

are already doing in our office. We have been the clearinghouse for 

identity theft information and for education and training for consumers, businesses and other law enforcement for years now. We 

think that message is getting out, which is why we get 15 to 20,000 

contacts from consumers a week on identity theft. But by all 

means, education empowers consumers and we would be happy to 

expand our education efforts. 

Senator SCHUMER. I know my time is about to expire. 

Chairman SPECTER. No, no, it has expired. 

[Laughter.] 

Senator SCHUMER. I would just say the job is not just education, 

but it is also helping people with their problems, and that is what 

we would want the office to do. 

Ms. MAJORAS. I understand. Thank you. 

Senator SCHUMER. Thank you. Thank you, Mr. Chairman. 

Chairman SPECTER. Thank you very much, Senator Schumer. 

Thank you, Chairman Majoras. Thank you, Mr. Swecker. Thank 

you, Mr. Johnson. Thank you, Attorney General Sorrell. We very 

much appreciate your testimony and coming in. 

The time of the vote has now been deferred until 12:15. You just 

can’t rely on times for votes, but we are still going to maintain meticulous observance of our time limits, and we are going to have a 

job in getting through the next panel even thus. 

If we could now have Mr. Curling, Mr. Sanford, Ms. Barrett, Mr. 

Dempsey and Mr. Douglas step forward, I would appreciate it. 

If you would raise your right hands, do you solemnly swear that 

the testimony you will present before the Senate Judiciary Committee will be the truth, the whole truth and nothing but the truth, 

so help you God? 

Mr. SANFORD. I do. 

Mr. CURLING. I do. 

Ms. BARRETT. I do. 

Mr. DEMPSEY. I do. 

Mr. DOUGLAS. I do. 

Chairman SPECTER. Let the record show that all five answered 

in the affirmative. 

Our first witness is Mr. Kurt Sanford, President and Chief Executive Officer of U.S. Corporate and Federal Markets for Reed 

Elsevier’s Global Division of LexisNexis Group. He was previously 

the CEO of LexisNexis Asia-Pacific, a $2 billion division. 

We welcome you here, Mr. Sanford, and the floor is yours for five 

minutes. 

29

STATEMENT OF KURT P. SANFORD, PRESIDENT AND CHIEF 

EXECUTIVE OFFICER, U.S. CORPORATE AND FEDERAL MARKETS, LEXISNEXIS, MIAMISBURG, OHIO 

Mr. SANFORD. Chairman Specter, ranking member Leahy and 

distinguished members of the Committee, good morning. My name 

is Kurt Sanford. I am the President and Chief Executive Officer for 

Corporate and Federal Markets at LexisNexis. I appreciate the opportunity to be here today to discuss the important issues surrounding data security and privacy in the use of commercial data. 

LexisNexis is a leading provider of authoritative legal public 

records and business information. LexisNexis plays a vital role in 

supporting government, law enforcement and business customers 

who use our information services for important uses, including detecting and preventing identity theft and fraud, locating suspects, 

finding missing children, and preventing and investigating criminal 

and terrorist activities. 

LexisNexis works closely with Federal, State and local law enforcement agencies on a variety of criminal investigations. For example, information provided by LexisNexis was recently used to locate and apprehend an individual who threatened a district court 

judge and his family in Louisiana. 

LexisNexis products are also used by financial institutions to 

help address the growing problem of identity theft and fraud. In 

2004, 9.3 million consumers were victimized by identity fraud. 

Credit card companies report $1 billion in losses each year from 

credit card fraud. With the use of LexisNexis, a major bank card 

issuer experienced a 77-percent reduction in the dollar losses due 

to fraud associated with identity theft. These are just a few examples of some of the important ways in which our products are used 

by our customers. 

While we work hard to provide our customers with effective products, we also recognize the importance of protecting the privacy of 

the consumer information in our databases. We have privacy policies, practices and procedures in place to protect this information. 

Our chief privacy officer and privacy policy review board work together to ensure that LexisNexis has strong policies to help safeguard consumer privacy. LexisNexis also has multi-layer security 

processes and procedures in place to protect our systems and the 

information contained in our databases. 

Maintaining security is not a static process; it requires continuously evaluating and adjusting our security procedures to adjust to 

the new threats we face everyday. Even with these safeguards, we 

recently discovered some security incidents at our Seisint business 

which we acquired last September. 

In February 2005, a LexisNexis integration team became aware 

of some billing irregularities and unusual usage patterns with several customer accounts. Upon further investigation, we discovered 

that unauthorized persons using I.D.s and passwords of legitimate 

Seisint customers may have accessed personal identifying information such as Social Security numbers and drivers’ license numbers. 

No personal financial, credit or medical information was involved, 

since LexisNexis and Seisint do not collect that type of information. 

In March, we notified approximately 30,000 individuals whose 

personal identifying information may have been unlawfully 

30

accessed. Although no individuals who have responded to our notice have reported any incidents of identity theft or fraud, law enforcement has recently informed us of ten incidents of potential 

identity fraud where new accounts have been opened. Most of these 

incidents involve the opening of a new e-mail account or similar activity, while a few involve potential credit card fraud. We are in the 

process of reaching out to those individuals to put them in touch 

with the identity theft counselors. 

Based on these incidents at Seisint, I ordered an extensive review of data search activity going back to January 2003 at our 

Seisint unit and across all LexisNexis databases that contain personal identifying information. We have just completed that review 

and concluded that unauthorized persons, primarily using I.D.s and 

passwords of legitimate Seisint customers, may have accessed personal identifying information on approximately 280,000 additional 

individuals. At no time was the LexisNexis or Seisint technology 

infrastructure hacked into or penetrated, and no customer data 

was accessed or compromised. 

We sincerely regret these incidents and any adverse impact they 

may have on the individuals whose information may have been 

accessed. We will begin notifying those individuals immediately. 

We are providing all individuals with a consolidated credit report 

and credit monitoring services. For those individuals who do become victims of fraud, we will provide counselors to help them clear 

their credit reports of any information relating to fraudulent activity. We also provide them with identity theft insurance to cover expenses associated with restoring their identity and repairing their 

credit reports. 

We are working cooperatively with the U.S. Secret Service and 

the Electronic Crimes Task Force in their investigation of these 

crimes. We greatly appreciate the professionalism, specialized skills 

and efforts provided by the Secret Service and other law enforcement organizations. 

We have learned a great deal from the security incidents at 

Seisint and are making substantial changes in our business practices and policies across all LexisNexis businesses to help prevent 

any future incidents. I have included the details of these enhancements in my written statement. 

I note my time is expired. I appreciate the opportunity to be 

here. In my written statement, I indicated the type of legislation 

that LexisNexis has already indicated it would support. 

[The prepared statement of Mr. Sanford appears as a submission 

for the record.] 

Chairman SPECTER. Thank you very much, Mr. Sanford.

We turn now to Mr. Douglas Curling, President and Chief Operating Officer of ChoicePoint. Mr. Curling has had a variety of positions with ChoicePoint, and before was Vice President and Assistant Corporate Controller at Equifax. 

We welcome you here, Mr. Curling, and we would be interested 

to know what your company has found, the breaches, and what you 

have done about them. The floor is yours for five minutes. 

31

STATEMENT OF DOUGLAS C. CURLING, PRESIDENT AND 

CHIEF OPERATING OFFICER, CHOICEPOINT, ALPHARETTA, 

GEORGIA 

Mr. CURLING. Chairman Specter, Senator Leahy and members of 

the Committee, good morning. I am Doug Curling, President and 

Chief Operating Officer of ChoicePoint. At ChoicePoint, we recognize that in an increasingly risky world, information and technology can be used to help create a safer, more secure society. At 

the same time, we know, and have been painfully reminded by recent events, that there can be negative consequences to the improper access of personally identifiable information. 

On behalf of ChoicePoint, let me again offer our sincere apology 

to those consumers whose information may have been accessed by 

criminals who perpetrated this recent fraud. As a result of these 

experiences, we have made fundamental changes to our business 

model and products to prevent this from happening in the future. 

By way of background, ChoicePoint is a leading provider of identification and credential verification to businesses, governments 

and non-profit organizations. We have 5,000 associates in 60 locations. We serve more than 7,000 Federal, State and local law enforcement agencies, as well as a significant number of Fortune 500 

companies, more than 700 insurance companies and many large financial services institutions. 

The majority of transactions our business supports are initiated 

by consumers. Last year, ChoicePoint helped over 100 million 

American consumers secure home and auto insurance, more than 

7 million American consumers get jobs from our workplace solutions pre-employment screening services, and more than 1 million 

consumers obtain expedited copies of their vital records—birth, 

death and marriage certificates. 

In addition to helping consumers, ChoicePoint helps agencies at 

all levels of government fulfill their mission to safeguard our country and its citizens. Our products and services are also used by 

many non-profit organizations. For example, we have identified 

11,000 undisclosed felons among those volunteering or seeking to 

volunteer with the Nation’s leading youth service organizations. 

Mr. Chairman, apart from what we do, I also understand that 

the Committee is interested in how our business is regulated by 

Federal legislation as well as various State regulations, including 

the FCRA, the recently enacted companion FACT Act, the GrammLeach-Bliley Act and the Drivers’ Protection Act. 

Sixty percent of ChoicePoint’s business is driven by consumer-initiated transactions, most of which are regulated by the FCRA. 

These include pre-employment screening, auto and home insurance 

underwriting services, tenant screening services, and facilitating 

the delivery of vital records to consumers. 

Nine percent of ChoicePoint’s business is related to marketing 

services, none of which include the distribution of personally identifiable information. Five percent of ChoicePoint’s business is related 

to supporting law enforcement agencies in pursuit of their investigative missions through information and data services. 

Six percent of our business supports law firms, financial institutions and general businesses to help mitigate fraud through data 

and authentication services. Finally, 20 percent of our business 

32

consists of software and technology services that do not include the 

distribution of personally identifiable information. 

Financial and identity fraud is a rapidly growing and costly 

threat to our Nation’s economy. While we offer a wide range of 

tools to help avoid fraud, no one is immune to it, as we and other 

companies and institutions have learned. ChoicePoint has previously provided Congress with information about how identity 

thieves in California were able to access our products. As you 

know, California has been the only State that requires consumers 

to be notified of a potential breach of personally identifiable information. 

Contrary to prior statements at this hearing, we not only followed California law, we built upon it and voluntarily notified consumers who may have been impacted across the country, and we 

did that before anyone called upon us to do so. 

We have also taken other steps to help the system protect consumers who may have been harmed in this incident. First, we arranged for a dedicated website and toll-free number. Second, we 

provided free of charge a three-bureau credit report. And, third, we 

are providing free of charge a one-year subscription to Credit Monitoring Service. 

In addition to helping those affected consumers, we have taken 

strong remedial action and made fundamental changes to our business and products. First and most importantly, ChoicePoint has decided to discontinue the sale of information products that contain 

personally identifiable information, unless these products and services meet one of three tests. 

First, the product supports consumer-driven transactions such as 

insurance, employment and tenant screening, or provides consumers with access to their own data. Second, the product provides 

authentication or fraud prevention tools to large accredited corporate customers where consumers have existing relationships, 

and, third, when personally identifiable information is needed to 

assist Federal, State or local government and criminal justice agencies in their important missions. 

We have also significantly reviewed and strengthened our 

credentialing process. We are recredentialing broad sections of our 

customer base, including more stringent diligence like bank references and site visits. We have created an independent office of 

credentialing compliance and privacy that reports directly to the 

board of directors’ privacy committee. Finally, we appointed Robert 

McConnell, a 28-year veteran of the Secret Service and former chief 

of the Federal Government’s Nigerian organized fraud crime task 

force, to serve as our liaison to law enforcement. 

My testimony includes the legislation we would support and we 

welcome the opportunity to work with this Committee in trying to 

address this important issue. 

[The prepared statement of Mr. Curling appears as a submission 

for the record.] 

Chairman SPECTER. Thank you very much, Mr. Curling.

Our next witness is Ms. Jennifer Barrett, Chief Privacy Officer 

of Acxiom Corporation. She has been with the company since 1974, 

after receiving a degree in mathematics and computer science at 

33

the University of Texas. She has had a series of important positions with the company. 

We welcome you here today, Ms. Barrett, and look forward to 

your testimony. 

STATEMENT OF JENNIFER BARRETT, CHIEF PRIVACY 

OFFICER, ACXIOM CORPORATION, LITTLE ROCK, ARKANSAS 

Ms. BARRETT. Thank you, Chairman Specter, Senator Leahy, distinguished members of the Committee. Thank you for allowing 

Acxiom the opportunity to participate in today’s hearing, and I ask 

that my written statement be inserted into the record. 

Chairman SPECTER. Without objection, your full statement will 

be made a part of the record. 

Ms. BARRETT. Thank you. 

Mr. Chairman, let me be blunt. The bad guys are smart and they 

are getting more organized. They are using their skills to illegally 

and fraudulently access information. Acxiom must therefore remain 

diligent and innovative by constantly improving, auditing and testing our systems and, yes, even learning from security breaches in 

the marketplace. 

Information is an integral part of the American economy and 

Acxiom recognizes its responsibility to safeguard the personal information it collects and brings to market. As FTC Chairman Majoras 

recently stated in testimony before both the Senate and the House, 

there is no such thing as perfect security and breaches can happen 

even when a company has taken every reasonable precaution. Although we believe this is true, no one has a greater interest than 

Acxiom in protecting its information because our very existence depends on it. 

Acxiom’s U.S. business includes two distinct components—our 

customized computer services and a line of information products. 

Our computer services represent more than 80 percent of the company’s business and help businesses, not-for-profit organizations, 

political parties and government manage their own information. 

Less than 20 percent of Acxiom’s business comes from its four information product lines—fraud management products, background 

screening products, directory products and marketing products. 

Our fraud management and background screening products are the 

only Acxiom products containing sensitive information and they 

represent less than 10 percent of our business. 

Acxiom would like to set the record straight in response to a 

number of misunderstandings that have developed about the company. First, Acxiom does not maintain one database containing 

dociers on anyone. Instead, we maintain discreet, segregated databases for every product. 

Second, Acxiom does not commingle client information from our 

computer services with our information products. Such activity 

would constitute a violation of our contracts and consumer privacy. 

Third, Acxiom’s fraud management products are sold only to a 

handful of large companies and government agencies who have a 

legitimate need for them. The information utilized in these products is covered under the safeguard and use rules of the GrammLeach-Bliley Act and both State and Federal drivers’ privacy protection laws. 

34

Fourth, Acxiom’s management verification services only validate 

information already in our clients’ possession. Access to additional 

information is only available to law enforcement and the internal 

fraud departments of large financial institutions and insurance 

companies. Fifth, our background screening products are covered 

under the Fair Credit Reporting Act. We do not pre-aggregate any 

of the information for this purpose. 

Beyond these protections, the following additional safeguards 

exist. First, because Acxiom has blended public information with 

regulated information in both our fraud management and background screening products, we voluntarily apply the more stringent 

security standards to all such blended data, even though not required by law. 

Since 1997, Acxiom has posted a privacy policy on our website 

describing our on- and offline practices, thus voluntarily subjecting 

the company to the FTC rules governing unfair and deceptive conduct. 

Third, the company has imposed our own more stringent, restrictive guidelines on sensitive information such as Social Security 

numbers. Fourth, all of Acxiom’s products and practices have been 

audited on an annual basis since 1997 and our security policies are 

regularly audited both internally and externally by our clients. 

Two years ago, Acxiom experienced a security breach on one of 

our external file transfer servers. Fortunately, the vast majority of 

the information involved was of a non-sensitive nature and law enforcement was able to apprehend the suspects and ascertain that 

none of the information was used to commit identity fraud. Since 

then, Acxiom has put even greater protections in place for the benefit of both consumers and our clients. 

In concluding, ongoing privacy concerns indicate that adoption of 

additional legislation may be appropriate. Acxiom supports efforts 

to pass federally preemptive legislation requiring notice to consumers in the event of a security breach which places the consumer 

at risk of identity fraud, and we also support the recent proposal 

from FTC Chairman Majoras and her comments today extending 

the GLBA safeguards rule. 

Mr. Chairman, on behalf of Acxiom, I want to express our gratitude for the opportunity to participate in this hearing and we are 

happy to answer any questions the Committee may have. 

[The prepared statement of Ms. Barrett appears as a submission 

for the record.] 

Chairman SPECTER. Thank you very much, Ms. Barrett.

We now turn to Mr. James Dempsey, who is the global Internet 

policy head for the Center for Democracy & Technology. He has a 

record of having been deputy director for the Center for National 

Security Studies, special counsel to the National Archives, and with 

a House Judiciary subcommittee in the past. 

Thank you for joining us, Mr. Dempsey, and we look forward to 

your testimony. 

35

STATEMENT OF JAMES X. DEMPSEY, EXECUTIVE DIRECTOR, 

CENTER FOR DEMOCRACY & TECHNOLOGY, WASHINGTON, 

D.C. 

Mr. DEMPSEY. Good morning, Mr. Chairman, Senator Leahy. 

Thank you for the opportunity to testify this morning. 

We are at a historic moment, I think, today at this hearing for 

four reasons. First of all, the recent security breaches at a range 

of companies and institutions have opened a window on the really 

extraordinary changes that have occurred to the information landscape in recent years. 

There is no need to demonize the information service companies. 

The goal is not to put them out of business. They serve very legitimate purposes, as we have heard today, but they have grown up 

very rapidly and now it is time for the law to catch up, to provide 

a framework of oversight and accountability. 

Secondly, the debate over harms is now ended. It is clear that 

the lack of a privacy and security framework is causing real harm 

to individuals. This isn’t some hypothetical debate about marketing 

data. 

Third, the concerns go beyond security and the harms go beyond 

identity theft. If people are being screened for employment or being 

denied jobs or screened by landlords and denied the ability to rent 

an apartment, those are real harms. People should have a right to 

see that information that is used and the right to challenge it, and 

the companies compiling it should have some responsibility for its 

accuracy. The Fair Credit Reporting Act covers many of those applications, but has gaps. 

Finally, the industry itself is now open to closing some of the 

gaps in the law, as you have heard at the table today. So we have 

an urgent situation. We clearly lack an adequate policy framework. 

How do we make sure we do not squander this opportunity? There 

are five sets of policy responses for this Committee and for the 

Congress. 

As a first step toward mitigating identity theft, entities, including universities and government agencies, holding sensitive personal data should be required to notify individuals in the event of 

a security breach. Since leading information service companies already have spoken in favor of Federal legislation, there is no need 

to dwell on this other than to say that it makes no sense to enact 

a law weaker or less comprehensive than the California law. Also, 

part of the notice solution should be options about what consumers 

can do when they receive notice. There should be easier ways to 

freeze credit reports or to put more permanent fraud alerts on credit reports. 

Secondly, since notice only kicks in after a breach has occurred, 

Congress should require entities that electronically store personal 

information to implement security safeguards similar to those required by a California law AB 1950 and the regulations under 

Gramm-Leach-Bliley. 

Third, Congress should impose tighter controls on the sale, disclosure and use of Social Security numbers. Senator Feinstein has 

been a leader on this issue for a number of years and the time to 

address this issue has clearly come. We should take the Social Security number out of the credit header. I don’t see any need to send 

36

that out in response to a name query, or to use that in the credit 

header. 

I think we need to shut down the kinds of sales of Social Security 

numbers illustrated by Mr. Douglas. Keep the Social Security number off student I.D. cards and employee cards and medical insurance cards. Also, we need somehow to break the habit of using the 

Social Security number as an authenticator. People treat it as if it 

is a secret or a PIN number, when it is clearly widely available. 

The fourth and fifth areas of policy that require addressing concern the legitimate uses of data, because even legitimate uses of 

data have consequences if the data is inaccurate. Several Senators 

raised what I consider to be the fourth set of policy issues, which 

is the Federal Government and other government agencies’ use of 

information brokers. Clearly, national security and law enforcement are legitimate uses, but that doesn’t mean we should leave 

aside questions of accuracy. As a first step, we clearly need to get 

a handle at least on what information the Federal Government is 

purchasing and how it is using it. 

Finally, Congress needs to look at the fair information practices 

that have helped define privacy in the credit and financial sectors 

and adapt them as appropriate to this new data landscape. It is 

most important here—and I will conclude—to focus on consequences. When data is used in ways that have implications for 

people’s insurance or whether their claims get paid or for a host 

of other reasons that may not be covered by current law, we need 

to fill those gaps. 

A book was written recently entitled No Place to Hide. Chairman SPECTER. Mr. Dempsey, your time has expired. Would 

you please summarize? 

Mr. DEMPSEY. Is there no place to hide? Senator, really it doesn’t 

have to be that way. We can shape the policy to reclaim our privacy and to set some framework of accountability. 

Thank you. 

[The prepared statement of Mr. Dempsey appears as a submission for the record.] 

Chairman SPECTER. Thank you very much, Mr. Dempsey.

We now turn to Mr. Robert Douglas, who has already been introduced and has already testified. 

You still have five minutes left, Mr. Douglas.

Mr. DOUGLAS. Thank you. I appreciate that. 

As I discussed in the opening presentation and concluded with 

the murder of Amy Boyer, I would like to concentrate on some of 

the facts in that case that illuminate, I think, many of the issues 

that we are discussing here today and what I have learned over the 

last eight years about information brokers and the harm that can 

occur. 

The facts behind the murder of Amy encapsulate all the issues 

before this Committee today. Amy’s murder demonstrates the problem is much larger than recent breaches of information broker 

databases. 

In October 1999, Amy was entering her car, having just left 

work. A stalker named Liam Youens pulled alongside Amy and 

shot and killed her, then killed himself. Youens published his plans 

to murder Amy on a website for several years, but that website 

37

contained more than the perversity of Youens. It contained a trail 

of evidence proving personal information gathered with good intent 

can lead to incalculable harm. 

Youens decided to ambush Amy at work, but didn’t know where 

she worked. He used information brokers and private investigators 

to find her. On the Internet, Youens bought Amy’s date of birth, 

Social Security, home address, and finally place of employment. 

Youens himself was struck by how easily he could buy Amy’s personal information, writing on his website ‘‘It is actually obscene 

what you can find out about a person on the Internet.’’

The Internet site Youens found was Docusearch.com. Docusearch 

located Amy’s work address by using her Social Security number 

and other personal information as elements of a deceit designed to 

fool Amy and/or her mother into revealing the employment address. 

Indeed, this was Docusearch’s expertise. Like many other companies that I demonstrated this morning, at the time of Amy’s murder Docusearch specialized in defeating the information security 

systems of financial institutions, telecommunications companies 

and unsuspecting citizens with information about loved ones. 

But the evidence in Amy’s murder doesn’t end there. It leads to 

thousands of documents showing how databases of American businesses that contain our most personal information are breached everyday. As mentioned, Docusearch was penetrating the information 

systems of financial institutions, telecommunications firms, other 

utility companies, and selling that information to just about anyone. 

In the files of Docusearch and other similar companies is evidence that when it comes to being guardians of personal information, both government and the private sector deserve a failing 

grade. Several years ago, I worked with the FTC to catch information brokers selling citizens’ personal financial information. The investigation revealed hundreds of Internet-based information brokers and private investigators advertising the sale of personal information, in violation of laws Congress has already passed, including Gramm-Leach-Bliley, the FCRA, the DPPA and the Unfair and 

Deceptive Trade Practices Act. 

Many of the illicit information brokers have subscriber access to 

legitimate information brokers similar to those at the table here at 

this moment. The illegitimate brokers, along with I.D. thieves, as 

we have learned, need the biographical information contained in 

the databases of the legitimate information brokers in order to 

carry out their crimes. 

Specifically, some will purchase the biographical data needed by 

means of a legitimate information broker via a fraudulent subscriber agreement, as in the ChoicePoint case, or via a reseller who 

obtains the information from a legitimate broker, then willingly 

violates the ‘‘no resale’’ clause of their contract. This is the worstkept secret in the information broker-private investigative world 

today. 

While a number of the major brokers have announced they will 

restrict access to certain subscriber classes, absent legislation, 

other companies will step in. But even if all legitimate information 

brokers were secure, the flow of information would continue. CrimiVerDate 0ct 09 2002 14:25 Jul 12, 2005 Jkt 022293 PO 00000 Frm 00041 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\22293.TXT SJUD4 PsN: CMORC
38

nals and others will just continue to access databases from the government and private sector. 

And there is a reason these databases are easily defeated. Far 

too often, personal biographical information, as we see for sale on 

the charts in the Committee room today, is the key to unlocking 

the databases. So even if Social Security numbers were not for sale 

on the Internet, the reality is Social Security numbers have been 

compromised in this country in many ways for such a long period 

that it is laughable that either government or commercial enterprises use the number or other biographical personal information 

as identifiers for maintaining security of databases. 

Yet, this is the method chosen by more than 50 percent of the 

Nation’s banks, telecommunications companies, hospitals, doctors’ 

offices, universities, utility providers, government programs and almost any government or commercial entity one can name. The bottom line: any information security system using personal biographical information as the primary security identifier is fatally flawed. 

Thank you. 

[The prepared statement of Mr. Douglas appears as a submission 

for the record.] 

Chairman SPECTER. Thank you very much, Mr. Douglas.

Mr. Sanford, I am advised that LexisNexis just yesterday announced a breach of security involving some 310,000 people. Did 

that announcement yesterday have any connection with this hearing scheduled for today? 

Mr. SANFORD. The announcement had everything to do with the 

conclusion of a review that I commenced in February of 2005. As 

I testified, we acquired the Seisint business in the fall of 2004. One 

of our integration teams became aware of some irregular billing activities in February. 

Chairman SPECTER. That is a no? 

Mr. SANFORD. That would be a no, Senator. 

Chairman SPECTER. You stated an investigation in February, but 

you knew about the breach in February? 

Mr. SANFORD. We became aware of some irregular billing activities in February. 

Chairman SPECTER. Did you know about the breach in February? 

Mr. SANFORD. I didn’t know what I had until I did an investigation, Senator. 

Chairman SPECTER. Well, I am still uncertain as to whether you 

knew about the breach. Did you have enough information—

Mr. SANFORD. We were not—

Chairman SPECTER. Let me finish the question, since I didn’t get 

an answer to the last one. 

Did you know in February that there was a breach? 

Mr. SANFORD. I knew in February that I had irregular billing activity in a handful of customer accounts. 

Chairman SPECTER. Well, why would it take until mid-April to 

make a determination sufficient to notify the people whose information had been breached? 

Mr. SANFORD. That is an excellent question and I am glad you 

have asked it because it seems to have been misreported in the 

press. We are not talking about an incident. In March, we made 

39

a statement acknowledging that we had discovered a handful of security breaches and we immediately made notice. 

Based on those incidents, I ordered a review going back some 27 

months in our business that we had—

Chairman SPECTER. Mr. Sanford, I don’t want to cut you off, but 

there are five minutes and I have got a lot of questions of this 

panel. I would like the specifics in writing focusing on why the people whose information was breached couldn’t have been notified 

earlier. 

Those people are all at risk and you have a duty to notify them 

at the earliest possible moment. So I want to know precisely what 

you did, what was the intensity of your investigation and whether 

it could have been done faster. 

Mr. SANFORD. I would be happy to provide that. 

Chairman SPECTER. Mr. Curling, I am advised that ChoicePoint 

had a breach in the past and did not report it. Is that true. 

Mr. CURLING. There has been a recent arrest, or conviction, rather, reported by the Secret Service that involved ChoicePoint information. My understanding is that the subpoena was issued on that 

individual in 2001. 

Chairman SPECTER. Well, see, I am having a hard relating your 

answer to my question. Did ChoicePoint have a breach of security 

and failed to report it and notify the people whose information had 

been breached? 

Mr. CURLING. Yes, sir, it would appear in 2001 that happened. 

Chairman SPECTER. And it was not reported? 

Mr. CURLING. No, it was not reported. 

Chairman SPECTER. Why not? 

Mr. CURLING. No one was made aware of it, sir. We turned over 

the information to law enforcement, didn’t know the purpose of 

their investigation. 

Chairman SPECTER. No one was made aware of it? Well, how 

about the person who turned it over to law enforcement? 

Mr. CURLING. I don’t think that person understood the purpose 

of the subpoena, sir. 

Chairman SPECTER. Well, where did that person stand in the 

company hierarchy? Somebody who has the authority to turn it 

over to law enforcement doesn’t know enough to say confidential information is now out and it ought to be reported and these people 

ought to be told about it? 

Mr. CURLING. Current circumstances would certainly cause that 

to happen. Going back four years—

Chairman SPECTER. Well, I am talking about before. Why not? 

Mr. CURLING. I can’t explain why someone four years ago 

didn’t—

Chairman SPECTER. Well, Mr. Curling and Mr. Sanford, we may 

well face the necessity for some really tough legislation that will 

have you do your duty. It is very, very disconcerting that 

ChoicePoint doesn’t make a report of it. A lot of people are at risk 

and subject to damage. 

I would like you also to provide more detailed information as to 

what you testified, Mr. Sanford, about identity theft insurance—

people have to pay for it—whether you have been sued by people 

whose information has been disclosed. 

40

Let me turn to the Social Security number question, Mr. 

Dempsey and Mr. Douglas. You need the Social Security number 

to report your wages and get that information to the Federal Government so they know what your Social Security claim is. 

What problem would arise if we legislated that you couldn’t use 

the Social Security number at all, except for purposes relating to 

collecting Social Security taxes and having the employee get the 

benefits? 

You may both answer. My time is now expired. 

Mr. DEMPSEY. Well, that was the original purpose, of course, 

Senator, and over the years a lot of people became dependent upon 

the Social Security number as an identifier for purposes unrelated 

to Social Security. For connecting people, it is not perfect, but it is 

better than name and address, and that is how people use it. 

Now, at the very least we need to begin to wean away from that. 

I think you would need some kind of implementation time frame 

to get people that are currently dependent upon the Social Security 

number for aggregating data and for knowing which Jim Dempsey 

it is—they use the Social Security number for that. I think we 

should right away stop using it as an authenticator, which is different from an identifier. People are using it to determine that 

someone calling up and saying he is Arlen Specter is, in fact, Arlen 

Specter, when the Social Security number, we know, is widely 

available. 

Chairman SPECTER. There are a lot of people with that name. 

[Laughter.] 

Mr. DEMPSEY. I can guarantee you that there are probably more 

than one, Senator. 

Chairman SPECTER. I doubt it, but okay. 

[Laughter.] 

Chairman SPECTER. Senator Leahy. 

Senator LEAHY. In the Senate, there is only one. 

Mr. DEMPSEY. That is true. 

Senator LEAHY. I understand what you mean, Mr. Dempsey. The 

name is not enough. 

Mr. Curling, the CEO of ChoicePoint recently wrote a book about 

the information industry entitled The Risk Revolution. In the book 

he said everyone should have a right of access to data that is used 

to make decisions about them, subject to law enforcement and national security exceptions. He also recommended that we expand 

the principles of the Fair Credit Reporting Act to all types of information—right to access, right to question the accuracy and prompt 

review, right to comment if a negative record is found to be inaccurate. The Fair Credit Reporting Act also includes procedures to 

delete inaccurate information and identifying sources that furnish 

disputed information. 

Does ChoicePoint support the expansion of these principles from 

fair credit to all types of information? 

Mr. CURLING. We certainly do, sir. 

Senator LEAHY. This past January 20, the Washington Post 

quoted a ChoicePoint executive as saying, ‘‘We do act as an intelligence agency gathering data, applying analytics.’’ He also reported that ChoicePoint acquired I2, Inc., and quoted an I2 company executive as saying, quote, ‘‘We are principally a company 

41

whose focus is all about converting large volumes of information 

into actionable intelligence,’’ close quote. 

The article described I2 as a company that uses software to head 

off crimes or attacks, not just investigate them after the fact—sort 

of something like the movie ‘‘Minority Report.’’ How would you 

head off a crime? How do you identify a potential crime or criminal? Do you have predictive algorithms or profiling, risk-scoring? It 

seems fascinating as a former prosecutor. Can you just put us all 

out of business? Can you tell who is going to commit a crime? 

Mr. CURLING. These are tools that ChoicePoint sells to law enforcement agencies. They are the ones that use the tools to try and 

figure out how to solve crimes, and largely the data they are using 

is data they gather on their own. I2 is a software company. It is 

a company that provides a robust analytic engine to link disparate 

data together so you can look for similarities. 

If two people don’t necessarily know each other but they both 

made phone calls to the same phone number, you can look for that 

kind of linkage through vast amounts of data. They use it as an 

analyst aid for an analyst to almost interact with the data 

iteratively and reach conclusions that they might otherwise have 

reached doing manual research, but in a much faster way. 

Senator LEAHY. To identify a crime before it happens? 

Mr. CURLING. Or just look at patterns to try and track down 

criminals that have suspicious behavior going on. 

Senator LEAHY. ChoicePoint also purchased—is it Bode Technology? 

Mr. CURLING. Yes, sir. 

Senator LEAHY. A company that specializes in the use of DNA to 

identify people. The CEO, Derek Smith, wrote in his book, ‘‘Biometrics provide an opportunity to shore up the society’s fundamental building blocks of identification through technology.’’

Biometrics is a technology with great potential, but there are 

concerns. Unlike a Social Security number which actually is 

changeable, with some difficulty, but can be changed, a fingerprint 

or other biometric compromised by a security breach can’t be replaced. There are technological limitations. We found that with facial recognition technology that that doesn’t always work. 

What types and how much biometric information, if any, is contained or accessible in the systems at ChoicePoint or any of its subsidiaries, and under what conditions is it used or provided and 

what are the protections? 

Mr. CURLING. We don’t warehouse biometric data. We don’t 

maintain biometric databases on behalf of anyone. Bode Labs is a 

forensic DNA laboratory that supports law enforcement activities 

on an outsource basis. That laboratory was the lab that identified 

the victims of the World Trade Center from a DNA perspective. 

That laboratory had a scientist over in Thailand recently for the 

tsunami aid. 

It is a law enforcement outsource laboratory that does very hightechnology DNA assistance in prosecution of cases. They receive 

samples directly from law enforcement. They manage the chain of 

custody of that sample and they turn it back over to law enforcement when the lab activities are processed. 

Senator LEAHY. Thank you. 

42

Mr. Dempsey, government relies more and more on the services 

and products of data brokers for law enforcement and homeland security efforts. Is this allowing the government to access and use information that otherwise it might not be allowed to under privacy 

and information laws? In other words, does it allow them to do a 

search that they wouldn’t be allowed to do if they were doing it directly through a government agency? 

Mr. DEMPSEY. Well, it does allow them to, in essence, outsource 

data collection activities outside of the Privacy Act. Right now, if 

the government is going to start a new collection of data, it needs 

to comply with the Privacy Act and it needs to perform a privacy 

impact assessment. But if it goes and buys that same data or subscribes to it, some of those rules don’t apply, and I think that is 

an issue that needs to be definitely included in the scope of these 

hearings and needs to be addressed in legislation. 

Senator LEAHY. Thank you. Thank you, Mr. Chairman. 

Chairman SPECTER. Thank you very much, Senator Leahy. 

Senator Feinstein.

Senator FEINSTEIN. Thank you very much. 

The California law went into effect in 2003. I would like to ask 

each of the people here representing companies to indicate if, prior 

to 2003, you had a breach and did not notify people. 

Mr. Sanford? 

Mr. SANFORD. I believe there were security breaches in the business that I acquired that I mentioned, Seisint. I believe there may 

have been a security breach in LexisNexis prior to 2003, and we 

did not make notice prior. 

Senator FEINSTEIN. Thank you. I appreciate the honesty. 

Mr. Curling? 

Mr. CURLING. Yes, ma’am, I previously indicated there was a 

breach that we didn’t notify them. 

Senator FEINSTEIN. Thank you. 

Ms. Barrett? 

Ms. BARRETT. The breach that we had in 2003 did span the enactment of the law in July. Our obligation as a provider, since the 

breach did not involve—

Senator FEINSTEIN. My question is did you have a breach prior 

to the 2003 law going into effect? 

Ms. BARRETT. Yes, the breach that we had did span it, but we 

did provide notice to our clients. 

Senator FEINSTEIN. Thank you. This is my point: If it weren’t for 

the California law, we would have no way of knowing breaches that 

have occurred. It is really only because of that law that we now 

know. We in no way, shape or form are able to pierce the depth 

of what has happened in this industry. 

Now, I would like to ask the question of each, how did the data 

breach or breaches occur and what has been done to correct it? 

Who would like to go first? 

Mr. Sanford? 

Mr. SANFORD. The data breaches that we have reported principally involve compromised passwords and I.D.s of legitimate customers, and that happened through a variety of methods. 

Senator FEINSTEIN. Could you explain ‘‘compromised?’’

43

Mr. SANFORD. Sure. Where a company has individual users, each 

person would have an I.D. and would have a password. A company 

may report to us that they notice search activity that showed up 

on their bill that they said that they didn’t do. 

Senator FEINSTEIN. Now, take a big company. How many people 

would have a password? 

Mr. SANFORD. In most companies, there would be individual I.D.s 

and individual passwords. There were some instances in—

Senator FEINSTEIN. But how many per company? 

Mr. SANFORD. It depends, Senator. You could have two. You 

could have 10,000. 

Senator FEINSTEIN. That is correct, so that a large bank like a 

Citibank could have a large number of individuals that would have 

passwords to the system, correct? 

Mr. SANFORD. I.D.s and passwords, that is correct. 

Senator FEINSTEIN. I am asking for speculation. I don’t know 

what they have, but this is a weak link, shall we say. 

Mr. SANFORD. Well, passwords and I.D.s are part of the security 

and when those password and I.D. protocols are not strong, then 

you do have a weak link in the system. What we have found is we 

have weak links in some of the passwords and I.D.s in some of our 

customer environments that were compromised and unauthorized 

persons gained access to those passwords and I.D.s and did 

searches. 

Sometimes that was because it was a weak password-I.D. combination. Sometimes that was because there may have been virus 

in that business and someone compromised it through criminal 

means. 

Senator FEINSTEIN. Right, and did you find out who that person 

was? 

Mr. SANFORD. We have referred all of these incidents to the U.S. 

Secret Service and it is an ongoing investigation. 

Senator FEINSTEIN. Were those persons found out? 

Mr. SANFORD. I don’t know. That is not the kind of information 

they share with me. 

Senator FEINSTEIN. And you didn’t think you would be interested 

in finding out? 

Mr. SANFORD. Well, as the agent in charge advised me, he will 

be briefing us on it as they conclude their investigation. 

Senator FEINSTEIN. You have had more than one breach, though. 

Mr. SANFORD. That is correct. 

Senator FEINSTEIN. So there are a number of people whose passwords have been compromised. 

Mr. SANFORD. That is correct. 

Senator FEINSTEIN. Which means they could have sold them for 

a lot of money to somebody else who got into the system. 

Mr. SANFORD. That is a possibility, so each password and I.D.—

Senator FEINSTEIN. But you have no knowledge. How many 

breaches have you had? 

Mr. SANFORD. We reported 59 incidents going back to the beginning of 2003. 

Senator FEINSTEIN. And these were all from compromised passwords? 

44

Mr. SANFORD. I believe all but four or five of them were through 

compromised password I.D.s. 

Senator FEINSTEIN. And you don’t know who compromised the 

passwords? 

Mr. SANFORD. I don’t know who did. 

Senator FEINSTEIN. Okay, that is fine. 

I want to go down the line on this and then back on what you 

have done. Mr. Curling, how many breaches have you had, total? 

Mr. CURLING. The breaches that we investigated and reported 

were a number between 45 and 50. It was an organized ring of 

fraudsters and they hijacked legitimate business identities or created false business identities and were able to get through our 

credentialing processes. We ultimately identified that activity when 

they were trying to set up accounts, but unfortunately and regrettably, accounts had been set up prior to that. 

Senator FEINSTEIN. Ms. Barrett? 

Ms. BARRETT. Yes. The breaches that we had in 2003 involved 

two different individuals. 

Senator FEINSTEIN. How many breaches have you had, total—has 

Acxiom had? 

Ms. BARRETT. These are the only two breaches. 

Senator FEINSTEIN. You have only had two breaches, okay. 

Ms. BARRETT. They involved a file transfer server sitting outside 

of our main system that was used to send information back and 

forth between our clients. They did not penetrate our main firewalls of the system. The data on this server belonged to our clients. 

The data was breached because an individual at a client location 

with legitimate access to that server downloaded the password file 

for that server and unencrypted a portion of the encrypted passwords, then used those passwords to access other people’s data. 

Senator FEINSTEIN. My time is up. Can I ask just one other question? I have sat here patiently all morning. 

Chairman SPECTER. Yes, you may, Senator Feinstein. 

Senator FEINSTEIN. Just one other question and this is on the 

subject of whether there should be a requirement that all data in 

these data companies be encrypted and there should be a prohibition on using PCs to hold this data. I am looking specifically at 

University of California data breaches which involved the names of 

over 700,000 people from thefts of personal computers. 

Would anyone care to comment on that? 

Mr. DEMPSEY. Senator, I would only say that encryption is not 

as easy to do as it sounds and I would hate to see the Federal Government get into the posture of dictating specific security measures 

that companies or institutions like universities have to take. 

Senator FEINSTEIN. So you think it is okay for personal data, for 

somebody to be walking around with a computer with 700,000 

names in it? 

Mr. DEMPSEY. Well, I think there is a separate question about 

the physical custody of that kind of—at some level, that is a physical custody issue. If you look at the Gramm-Leach-Bliley regulations, they talk about technical, physical and administrative safeguards. And I think without, again, dictating what is the right balance of those, all three have to be considered. And I agree with you 

that people have clearly gotten far too lax about storage of data. 

45

Senator FEINSTEIN. Thank you. My time is up. 

Chairman SPECTER. Thank you, Senator Feinstein. 

Senator Schumer.

Senator SCHUMER. Thank you, Mr. Chairman, and I have a question I am going to ask of the whole panel, but take your pencils 

out because it has a few parts. I want to ask your opinion on various ways to deal with identity theft, all of which are embodied in 

the legislation that we have. If you could give us a yes or no answer, that would be great and save time. If you can’t, keep your 

explanation as short as possible. 

Do you support the goal of regulating data merchants, similar to 

the way we regulate credit bureaus I would say, but certainly data 

merchants? Do you support the idea of creating a one-stop shop to 

help consumers get their identity back, as we have done in the 

FTC? They have done something, but they are not close to what is 

needed. 

Do you support disclosure laws for companies that plan to sell 

your information? Do you support making any company that has 

sensitive personal information on its consumers take reasonable 

steps to protect it? That would be the words of the law—‘‘reasonable steps to protect it.’’ Do you support limiting the sale of people’s 

Social Security numbers on a narrow needs basis—law enforcement 

and things like that? 

Just two more. Would you support rules authenticating customers? This relates to ChoicePoint, which actually sold the information to criminals. And would you support increased background 

examination of those within your companies and other companies 

who have access to sensitive personal information? 

I realize that is a long question. It will be my only one and I 

await your answers. 

Mr. Sanford? 

Mr. SANFORD. Senator, I don’t know if I got it all down, but I 

think the first one was with respect to regulating the industry 

similar to FCRA. I think some of the portions of the FCRA could 

be appropriate. I would like to see specifically what the wording 

would be on that. I would be glad to work with you on that. 

A one-stop shop at the FTC. 

Senator SCHUMER. But, in general, you support regulating data 

companies like yours in terms of how they deal with the data, data 

merchants? 

Mr. SANFORD. I certainly think the safeguards as contained in 

GLBA would certainly be a step in the right direction. 

Senator SCHUMER. Thank you. 

Mr. SANFORD. I don’t know anybody who could argue with a onestop shop at the FTC and additional funding to help, given the pervasiveness of identity theft. I am not sure I understand the provision on disclosure laws on companies. I didn’t quite get the rest of 

it down here in my notes. 

We would support data safeguards. We would support legislation—

Senator SCHUMER. That is disclosure to the individual, whoever 

gives it in, that we may be giving or selling that information to 

somebody. 

46

Mr. SANFORD. I don’t know, unless I saw the wording, whether 

I could support that, given the number of transactions we are talking about. 

Senator SCHUMER. Okay. 

Mr. SANFORD. Limiting the sale of SSNs. Certainly, there are 

limits today on the use of personally sensitive information and I 

support the limits that are there. I think there could be greater 

limits on the display of information, but perhaps not the access because of the importance of using some of that sensitive information 

to provide services to detect fraud, for example. 

And then on rules authenticating customers, I think I would support, again, GLBA, and I think reasonable safeguards would pretty 

much pick that up and say you have got to make sure you are 

doing business with legitimate customers. 

Senator SCHUMER. And then the last one was background checks 

on the people who handle the sensitive information. 

Mr. SANFORD. I would have to learn more about that, but again 

I think that would be part of an overall safeguard program and 

make sure that the people who are dealing with sensitive data—

Senator SCHUMER. Thank you. 

Mr. Curling? 

Mr. CURLING. In the interest of time, Senator, obviously I would 

like to read the specific proposals, but I would answer yes, in general, to all of the questions. 

Senator SCHUMER. Thank you. 

Ms. Barrett? 

Ms. BARRETT. Yes, I would also say yes, in general, to all of the 

questions. Many of what you are suggesting are already policies of 

ours. 

Senator SCHUMER. Mr. Dempsey? 

Mr. DEMPSEY. I have never seen a vote count like this, Senator. 

I am a ‘‘yes’’ on all as well. 

Senator SCHUMER. And Mr. Douglas? 

Mr. DOUGLAS. Absolutely. 

Senator SCHUMER. Mr. Chairman, I yield back my 32 remaining 

seconds. 

Chairman SPECTER. It is greatly appreciated, Senator Schumer. 

Senator SCHUMER. I knew it would be. 

Chairman SPECTER. You now owe the yield-back bank only 17 

hours and 23 seconds. 

Senator SCHUMER. No good deed goes unpunished. 

Chairman SPECTER. On behalf of Senator DeWine, I am going to 

direct this question to you, Mr. Sanford. Senator DeWine could not 

be here. I understand that LexisNexis has been working with the 

National Center for Missing and Exploited Children and law enforcement to help find abducted children. Can you explain to the 

Committee how LexisNexis contributes to this effort? 

Mr. SANFORD. Senator, the National Center, as you know, has 

been in existence for nearly 20 years. It provides critical assistance 

to find abducted and missing children. I think in the last 20 years, 

they have recovered 85,000 children. 

What the National Center does is we provide our service to them 

at no charge. They work with law enforcement and what they have 

determined is the best way to find an abducted child in the first 

47

48 hours is to do searches and to find the relationships of the custodial and non-custodial parents. And by doing those searches with 

law enforcement, they are able to recover many of the abducted 

and missing children rapidly. 

Chairman SPECTER. Well, thank you very much, Mr. Sanford, 

Mr. Curling, Ms. Barrett, Mr. Dempsey and Mr. Douglas.

Senator LEAHY. Could I ask one more question? 

Chairman SPECTER. Sure, Senator Leahy. 

Senator LEAHY. Mr. Dempsey, you and I have had discussions 

over the years on some of these issues and I have appreciated very 

much your input. I think about public records, and let’s just take 

one example. You have whatever court handles divorce matters in 

your State and you may have divorce records in there which contain a number of things because of payments—Social Security 

numbers and maybe even the names of the banks that the litigants 

have, and so on. 

If you were to walk into that court and ask, they would say, well, 

we can give you the judge’s findings, the pleadings, of course, but 

we can’t give you this page that has all the rest. So you kind of 

felt you were pretty safe because had to go to court, to court, to 

court, to court and be turned down. 

Now, if it is all electronic, you don’t have that inconvenience. Is 

there a responsibility on the part of data brokers who might go 

through every single court in the Nation pulling up Jones v. Jones

or whatever—do they have a responsibility in weeding out the 

things that the courts would normally expect not to be shown? 

Mr. DEMPSEY. Well, I think, Senator, you are on to a very important point, which is just because information is in a public record, 

does it mean that there are no privacy issues, particularly in terms 

of accuracy, particularly in terms of sensitivity? 

The Supreme Court held in the Reporter’s Committee case and 

in the DPPA case, the Reno v. Condon case, that even if information is publicly available, interests in accuracy apply, and the computerized compilation of that data into a single database changes 

the privacy equation. So you can’t just say, oh, it is public record 

information, therefore there are no concerns. 

There are still concerns about the accuracy in the transcription 

of that data and still concerns about the fact that, as you say, in 

bankruptcy court there is a lot of very sensitive information. I 

know that bankruptcy judges are struggling with that specifically. 

Senator LEAHY. Adoption courts; probate courts handle adoptions. Courts have allegations that are made in initial filings in a 

case, but the case may be heard six months later and all the allegations thrown out. 

Mr. DEMPSEY. So I think that that has to absolutely be part of 

the equation here. Under the Fair Credit Reporting Act, we have 

created this cycle of responsibility where the data furnishers have 

a responsibility for accuracy, the data aggregators and the credit 

reporting agencies have a responsibility, and the users have a responsibility in terms of accuracy. 

It is a little bit different in the public record system, in that the 

government entities are not pushing that data. It is being pulled 

by sending people out, but we still have to somehow address that, 

Senator, and work on what is the responsibility for accuracy of the 

48

compilier of that so-called public record information because it is 

being used against people in ways that have implications. 

Senator LEAHY. And some of it is there for a very, very specific 

purpose. I mean, you could actually have on public record what 

kind of alarm systems you have in your house from an appraisal 

that had been done of the house. 

Mr. DEMPSEY. Well, for example, criminal history records. There 

is a very important public policy interest in having arrests be public, in having court proceedings be public. But we also know that 

a lot of arrests don’t result in convictions for the charges. We have 

put limits in the fair credit reporting area on reporting of old arrests reporting of so-called naked arrests. I think we need to make 

sure that those kinds of accuracy responsibilities spread across the 

data landscape. 

Senator LEAHY. Thank you. Thank you, Mr. Chairman. I appreciate again your holding this hearing. I think it is extremely important and I am glad to see the Committee doing this kind of oversight. 

Chairman SPECTER. Well, thank you, Senator Leahy. You were 

the first one on the Committee to ask for it and I promptly responded and said yes. I think it has been a very, very productive 

hearing and I believe that there will be some very firm Federal legislation coming out of this issue. 

Thank you all very much. 

[Whereupon, at 12:00 p.m., the Committee was adjourned.] 

[Questions and answers and submissions for the record follow.] 

[Additional material is being retained in the Committee files.]

49


22293.001
50


22293.002
51


22293.003
52


22293.004
53


22293.005
54


22293.006
55


22293.007
56


22293.008
57


22293.009
58


22293.010
59


22293.011
60


22293.012
61


22293.013
62


22293.014
63


22293.015
64


22293.016
65


22293.017
66


22293.018
67


22293.019
68


22293.020
69


22293.021
70


22293.022
71


22293.023
72


22293.024
73


22293.025
74


22293.026
75


22293.027
76


22293.028
77


22293.029
78


22293.030
79


22293.031
80


22293.032
81


22293.033
82


22293.034
83


22293.035
84


22293.036
85


22293.037
86


22293.038
87


22293.039
88


22293.040
89


22293.041
90


22293.042
91


22293.043
92


22293.044
93


22293.045
94


22293.046
95


22293.047
96


22293.048
97


22293.049
98


22293.050
99


22293.051
100


22293.052
101


22293.053
102


22293.054
103


22293.055
104


22293.056
105


22293.057
106


22293.058
107


22293.059
108


22293.060
109


22293.061
110


22293.062
111


22293.063
112


22293.064
113


22293.065
114


22293.066
115


22293.067
116


22293.068
117


22293.069
118


22293.070
119


22293.071
120


22293.072
121


22293.073
122


22293.074
123


22293.075
124


22293.076
125


22293.077
126


22293.078
127


22293.079
128


22293.080
129


22293.081
130


22293.082
131


22293.083
132


22293.084
133


22293.085
134


22293.086
135


22293.087
136


22293.088
137


22293.089
138


22293.090
139


22293.091
140


22293.092
141


22293.093
142


22293.094
143


22293.095
144


22293.096
145


22293.097
146


22293.098
147


22293.099
148


22293.100
149


22293.101
150


22293.102
151


22293.103
152


22293.104
153


22293.105
154


22293.106
155


22293.107
156


22293.108
157


22293.109
158


22293.110
159


22293.111
160


22293.112
161


22293.113
162


22293.114
163


22293.115
164


22293.116
165


22293.117
166


22293.118
167


22293.119
168


22293.120
169


22293.121
170


22293.122
171


22293.123
172


22293.124
173


22293.125
174


22293.126
175


22293.127
176


22293.128
177


22293.129
178


22293.130
179


22293.131
180


22293.132
181


22293.133
182


22293.134
183


22293.135
184


22293.136
185


22293.137
186


22293.138
187


22293.139
188


22293.140
189


22293.141
190


22293.142
191


22293.143
192


22293.144
193


22293.145
194


22293.146
195


22293.147
196


22293.148
197


22293.149
198


22293.150
199


22293.151
200


22293.152
201


22293.153
202


22293.154
203


22293.155
204


22293.156
205


22293.157
206


22293.158
207


22293.159
208


22293.160
209


22293.161
210


22293.162
211


22293.163
212


22293.164
213


22293.165
214


22293.166
215


22293.167
216


22293.168
217


22293.169
218


22293.170
219


22293.171
220


22293.172
221


22293.173
222

Æ


22293.174