```

[Senate Hearing 109-1087]
[From the U.S. Government Publishing Office]

                                                       S. Hrg. 109-1087
 
                IDENTITY THEFT AND DATA BROKER SERVICES 

=======================================================================

                                HEARING

                               before the

                         COMMITTEE ON COMMERCE,
                      SCIENCE, AND TRANSPORTATION
                          UNITED STATES SENATE

                       ONE HUNDRED NINTH CONGRESS

                             FIRST SESSION

                               __________

                              MAY 10, 2005

                               __________

    Printed for the use of the Committee on Commerce, Science, and 
                             Transportation

                               ----------
                         U.S. GOVERNMENT PRINTING OFFICE 

61-787 PDF                       WASHINGTON : 2010 

For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; 
(202) 512-1800 Fax: (202) 512-2250 Mail: Stop SSOP, 
Washington, DC 20402-0001 

       SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                       ONE HUNDRED NINTH CONGRESS

                             FIRST SESSION

                     TED STEVENS, Alaska, Chairman
JOHN McCAIN, Arizona                 DANIEL K. INOUYE, Hawaii, Co-
CONRAD BURNS, Montana                    Chairman
TRENT LOTT, Mississippi              JOHN D. ROCKEFELLER IV, West 
KAY BAILEY HUTCHISON, Texas              Virginia
OLYMPIA J. SNOWE, Maine              JOHN F. KERRY, Massachusetts
GORDON H. SMITH, Oregon              BYRON L. DORGAN, North Dakota
JOHN ENSIGN, Nevada                  BARBARA BOXER, California
GEORGE ALLEN, Virginia               BILL NELSON, Florida
JOHN E. SUNUNU, New Hampshire        MARIA CANTWELL, Washington
JIM DeMINT, South Carolina           FRANK R. LAUTENBERG, New Jersey
DAVID VITTER, Louisiana              E. BENJAMIN NELSON, Nebraska
                                     MARK PRYOR, Arkansas
             Lisa J. Sutherland, Republican Staff Director
        Christine Drager Kurth, Republican Deputy Staff Director
                David Russell, Republican Chief Counsel
   Margaret L. Cummisky, Democratic Staff Director and Chief Counsel
   Samuel E. Whitehorn, Democratic Deputy Staff Director and General 
                                Counsel
             Lila Harper Helms, Democratic Policy Director

                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on May 10, 2005.....................................     1
Statement of Senator Dorgan......................................    25
Statement of Senator Inouye......................................     1
    Prepared statement...........................................     2
Statement of Senator Kerry.......................................    38
Statement of Senator Lautenberg..................................     3
    Prepared statement...........................................     3
Statement of Senator Bill Nelson.................................     2
Statement of Senator Pryor.......................................    27
Statement of Senator Smith.......................................     5
    Chart, 2005 Data Security Incidents..........................    32
    Prepared statement of Senator McCain.........................    32
Statement of Senator Stevens.....................................     1
Statement of Senator Vitter......................................     6

                               Witnesses

Barrett, Jennifer T., Chief Privacy Officer, Acxiom Corporation..    46
    Prepared statement...........................................    48
Curling, Douglas C., President/Chief Operating Officer, 
  ChoicePoint Inc...............................................    12
    Prepared statement...........................................    15
Frank, Esq., Mari J., Attorney, Mari J. Frank, Esq. & Associates.    68
    Prepared statement...........................................    73
Kurtz, Paul B., Executive Director, Cyber Security Industry 
  Alliance (CSIA)................................................    53
    Prepared statement...........................................    55
Rotenberg, Marc, President/Executive Director, Electronic Privacy 
  Information Center (EPIC)......................................    58
    Prepared statement...........................................    60
Sanford, Kurt P., President/CEO, U.S. Corporate and Federal 
  Government Markets, LexisNexis.................................     6
    Prepared statement...........................................     8

                                Appendix

Dempsey, James X., Executive Director, Center for Democracy & 
  Technology, statement before the Senate Committee on the 
  Judiciary, April 13, 2005......................................   107
Hillebrand, Gail, Senior Attorney, Consumers Union, prepared 
  statement......................................................    99
Ireland, Oliver I., Attorney, Morrison & Foerster LLP; on behalf 
  of Visa U.S.A. Inc., statement before the Subcommittee on 
  Commerce, Trade, and Consumer Protection of the Committee on 
  Energy and Commerce, United States House of Representatives, 
  May 11, 2005...................................................   114
Response to written questions submitted by Hon. Daniel K. Inouye 
  to 
  Paul B. Kurtz..................................................   116
Response to written questions submitted by Hon. Bill Nelson to:
    Jennifer T. Barrett..........................................   118
    Kurt P. Sanford..............................................   121

                IDENTITY THEFT AND DATA BROKER SERVICES

                              ----------                              

                         TUESDAY, MAY 10, 2005

                                       U.S. Senate,
        Committee on Commerce, Science, and Transportation,
                                                    Washington, DC.
    The Committee met, pursuant to notice, at 2:30 p.m. in room 
SR-253, Russell Senate Office Building, Hon. Ted Stevens, 
Chairman of the Committee, presiding.

            OPENING STATEMENT OF HON. TED STEVENS, 
                    U.S. SENATOR FROM ALASKA

    The Chairman. Mr. Sanford, Mr. Curling, let me welcome you, 
gentlemen. And I thank the witnesses for coming, and appreciate 
their willingness to appear to discuss the recent data breaches 
that left exposed the personal information of thousands of 
consumers. Over the recess, my staff attempted to steal my 
identity, and I regret to say they were successful. So, they 
demonstrated to me, when I came back from this recess, just how 
easy it really is to steal an identity.
    This is the first of several hearings that our committee is 
going to conduct to have a better understanding of data 
brokerage services, as well as how data brokers handle personal 
consumer information.
    This hearing is intended to discuss the recent data 
breaches and what the private industry is doing to mitigate the 
possibility of future breaches. The Committee will revisit this 
issue next month as we look to develop legislative solutions 
that might better protect consumers from future breaches.
    We believe we must be careful to strike a balance between 
assuring the security of certain types of personal information, 
while not inhibiting the legitimate flow of information that is 
vital to our economy.
    Now, it's my intention to turn the chair over to Senator 
Smith when he arrives, Senator. I've got a conflict today. But 
let me yield to my Co-Chairman, Senator Inouye.

              STATEMENT OF HON. DANIEL K. INOUYE, 
                    U.S. SENATOR FROM HAWAII

    Senator Inouye. I thank you very much, Mr. Chairman.
    I agree with your words. And I'd like to point out that, 
since January, there have been at least 32 major data security 
incidents potentially affecting 5.2 million Americans. These 
incidents only came to light because of a California law that 
requires disclosure of data security breaches. No one knows how 
many undisclosed breaches may have occurred prior to the 
implementation of the California law. And equally disturbing is 
the possibility that the full impact of these breaches may 
never be known, and millions of Americans remain unaware of 
their vulnerability to identity theft.
    So, I look forward to hearing from the witnesses, and I 
thank them for appearing. And I ask that my full statement be 
made part of the record.
    The Chairman. Your statement will be made part of the 
record, and all the statements that the Senators have.
    [The prepared statement of Senator Inouye follows:]

 Prepared Statement of Hon. Daniel K. Inouye, U.S. Senator from Hawaii
    I thank Chairman Stevens and Chairman Smith for holding a hearing 
today on this important issue of data brokers.
    Since January, there have been at least 32 major data security 
incidents potentially affecting 5.2 million Americans. And those are 
just the data breaches we know about due to the disclosure law in the 
State of California. There are many more that have not been made 
public.
    The identity theft that results from these data breaches can wreak 
havoc on the lives of consumers--weathly and poor--for many years.
    Recognizing the risks of computerizing personal data, Congress, in 
1970, passed the Fair Credit Reporting Act. The FCRA requires credit 
reporting agencies to protect consumer information, and use it only for 
limited purposes. These agencies also are responsible for vetting their 
customers.
    Data brokers are now collecting different sensitive, personal 
information, yet their operations are not governed by any Federal law, 
and only one State law.
    We will hear today from the largest data brokers about the steps 
they are taking to better secure their data, and to properly vet their 
customers. We applaud you for taking those steps. But I am worried more 
about the hundreds of smaller data brokers who have no incentive to 
change their ways since there is no law governing their behavior.
    Almost every American--including this Senator--has their personal 
information stored in these databases whether we like it or not. This 
committee is responsible for making sure that this sensitive, personal 
information is not used for identity fraud that can ruin any family's 
financial future. We look forward to our witnesses helping us reach 
this goal.

    The Chairman. Senator, do you have a statement?

                STATEMENT OF HON. BILL NELSON, 
                   U.S. SENATOR FROM FLORIDA

    Senator Bill Nelson. Yes, sir, I do, Mr. Chairman, because 
one of the vehicles in front of the Committee is a bill that--
two bills that I have filed, one with Senator Schumer that's 
more of a comprehensive package.
    As I have met with identity victims, Mr. Chairman, one of 
the great parts of frustration for them is, once their identity 
is stolen, they don't know where to go to get it back. They go 
to local law enforcement; they send them to somebody at the 
State. The State sends somebody to the Federal. The reason my 
two bills have been referred here is that my solution to that 
is using the FTC as the repository, first of all, to give them 
some teeth in the law in which to regulate information brokers 
who heretofore have not been regulated as information brokers, 
and, second, to have a place where the consumer can go--one 
place, one-stop shopping--in order to get their identity back. 
And so, in the legislation, we create the Office of Identity 
Theft in our legislation, within the FTC, that creates that 
one-stop shopping.
    And our legislation would mandate that the companies must 
reasonably protect this consumer information that is now 
collected on billions of bits of information on virtually every 
one of us in America, and, as a result of what we've seen 
happen thus far, if we don't do something about this, Mr. 
Chairman, none of us are going to have any identity left. It's 
going to require the companies--these are the information 
brokers--to notify consumers when a security breach occurs. And 
the only reason that we know about this, Mr. Chairman Stevens, 
is the fact that there is a California State statute that 
requires just that; otherwise, we wouldn't have known about 
this. It's going to tighten the commercial usage of Social 
Security numbers, and it's going to create an Assistant 
Secretary of Cybersecurity within the Department of Homeland 
Security.
    And so, I'm really looking forward to the discussion today 
about these ideas.
    Thank you, Mr. Chairman.
    The Chairman. Senator Lautenberg?

            STATEMENT OF HON. FRANK R. LAUTENBERG, 
                  U.S. SENATOR FROM NEW JERSEY

    Senator Lautenberg. Yes, Mr. Chairman, I ask consent that 
my full statement be included in the record.
    But I do want to say a few things.
    And before I came here, I was CEO of a company called ADP, 
and--I was one of the founders of that company--and we were 
terribly conscious of the records that we had, because, through 
our company, we pay one out of six workers in the American 
private-sector labor market. One out of six are paid through 
the ADP company. And I thought our principal obligation, Mr. 
Chairman, was the protection of the identity of those people. 
And there is a treasure trove there that could be sold. We 
refused to do it, but--that wasn't our business, anyway--but 
this now has become such a problem, and I congratulate Senator 
Nelson for his initiative here, to try and get something done.
    But when you look at the numbers of identity--the people 
who are affected by identity theft, it's staggering--2002, 
404,000 people reported identify-theft complaints; in 2004, 
just 2 years later, the number climbed by more than 230,000 
more people who were exposed to identity theft.
    So, Mr. Chairman, I congratulate you for moving the agenda 
here on matters of great importance.
    [The prepared statement of Senator Lautenberg follows:]

            Prepared Statement of Hon. Frank R. Lautenberg, 
                      U.S. Senator from New Jersey
    Mr. Chairman, thank you for holding this important hearing on the 
``data brokerage'' industry, and the role and responsibilities of firms 
that compile, store, and sell sensitive, personal information.
    The recent security breaches at the Nation's largest data brokerage 
firms have left millions of Americans increasingly vulnerable to 
identity theft and scams. Overall, some 10 million Americans were 
victimized by identity thieves last year.
    Mr. Chairman, before I ran for the Senate, I was a Co-Founder and 
CEO of a company called ADP, or Automatic Data Processing, which 
processes payrolls and maintains personnel records, and currently pays 
one out of every six private-sector workers in the United States.
    Throughout my years at ADP, we always recognized our obligation to 
maintain the confidentiality of the information that was entrusted to 
us. So I am extremely concerned about the security breaches and 
management failures that have recently exposed sensitive, personal 
information about millions of Americans.
    In the wrong hands, this data about an individual can be used to 
ruin that person's credit rating . . . their finances . . . and even 
their good name.
    In the past, personal information on individuals was available, but 
it was stored in multiple locations and often only on paper. It took 
significant effort to accumulate the information necessary to damage 
the credit or identity of a person.
    Today, however, technology permits faster and consolidated access 
to personal data in fewer databases. Collecting and selling personal 
information is a big business--but no matter how big it becomes, it 
must never overshadow the rights of the American people. Their privacy 
should never be compromised or neglected.
    Victims of identity theft often spend years of their precious time, 
and large amounts of their hard-earned money, to repair their financial 
records and credit history. In some cases, job opportunities are lost 
and loans are refused. In 2002, there were just under 404,000 reported 
identity theft complaints nationwide. In 2004, that number climbed to 
635,000.
    Mr. Chairman, our laws must ensure that companies protect personal 
information with great care. I look forward to hearing from our two 
panels today.
    Thank you, Mr. Chairman.

    Senator Lautenberg. And, if I may indulge the Committee 
just one half-minute more, today is the last day for Rudy 
Brioche, who's been with me for these couple of years. Rudy is 
leaving me to go work for the FCC. And so, this is his last 
hearing, and I want to publicly thank him for his wonderful 
work for all of us.
    The Chairman. We wish him well. We'll keep him busy.
    [Laughter.]
    The Chairman. Let me just say, turning the hearing over to 
Senator Smith, I was surprised when my staff presented me the 
information they got from a series of places. For $65, they 
were told they could get my Social Security number. I don't 
know if you've done this, but in the report that they got on 
me, I found my daughter's rental property in California and 
some of my son's activities. And he's, unfortunately, a junior 
out in California. I also found that there are probably two or 
three other people in this community right here that have the 
same basic name, Theodore F. Stevens; they're not all the same 
middle name. It's been suggested that I should change my name, 
and use my middle name now if I want to maintain my own 
identity.
    I think this is a very serious thing, and we want to hear 
from you all. As I said, Senator Smith, this is just the first 
of a series of hearings. I do think we've got several bills now 
that have been introduced into Congress to address this, and 
it's going to be a very difficult thing for us to handle.
    So, we're not going to handle it on the basis of listening 
sessions, like this one, because basic information is going to 
come from people like the witnesses who are where today. Again, 
I thank them very much for being willing to join us.
    Senator Smith, it's your Chair.
    Senator Bill Nelson. Mr. Chairman, could I just add one 
thing to what Senator Stevens has said? This card that each one 
of us has, which is Bank of America, and it is the Senate 
travel card, the records are missing on 60 Senators. I am one 
of them. Now, we hope that this information is not stolen, but 
the records of over a million people, of which 60 United States 
Senators are included within that, those records are missing. 
If they are in the wrong hands, then, because they have the 
information on that card, they've got all of our Social 
Security numbers, and they've got detailed financial 
information. And this is, increasingly, what we're going to be 
facing.
    The Chairman. Well, I'm embarrassed to say, Senator, my 
staff doesn't trust me with that card.
    [Laughter.]
    The Chairman. Senator?
    Voice: Zero balance.
    [Laughter.]

              STATEMENT OF HON. GORDON H. SMITH, 
                    U.S. SENATOR FROM OREGON

    Senator Smith. [presiding] Well, thank you, Mr. Chairman. 
And I know you have another responsibility at some point, and 
I'm happy to sit in your stead.
    But I think this is a very, very important hearing, as all 
of my colleagues have indicated, and I read, with horror, that 
the FTC is reporting that over ten million Americans are 
victimized by identity thieves every year. These numbers 
translate into losses of over $55 billion per year, averaging 
over $10,000 stolen per fraudulent incident. In 2005, alone, 
there were at least 35 known incidents of data breaches 
potentially affecting over five million individuals. My State 
of Oregon ranks ninth in the Nation for fraud complaints and 
identity theft.
    So, today's hearing will focus on recent data-broker 
services and their relationship to identity-theft enforcement. 
Although this hearing will not focus on any particular 
legislative proposal, the Committee, as the Chairman has noted, 
will hold subsequent hearings with the FTC to discuss 
legislative solutions that we need to pursue on identify theft.
    At this hearing, the Committee will examine data-broker 
services, the recent data breaches, and the treatment of data 
brokers under existing Federal privacy laws. Specifically, we 
will have the chance to better understand the recent security 
breaches at ChoicePoint and LexisNexis and how the information 
industry has responded to prevent future breaches. We'll also 
explore public and private solutions to detect and prevent 
identity theft and fraud, and ensure that personal information 
is secure and protected from those who attempt to perpetrate 
these crimes.
    Protecting sensitive information is an issue of great 
importance for all Americans, and this issue does not register 
Democrat or Republican. Consumers should have confidence, when 
they share their information with others, that their 
information will be protected. At the same time, the ability of 
legitimate companies to access personal information certainly 
does facilitate commerce and continues to benefit consumers. 
Data-broker companies perform important commercial and public 
functions through their ability to quickly and securely access 
consumer data.
    Now, we look forward to working with all our colleagues in 
coming up with legislative solutions to this problem. We need 
to make sure that this legislation strikes the right balance to 
ensure the continued existence of critical services while 
ensuring the security of personal information to prevent its 
misuse and subsequent breaches.
    We've been joined by Senator Vitter on this Committee, and, 
Senator, if you have an opening statement, we'll hear from you 
before we go to our witnesses.

                STATEMENT OF HON. DAVID VITTER, 
                  U.S. SENATOR FROM LOUISIANA

    Senator Vitter. Mr. Chairman, I don't have an opening 
statement. Thank you, Chairman Stevens, for leading this 
matter. It's, unfortunately, a very legitimate area of growing 
concern because of these recent breaches and because of the 
phenomenon across the country. So, thank you for your, Senator 
Stevens, and others' leadership.
    Senator Smith. Thank you, Senator Vitter.
    We will, now hear first from Mr. Kurt Sanford, President 
and Chief Executive Office of U.S. Corporate and Federal 
Government Markets, LexisNexis, from Miamisburg, Ohio.
    Thank you, Mr. Sanford. The mike is yours.

       STATEMENT OF KURT P. SANFORD, PRESIDENT/CEO, U.S. 
      CORPORATE AND FEDERAL GOVERNMENT MARKETS, LexisNexis

    Mr. Sanford. Chairman Stevens, Senator Inouye, Senator 
Smith, and distinguished members of the Committee, good 
afternoon. My name is Kurt Sanford. I am the President and 
Chief Executive Officer for Corporate and Federal Markets at 
LexisNexis. I appreciate the opportunity to be here today to 
discuss the important issues surrounding identity theft, fraud, 
and data security.
    LexisNexis is a leading provider of authoritative legal 
public records and business information, playing a vital role 
in supporting government, law enforcement, and business 
customers who use our information services for important uses, 
including detecting and preventing identity theft and fraud, 
locating suspects, and finding missing children.
    One of the important uses of our products and services 
provided by LexisNexis is to detect and prevent identity theft 
and fraud. The FTC has indicated that the total cost of 
identity fraud for businesses and individuals is approximately 
$50 billion per year. In 2004, 9.3 million consumers were 
victimized by identity fraud.
    Until recently, it was not fully appreciated that identity 
theft is part of a larger problem of identity fraud. Identity 
fraud is the use of false identifiers, fraudulent documents, or 
a stolen identity in the commission of a crime. Both industry 
and government have asked LexisNexis to develop solutions to 
help address this evolving problem.
    Financial institutions, online retailers, and other 
businesses have turned to LexisNexis to help them detect and 
prevent identity theft and fraud. With the use of LexisNexis, a 
major bank-card issuer experienced a 77 percent reduction in 
the dollar losses due to fraud associated with identity theft. 
Our products are becoming increasingly necessary to combat 
identity fraud associated with Internet transactions, where 
high-dollar merchandise, such as computers and other 
electronics, are sold via credit card. Lower fraud costs to 
businesses ultimately mean lower cost and greater efficiencies 
for consumers.
    While we work hard to provide our customers with effective 
products, we also recognize the importance of protecting the 
privacy of the consumer information in our databases. We have 
privacy policies, practices, and procedures in place to protect 
this information. Our Chief Privacy Officer and Privacy Policy 
Review Board work together to ensure that LexisNexis has strong 
policies to help safeguard consumer privacy.
    We also have multilayer security processes and procedures 
in place to protect our systems and the information contained 
in our databases. Maintaining security is not a static process; 
it requires continuously evaluating and adjusting our security 
procedures to address the new threats we face every day.
    Even with these safeguards, we discovered, earlier this 
year, some security incidents at our Seisint business, which we 
acquired last September. In February 2005, a LexisNexis 
integration team became aware of some billing irregularities 
and unusual usage patterns with several customer accounts. Upon 
further investigation, we discovered that unauthorized persons 
using IDs and passwords of legitimate Seisint customers may 
have accessed personally identifying information such as Social 
security numbers and driver's license numbers. No personal 
financial, credit, or medical information was involved, since 
LexisNexis and Seisint do not collect that type of information. 
In March, we notified approximately 30,000 individuals whose 
personally identifying information may have been unlawfully 
accessed.
    Based on these incidents at Seisint, I ordered an extensive 
review of data-search activity going back to January 2003 at 
our Seisint unit and across all LexisNexis databases that 
contained personally identifying information. We completed that 
review on April 11th and concluded that unauthorized persons, 
primarily using IDs and passwords of legitimate Seisint 
customers, may have accessed personally identifying information 
on approximately 280,000 additional individuals. At no time was 
the LexisNexis or Seisint technology infrastructure hacked into 
or penetrated, no customer data was accessed or compromised.
    We sincerely regret these incidents and any adverse impact 
they may have on the individuals whose information may have 
been accessed. We took quick action to notify those 
individuals. We are providing all individuals with a 
consolidated credit report and credit-monitoring services. For 
those individuals who do become victims of fraud, we will 
provide counselors to help them clear their credit reports of 
any information relating to fraudulent activity. We will also 
provide them with identify-theft insurance to cover expenses 
associated with restoring their identity and repairing their 
credit reports.
    We've learned a great deal from the security incidents at 
Seisint and are making substantial changes in our business 
practices and policies across all LexisNexis businesses to help 
prevent any future incidents. I have included the details of 
these enhancements in my written statement.
    I would like to focus the remainder of my time on policy 
issues being considered to further enhance data security, and 
address the growing problem of identity theft and fraud.
    LexisNexis would support the following legislative 
approaches.
    First, we support requiring notification in the event of a 
security breach where there is a significant risk of harm to 
consumers. In addition, we believe that it's important that any 
such proposal contain Federal preemption.
    Second, we would support the adoption of data-security 
safeguards modeled after the safeguard rules of the Gramm-
Leach-Bliley Act.
    Finally, it's important that any legislation strike the 
right balance between protecting privacy and ensuring continued 
access to critically important information.
    Thank you, again, for the opportunity to be here today to 
provide the Committee with our company's perspective on these 
important public-policy issues. We look forward to working with 
the Committee as it considers these important issues.
    [The prepared statement of Mr. Sanford follows:]

 Prepared Statement of Kurt P. Sanford, President/CEO, U.S. Corporate 
               and Federal Government Markets, LexisNexis
Introduction
    Good morning. My name is Kurt Sanford. I am the President and Chief 
Executive Officer for Corporate and Federal Markets at LexisNexis. I 
appreciate the opportunity to be here today to discuss the important 
issues surrounding identity theft and fraud, and data security.
    LexisNexis is a leading provider of authoritative, legal, public 
records, and business information. Today, over three million 
professionals--lawyers, law enforcement officials, government agencies' 
employees, financial institution representatives, and others--use the 
LexisNexis services. Government agencies, businesses, researchers, and 
others rely on information provided by LexisNexis for a variety of 
important uses.
    One of the important uses of products and services provided by 
LexisNexis is to detect and prevent identity theft and fraud. In 2004, 
9.3 million consumers were victimized by identity fraud. Credit card 
companies report $1 billion in losses each year from credit card fraud. 
Although the insidious effects of identity theft are fairly well known, 
until recently it was not fully appreciated that identity theft is part 
of the larger problem of identity fraud. Identity fraud, which 
encompasses identity theft, is the use of false identifiers, false or 
fraudulent documents, or a stolen identity in the commission of a 
crime. It is a component of most major crimes and is felt around the 
world today. As a result, both industry and government have asked 
LexisNexis to develop solutions to help address this evolving problem.
    Financial institutions, online retailers, and others depend on 
products and services provided by LexisNexis to help prevent identity 
theft and fraud. With the use of a LexisNexis solution called Fraud 
Defender, a major bank card issuer experienced a 77 percent reduction 
in the dollar losses due to fraud associated with identity theft and 
credit card origination.
    LexisNexis products are becoming increasingly necessary to combat 
identity fraud associated with Internet transactions where high-dollar 
merchandise such as computers and other electronic equipment are sold 
via credit card. Lower fraud costs ultimately mean lower costs and 
greater efficiencies for consumers.
    The following are some other examples of the important ways in 
which the services of LexisNexis are used by customers:
    Locating and recovering missing children--Customers like the 
National Center for Missing and Exploited Children rely on LexisNexis 
to help them locate missing and abducted children. Since 1984, the 
Center has assisted law enforcement in recovering more than 85,000 
children. Over the past 4 years, information provided by LexisNexis has 
been instrumental in a number of the Center's successful recovery 
efforts.
    Locating suspects and helping make arrests--Many Federal, State and 
local law enforcement agencies rely on LexisNexis to help them locate 
criminal suspects, and to identify witnesses to a crime. LexisNexis 
works closely with Federal, State, and local law enforcement agencies 
on a variety of criminal investigations. For example, the Beltway 
Sniper Task Force in Washington, D.C., used information provided by 
LexisNexis to help locate one of the suspects wanted in connection with 
that case. In another case, information provided by LexisNexis was 
recently used to locate and apprehend an individual who threatened a 
District Court Judge and his family in Louisiana.
    Preventing money laundering--LexisNexis has partnered with the 
American Bankers Association to develop a tool used by banks and other 
financial institutions to verify the identity of new customers to 
prevent money laundering and other illegal transactions used to fund 
criminal and terrorist activities. This tool allows banks to meet 
Patriot Act and safety and soundness regulatory requirements.
    Supporting homeland security efforts--LexisNexis worked with the 
Department of Homeland Security Transportation Safety Administration 
(TSA) in developing the Hazardous Materials Endorsement Screening 
Gateway System. This system allows TSA to perform background checks on 
commercial truck drivers who wish to obtain an endorsement to transport 
hazardous materials.
    Locating parents delinquent in child support payments--Both public 
and private agencies rely on LexisNexis to locate parents who are 
delinquent in child support payments and to locate and attach assets in 
satisfying court-ordered judgments. The Association for Children for 
the Enforcement of Support (ACES), a private child-support recovery 
organization, has had tremendous success in locating non-paying parents 
using LexisNexis.
    These are just a few examples of how our information products are 
used to help consumers by detecting and preventing fraud, strengthening 
law enforcement's ability to apprehend criminals, protecting homeland 
security and assisting in locating missing and abducted children.
Types of Information Maintained by LexisNexis Risk Solutions
    The information maintained by LexisNexis falls into the following 
three general classifications: public record information, publicly 
available information, and non-public information.
    Public record information. Public record information is information 
originally obtained from government records that are available to the 
public. Land records, court records, and professional licensing records 
are examples of public record information collected and maintained by 
the government for public purposes, including dissemination to the 
public.
    Publicly available information. Publicly available information is 
information that is available to the general public from non-
governmental sources. Telephone directories are an example of publicly 
available information.
    Non-public information. Non-public information is information about 
an individual that is not obtained directly from public record 
information or publicly available information. This information comes 
from proprietary or non-public sources. Non-public data maintained by 
LexisNexis consists primarily of information obtained from either motor 
vehicle records or credit header data. Credit header data is the non-
financial identifying information located at the top of a credit 
report, such as name, current and prior address, listed telephone 
number, Social Security number, and month and year of birth.
Privacy
    LexisNexis is committed to the responsible use of personal 
identifying information. We have privacy policies in place to protect 
the consumer information in our databases. Our Chief Privacy Officer 
and Privacy and Policy Review Board work together to ensure that 
LexisNexis has strong privacy policies in place to help protect the 
information contained in our databases. We also undertake regular 
third-party privacy audits to ensure adherence to our privacy policies.
    LexisNexis has an established Consumer Access Program that allows 
consumers to review information on them contained in the LexisNexis 
system. While the information provided to consumers under this program 
is comprehensive, it does not include publicly available information 
such as newspaper and magazine articles, and telephone directories 
contained in the LexisNexis system.
    LexisNexis also has a consumer opt-out program that allows 
individuals to request that information about themselves be suppressed 
from selected databases under certain circumstances. To opt-out of 
LexisNexis databases, an individual must provide an explanation of the 
reason or reasons for the request. Examples of reasons include:

   You are a State, local or Federal law enforcement office or 
        public official and your position exposes you to a threat of 
        death or serious bodily harm;

   You are a victim of identity theft; or

   You are at risk of physical harm.

    Supporting documentation is required to process the opt-out 
request. While this opt-out policy applies to all databases maintained 
by our recently acquired Seisint business, it is limited to the non-
public information databases in the LexisNexis service. The policy does 
not currently apply to public records information databases maintained 
by LexisNexis. We are currently evaluating what steps we can take to 
better publicize our opt-out program and extend the program to all 
public records databases in the LexisNexis service.
Security
    LexisNexis has long recognized the importance of protecting the 
information in our databases and has multiple programs in place for 
verification, authorization and IT security. Preventive and detective 
technologies are deployed to mitigate risk throughout the network and 
system infrastructure and serve to thwart potentially malicious 
activities. LexisNexis also has a multi-layer process in place to 
screen potential customers to ensure that only legitimate customers 
have access to sensitive information contained in our systems. Our 
procedures include a detailed authentication process to determine the 
validity of business licenses, memberships in professional societies 
and other credentials. We also authenticate the documents provided to 
us to ensure they have not been tampered with or forged.
    Only those customers with a permissible purpose under applicable 
laws are granted access to sensitive data such as driver's license 
information and Social Security numbers. In addition, customers are 
required to make express representations and warranties regarding 
access and use of sensitive information and we limit a customer's 
access to information in LexisNexis products according to the purposes 
for which they seek to use the information.
    Maintaining security is not a static process--it requires 
continuously evaluating and adjusting our security processes, 
procedures and policies. High-tech fraudsters are getting more 
sophisticated in the methods they use to access sensitive information 
in databases. We continuously adapt our security procedures to address 
the new threats we face every day from those who seek to unlawfully 
access our databases. We undertake regular third-party security audits 
to test the security of systems and identify any potential weaknesses.
    Even with the multi-layer safeguards in place at LexisNexis, we 
discovered earlier this year that unauthorized persons primarily using 
IDs and passwords of legitimate customers may have accessed personal 
identifying information at our recently acquired Seisint business. In 
February 2005, a LexisNexis integration team became aware of some 
billing irregularities and unusual usage patterns with several customer 
accounts. At that point we contacted the U.S. Secret Service. The 
Secret Service initially asked us to delay notification so they could 
conduct their investigation. About a week later, we publicly announced 
these incidents and within a week sent out notices to approximately 
30,000 individuals.
    The investigation revealed that unauthorized persons, primarily 
using IDs and passwords of legitimate customers, may have accessed 
personal-identifying information, such as Social Security numbers 
(SSNs) and driver's license numbers (DLNs). In the majority of 
instances, IDs and passwords were stolen from Seisint customers that 
had legally permissible access to SSNs and DLNs for legitimate 
purposes, such as verifying identities and preventing and detecting 
fraud. No personal financial, credit, or medical information was 
involved since LexisNexis and Seisint do not collect such information. 
At no time was the LexisNexis or Seisint technology infrastructure 
hacked into or penetrated nor was any customer data residing within 
that infrastructure accessed or compromised.
    Based on the incidents at Seisint, I directed our teams to conduct 
an extensive review of data-search activity at our Seisint unit, and 
across all LexisNexis databases that contain personal identifying 
information. In this review, we analyzed search activity for the past 
twenty-seven months to determine if there were any other incidents that 
potentially could have adversely impacted consumers. We completed that 
review on April 11, 2005. As a result of this in-depth review, we 
discovered additional incidents where there was some possibility that 
unauthorized persons may have accessed personal identifying information 
of approximately 280,000 additional individuals.
    We deeply regret these incidents and any adverse impact they may 
have on the individuals whose information may have been accessed. We 
took quick action to notify the identified individuals. We are 
providing all individuals with a consolidated credit report and credit 
monitoring services. For those individuals who do become victims of 
fraud, we will provide counselors to help them clear their credit 
reports of any information relating to fraudulent activity. We will 
also provide them with identity-theft expense insurance coverage up to 
$20,000 to cover expenses associated with restoring their identity and 
repairing their credit reports.
    We have learned a great deal from the security incidents at Seisint 
and are making substantial changes in our business practices and 
policies across all LexisNexis businesses to help prevent any future 
incidents. These include:

   Changing customer password security processes to require 
        that passwords for both system administrators and users be 
        changed at least every 90 days;

   Suspending customer passwords of system administrators and 
        users that have been inactive for 90 days;

   Suspending customer passwords after five unsuccessful login 
        attempts and requiring them to contact Customer Support to 
        ensure security and appropriate reactivation;

   Further limiting access to the most sensitive data in our 
        databases by truncating SSNs displayed in non-public documents 
        and narrowing access to full SSNs and DLNs to law enforcement 
        clients and a restricted group of legally authorized 
        organizations, such as banks and insurance companies; and

   Educating our customers on ways they can increase their 
        security.

Laws Governing LexisNexis Compilation and Dissemination of Identifiable 
        Information
    There are a wide range of Federal and State privacy laws to which 
LexisNexis is subject in the collection and distribution of personal 
identifying information. These include:
    The Gramm-Leach-Bliley Act. Social Security numbers are one of the 
two most sensitive types of information that we maintain in our systems 
and credit headers are the principal commercial source of Social 
Security numbers. Credit headers contain the non-financial identifying 
information located at the top of a credit report, such as name, 
current and prior address, listed telephone number, Social Security 
number, and month and year of birth. Credit header data is obtained 
from consumer reporting agencies.\1\ The compilation of credit header 
data is subject to the Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. 
Sec. Sec. 6801 et seq., and information subject to the GLBA cannot be 
distributed except for purposes specified by the Congress, such as the 
prevention of fraud.
---------------------------------------------------------------------------
    \1\ Consumer reporting agencies are governed by the Fair Credit 
Reporting Act (``FCRA''), 15 U.S.C. Sec. Sec. 1681 et seq. Some 
information services, such as Seisint's Securint service and LexisNexis 
PeopleWise, also are subject to the requirements of the FCRA.
---------------------------------------------------------------------------
    Driver's Privacy Protection Act. The compilation and distribution 
of driver's license numbers and other information obtained from 
driver's licenses are subject to the Driver's Privacy Protection Act 
(DPPA), 18 U.S.C. Sec. Sec. 2721 et seq., as well as State laws. 
Information subject to the DPPA cannot be distributed except for 
purposes specified by the Congress, such as fraud prevention, insurance 
claim investigation, and the execution of judgments.
    Telecommunications Act of 1996.  Telephone directories and similar 
publicly available repositories are a major source of name, address, 
and telephone number information. The dissemination of telephone 
directory and directory assistance information is subject to the 
requirements of the Telecommunications Act of 1996, as well as State 
law.
    FOIA and other Open Records Laws: Records held by local, State, and 
Federal governments are another major source of name, address, and 
other personally identifiable information. The Freedom of Information 
Act, State open record laws, and judicial rules govern the ability of 
LexisNexis to access and distribute personally identifiable information 
obtained from government agencies and entities. See, e.g., 5 U.S.C. 
Sec. 552.
Other Laws
    Unfair and Deceptive Practice Laws: Section 5 of the Federal Trade 
Commission Act, and its State counterparts, prohibit companies from 
making deceptive claims about their privacy and security practices. 
These laws have served as the basis for enforcement actions by the 
Federal Trade Commission and state attorneys general for inadequate 
information security practices. The consent orders settling these 
enforcement actions typically have required companies to implement 
information security programs that conform to the standards set forth 
in the GLBA Safeguards Rule, 16 C.F.R. Part 314.
    Information Security Laws: A growing body of State law imposes 
obligations upon information service providers to safeguard the 
identifiable information they maintain. For example, California has 
enacted two statutes that require businesses to implement and maintain 
reasonable security practices and procedures and, in the event of a 
security breach, to notify individuals whose personal information has 
been compromised. See California Civil Code Sec. Sec. 1798.81.5, 
1798.82-84.
Legislative Measures LexisNexis Supports
    We recognize that additional legislation may be necessary to 
further enhance data security and address the growing problem of 
identity theft and fraud. LexisNexis supports the following legislative 
approaches:
    Data Security Breach Notification. We support requiring 
notification in the event of a security breach where there is 
substantial risk of harm to consumers. It is important that there is an 
appropriate threshold for when individuals actually would benefit from 
receiving notification, such as where the breach is likely to result in 
misuse of customer information. In addition, we believe that it is 
important that any such legislation contain Federal preemption to 
insure that companies can quickly and effectively notify individuals 
and not struggle with complying with multiple, potentially conflicting 
and inconsistent State laws.
    Adoption of Data Security Safeguards for Information Service 
Providers Modeled After the GLBA Safeguards Rule. LexisNexis supports 
the adoption of data security protections for information service 
providers modeled after the Safeguards Rule of the GLBA.
    Increased penalties for identity theft and other cybercrimes and 
increased resources for law enforcement. LexisNexis strongly encourages 
legislation that imposes more stringent penalties for identity theft 
and other cybercrimes. Additionally, consumers and industry alike would 
benefit from enhanced training for law enforcement and an expansion of 
the resources available to investigate and prosecute the perpetrators 
of identity theft and cybercrime. Too many of our law enforcement 
agencies do not have the resources to neutralize these high-tech 
criminals.
    Finally, LexisNexis strongly encourages that any legislation 
considered strike a balance between protecting privacy and providing 
legitimate businesses, organizations, and government agencies with 
access to critical information that enables them to fulfill their 
important missions.
    I appreciate the opportunity to be here today to discuss the 
important issues surrounding identify theft and fraud and data 
security. I look forward to working with the Members of this Committee 
as you consider these important public policy issues.

    Senator Smith. Thank you very much. Our next witness is Mr. 
Douglas C. Curling, President and Chief Operating Officer of 
ChoicePoint, of Alpharetta, Georgia.

  STATEMENT OF DOUGLAS C. CURLING, PRESIDENT/CHIEF OPERATING 
                   OFFICER, ChoicePoint INC.

    Mr. Curling. Thank you.
    Chairman Stevens, Chairman Smith----
    The Chairman. Pull that mike up toward you, please? Thank 
you.
    Mr. Curling. Certainly. Better?
    Chairman Stevens, Chairman Smith, Ranking Member Inouye and 
Members of the Committee, good morning. I'm Doug Curling, 
President and Chief Operating Officer of ChoicePoint.
    ChoicePoint has, on several occasions, provided Congress 
with testimony about the recent improper data access and the 
criminals who perpetrated this fraud, the steps we are taking 
to protect affected consumers, and the measures we're taking to 
prevent similar violations from occurring in the future. I have 
provided the Committee with details of these actions in my 
written testimony.
    At ChoicePoint, we recognize that in an increasingly risky 
world, information and technology can be used to help create a 
safer, more secure society. At the same time, we know, and have 
been painfully reminded by recent events, that there can be 
negative consequences to the improper access of personally 
identifiable data. As a result of these experiences, we've made 
fundamental changes to our business model and products to 
prevent this from happening again in the future. I hope you see 
in ChoicePoint a company that has listened to consumers, to 
privacy experts, and to government officials, and learned from 
this experience.
    Accordingly, we've responded rapidly and in fundamental 
ways. We've provided benefits to potentially affected consumers 
that no other information company had done before and several 
companies have since emulated, including voluntary nationwide 
notification, dedicated call centers and websites, free three-
bureau credit reports, and 1 year of credit monitoring at our 
cost. Once again, we extend our apology on behalf of our 
company to those who have been potentially affected.
    We learned that there are few places for consumers to turn 
to if their identity is stolen. This, alone, increases the fear 
and anxiety associated with identity theft. For this reason, we 
have recently formed a partnership with the Identity Theft 
Resource Center, a leading and well-respected nonprofit 
organization dedicated exclusively to assisting identity-theft 
victims.
    Most importantly, we have shifted our focus to ensuring our 
products and services provide a direct benefit to consumers or 
to society as a whole. While this has meant exiting an entire 
market, we decided that consumer interest must come first. We 
have already made broad changes to our products, limiting 
access to sensitive, personally identifiable information, and 
more changes are under development.
    Last year, we helped more than 100 million people obtain 
fairly priced home and auto insurance. More than seven million 
Americans get jobs through our pre-employment screening 
services, and we helped more than one million consumers obtain 
expedited copies of their own vital records--birth, death, and 
marriage certificates. These transactions were started by 
consumers, with their permission, and they provide a clear, 
direct benefit to them.
    Not all of our work is as obvious, but the value is. At a 
time when the news is filled with crimes committed against 
children, we're helping our Nation's religious institutions and 
youth-serving organizations protect those in our society who 
are least able to protect themselves. Our products and services 
have identified 11,000 undisclosed felons among those seeking 
to volunteer with children, 1,055 with convictions for crimes 
against children, 42 of which who were registered sex 
offenders.
    Consumers, businesses, and nonprofits are not the only ones 
that rely on ChoicePoint. In fact, government officials have 
recently testified to Congress that they could not fulfill 
their missions of protecting our country and its citizens 
without the help of ChoicePoint and others in our industry. 
Last month, ChoicePoint supported the U.S. Marshal Service in 
Operation Falcon, which served approximately 10,000 warrants in 
a single day.
    Mr. Chairman, apart from what we do, I also understand that 
the Committee is interested in how our business is regulated by 
Federal legislation, as well as various State regulations. 
Approximately 60 percent of ChoicePoint's business is driven by 
consumer-initiated transactions, most of which are regulated by 
the FCRA. These include pre-employment screening, auto- and 
home-insurance underwriting services, tenant screening 
services, and facilitating the delivery of vital records 
directly to consumers.
    Nine percent of ChoicePoint's business is related to 
marketing services, none of which include the distribution of 
personally identifiable information. Even so, we are regulated 
by State and Federal Do Not Mail and Do Not Call legislation, 
and, for some services, the FCRA.
    Five percent of ChoicePoint's business is related to 
supporting law enforcement agencies in pursuit of their 
investigative missions through information and data services.
    Six percent of our business supports law firms, financial 
institutions, and general business to help mitigate fraud 
through data and authentication services.
    The final 20 percent of our business consists of software 
and technology services that do not include the distribution of 
personally identifiable information.
    Although a majority of our products are already governed by 
the FCRA, we believe additional regulation will give consumers 
greater protections while strengthening our business model. I, 
therefore, want to conclude by stating for the record 
ChoicePoint's position on future regulation of our industry.
    We support independent oversight and increased 
accountability for those who handle personally identifiable 
information, including public records. This oversight should 
extend to all entities, including public-sector, academic, and 
other private-sector organizations that handle such data.
    We support a preemptive national law that would provide for 
notification to consumers, ensuring that the burden of notice 
follows the responsibility for breach.
    ChoicePoint supports providing consumers with the right to 
access and question the accuracy of public-record information 
used to make decisions about them, consistent with the 
principles of the FCRA. There are technical and logistical 
issues that will need to be solved, but they are solvable.
    We've already taken steps to restrict the display of Social 
Security and driver's license numbers, and would support 
legislation to restrict the display of Social Security numbers, 
modeling existing law, including GLB and FCRA.
    And, finally, we support increased resources for law 
enforcement efforts to combat identity theft, and stronger 
penalties for the theft of personally identifiable information.
    We have all witnessed the significant benefits to society 
that can come with the proper use of information, but we've 
been reminded firsthand the damage that can be caused when 
people with ill intent access sensitive consumer data.
    As a company, we have re-dedicated our efforts to creating 
a safer, more secure society. We look forward to participating 
in continued discussion of these issues. And I would be pleased 
to answer any questions you may have.
    [The prepared statement of Mr. Curling follows:]
  Prepared Statement of Douglas C. Curling, President/Chief Operating 
                       Officer, ChoicePoint Inc.
    Chairman Stevens, Ranking Member Inouye and members of the 
Committee,
    Good morning, I am Doug Curling, President and Chief Operating 
Officer of ChoicePoint. I have been with the company since its 
inception in 1997. ChoicePoint has on several occasions provided 
Congress with testimony about the recent improper data access and the 
criminals who perpetrated this fraud, the steps we are taking to 
protect affected consumers, and the measures that we are taking to 
prevent similar violations from occurring in the future.
    As you know, California has been the only State that requires 
consumers to be notified of a potential breach of personally 
identifiable information. We not only followed California law, we built 
upon it and voluntarily notified consumers who may have been impacted 
across the country, and we did that before anyone called upon us to do 
so. We've also taken other steps to help assist and protect the 
consumers who may have been harmed in this incident--first, we've 
arranged for a dedicated website and toll-free number for affected 
consumers where they can access additional information; second, we're 
providing, free of charge, a three-bureau credit report; and third, 
we're providing, free of charge, a one year subscription to a credit 
monitoring service.
    In addition to helping those affected consumers, we've taken strong 
remedial action and made fundamental changes to our business and 
products:

   ChoicePoint has decided to discontinue the sale of 
        information products that contain personally identifiable 
        information unless those products and services meet one of 
        three tests:

        1.  The product supports consumer driven transactions such as 
        insurance, employment and tenant screening, or provides 
        consumers with access to their own data;

        2.  The product provides authentication or fraud prevention 
        tools to large accredited corporate customers where consumers 
        have existing relationships. For example, information tools for 
        identity verification, customer enrollment and insurance 
        claims; or

        3.  When personally identifiable information is needed to 
        assist Federal, State or local government and criminal justice 
        agencies in their important missions.

   Additionally, we've strengthened ChoicePoint's customer 
        credentialing process and are re-credentialing broad sections 
        of our customer base. Our new process will require more 
        stringent due diligence such as bank references and site visits 
        before allowing businesses access to personally identifiable 
        information.

   Third, we've created an independent office of Credentialing, 
        Compliance and Privacy that will ultimately report to our Board 
        of Directors' Privacy Committee. This office is led by Carol 
        DiBattiste, the former Deputy Administrator of the 
        Transportation Security Administration, and a former senior 
        prosecutor in the Department of Justice with extensive 
        experience in the detection and prosecution of financial fraud.

   Finally, we've appointed Robert McConnell, a 28-year veteran 
        of the Secret Service and former chief of the Federal 
        Government's Nigerian Organized Crime Task Force, to serve as 
        our liaison to law enforcement officials. In this role, he will 
        work aggressively to ensure that criminal activities are 
        investigated and prosecuted to the fullest extent possible. He 
        will also help us ensure that our security and safeguard 
        procedures continue to evolve and improve.

    Obviously, our investigation as well as those of law enforcement 
continues and if we identify additional instances of fraud related to 
personally identifiable information we will provide notice.
    At ChoicePoint, we recognize that in an increasingly risky world, 
information and technology can be used to help create a safer, more 
secure society. At the same time, we know, and have been painfully 
reminded by recent events, that there can be negative consequences to 
the improper access to personally identifiable data. As a result of 
these experiences, we've made fundamental changes to our business model 
and products to prevent this from happening in the future. I hope you 
see in ChoicePoint a company that has listened--to consumers, privacy 
experts and government officials--and learned from this experience. 
Accordingly, we have responded rapidly and in fundamental ways.

   We have provided benefits to potentially affected consumers 
        that no other information company had done before and that 
        several companies have since emulated--including voluntary 
        nationwide notification, dedicated call centers and websites, 
        free three-bureau credit reports and one year of credit 
        monitoring at our cost. Once again, we extend our apology on 
        behalf of our company to those who have been potentially 
        affected.

   We learned that there are few places for consumers to turn 
        for help if their identity is stolen. This alone increases the 
        fear and anxiety associated with identity theft. For this 
        reason, we have recently formed a partnership with the Identity 
        Theft Resource Center--a leading and well respected non-profit 
        organization dedicated exclusively to assisting identity theft 
        victims.

   Most importantly, we have shifted our focus to ensuring our 
        products and services provide a direct benefit to consumers or 
        to society as a whole. While this has meant exiting an entire 
        market, we decided that consumer interests must come first. We 
        have already made broad changes to our products--limiting 
        access to personally identifiable information--and more changes 
        are under development.

    Mr. Chairman, before delving into the specifics of various policy 
proposals, perhaps it would be helpful if I gave Members of the 
Committee a brief overview of our company, the products we provide and 
some insight as to how we are currently regulated.
    The majority of transactions our business supports are initiated by 
consumers. Last year, we helped more than 100 million people obtain 
fairly priced home and auto insurance, more than seven million 
Americans get jobs through our pre-employment screening services, and 
we helped more than one million consumers obtain expedited copies of 
their family's vital records--birth, death and marriage certificates. 
These transactions were started by consumers with their permission, and 
they provide a clear, direct benefit to consumers.
    Not all of our other work is as obvious--but the value of it is. At 
a time when the news is filled with crimes committed against children, 
we're helping our Nation's religious institutions and youth-serving 
organizations protect those in our society who are least able to 
protect themselves. Our products or services have identified 11,000 
undisclosed felons among those volunteering or seeking to volunteer 
with children--1,055 with convictions for crimes against children. 
Forty-two of those felons were registered sex offenders. In addition, 
using information and tools supplied by us, the National Center for 
Missing and Exploited Children has helped return hundreds of children 
to their loved ones.
    Consumers, businesses and non-profits are not the only ones that 
rely on ChoicePoint. In fact, government officials have recently 
testified to Congress that they could not fulfill their missions of 
protecting our country and its citizens without the help of ChoicePoint 
and others in our industry. Last month, ChoicePoint supported the U.S. 
Marshals Service in Operation Falcon, which served approximately 10,000 
warrants in a single day for crimes ranging from murder to white-collar 
fraud.
    Mr. Chairman, apart from what we do, I also understand that the 
Committee is interested in how our business is regulated by Federal 
legislation, as well as various State regulations, including the Fair 
Credit Reporting Act (FCRA) and the recently enacted companion FACT 
Act, the Gramm-Leach-Bliley Act (GLB), and the Driver's Privacy 
Protection Act (DPPA).

   Approximately 60 percent of ChoicePoint's business is driven 
        by consumer initiated transactions, most of which are regulated 
        by the FCRA. These include pre-employment screening, auto and 
        home insurance underwriting services, tenant screening 
        services, and facilitating the delivery of vital records to 
        consumers.

   Nine percent of ChoicePoint's business is related to 
        marketing services, none of which include the distribution of 
        personally identifiable information. Even so, we are regulated 
        by State and Federal ``Do Not Mail'' and ``Do Not Call'' 
        legislation and, for some services, the FCRA.

   Five percent of ChoicePoint's business is related to 
        supporting law enforcement agencies in pursuit of their 
        investigative missions through information and data services.

   Six percent of our business supports law firms, financial 
        institutions and general business to help mitigate fraud 
        through data and authentication services.

   The final 20 percent of our business consists of software 
        and technology services that do not include the distribution of 
        personally identifiable information.

    Although a majority of our products are already governed by the 
FCRA and other Federal and State legislation, a small percentage of our 
business is not subject to the same level of regulation. We believe 
additional regulation will give consumers greater protections while 
strengthening our business model. I, therefore, want to state for the 
record, ChoicePoint's positions on future regulation of our industry.

   We support independent oversight and increased 
        accountability for those who handle personally identifiable 
        information, including public records. This oversight should 
        extend to all entities including public sector, academic and 
        other private sector organizations that handle such data.

   We support a preemptive national law that would provide for 
        notification to consumers, ensuring that the burden of notice 
        follows the responsibility for breach and that consumers do not 
        become de-sensitized to such notices. We also support 
        notification to a single law enforcement point of contact when 
        personally identifiable information has fallen into 
        inappropriate hands.

   ChoicePoint supports providing consumers with the right to 
        access and question the accuracy of public record information 
        used to make decisions about them consistent with the 
        principles of FCRA. There are technical and logistical issues 
        that will need to be solved, but they are solvable.

   We have already taken steps to restrict the display of full 
        Social Security numbers and would support legislation to 
        restrict the display of full Social Security numbers modeling 
        existing law including GLB and FCRA while extending those 
        principles to public record information. Providing uniformity 
        as to which portion of a Social Security number should be 
        masked would be an important step.

   Finally, we support increased resources for law enforcement 
        efforts to combat identity theft and stronger penalties for the 
        theft of personally identifiable information.

    We have all witnessed the significant benefits to society that can 
come with the proper use of information. But we have been reminded, 
first-hand, the damage that can be caused when people with ill intent 
access sensitive consumer data.
    As a company, we have rededicated our efforts to creating a safer, 
more secure society. We look forward to participating in continued 
discussion of these issues and would be pleased to answer any questions 
you might have.

    Senator Smith. Thank you very much.
    For the benefit of my colleagues, the order is, after my 
questions, Senator Inouye, Senator Nelson, Senator Lautenberg, 
and Senator Vitter. We've been joined now by Senator Dorgan and 
Senator Pryor. If that's all right with you, gentlemen, we'll 
go in that order.
    Mr. Sanford, I think I heard you say that some 300,000 have 
had their security breached within your company. I guess my 
question is, have all these individuals, including, I believe, 
about 9,000 Oregonians, received a consolidated credit report? 
And are they getting any credit-monitoring services from you 
all?
    Mr. Sanford. Senator, when we announced the security 
breaches in March, we mailed notice to approximately 30,000 
individuals within the same week, modeled our notice after 
California legislation, provided toll-free numbers for them to 
call to take advantage of those reports. April 11th, we also 
made notice of the additional incidents we discovered at our 
Seisint business. Again, within the week, we mailed notices to 
all 280,000. About 4 percent of the people that we've mailed 
notices to have responded.
    Senator Smith. And can you provide any update as to how 
many of those individuals actually experienced theft as a 
result of their identities being discovered?
    Mr. Sanford. It's a tricky question on what is ``theft,'' 
because of different state interpretations, but, in terms of 
financial losses, of the 12,800-or-so people who have notified 
us, the process is to provide them the credit reports and then 
a monitoring service. And if there was any indication of any 
fraud or financial losses that may have occurred, we have a set 
of counselors, professionals, to do that. We've referred about 
a dozen people to those counselors. All of those, except for 
one, have been resolved to show that there was no problem. 
Sometimes consumers just forget they have a credit card.
    Law enforcement has advised us of ten individuals that--in 
their investigation--that there may have been some loss. Seven 
of those were related to people opening AOL accounts or making 
credit inquiries under somebody else's identity. Three people 
may have suffered some financial loss, although law 
enforcement's not clear whether it's related to the breach in 
our system. We, personally, contacted, or tried to contact, all 
ten of those; I think we've reached eight--personally tried to 
enroll them all into our services; I think half of them 
actually took us up on that.
    Senator Smith. Thank you.
    Mr. Curling, I was encouraged to hear of the technological 
sorts of steps you have taken to protect Social Security 
numbers and driver's licenses. Is that something that has not 
been available until now? And is that a technological fix that 
you think actually makes less legislation necessary on our 
part?
    Mr. Curling. Well, the steps we've taken are a combination 
of technology changes and product offerings. We've completely 
changed the types of businesses we sell products to, and the 
circumstances under which, even if they're allowed to get 
access to that product under the law, we will choose to sell 
them products. So, most of the changes we made had to do with 
withdrawing from markets where there's, in our opinion, 
difficulty credentialing customers, particularly small 
businesses that, for a company like ChoicePoint, whose 
preponderance of revenue is in other markets that are unrelated 
to these kind of public-record offerings, just isn't in our 
commercial best interests to pursue.
    We have, however, taken steps and tried to change the 
products that we deliver to customers that we continue to 
serve, restricting access to Social Security numbers and 
driver's license numbers, just as a business practice, because 
we think, given the propensity to--of identity theft out there 
now, it's something everybody needs to step up to and go--we've 
got to find a way to link data correctly together by limiting 
the display of that Social Security number or other personal 
identifier.
    Senator Smith. Is it the case that the public is aware of 
all--however many security breaches have occurred at 
ChoicePoint?
    Mr. Curling. Well, I don't--I would presume the public is 
paying attention to this topic, as is everybody else. In the 
breaches that we've investigated and noticed, we indicated it 
was about 45 to 50 accounts that had been set up by a group of 
fraudsters. We noticed all of those folks and offered them the 
services I provided in my oral and written testimony.
    Senator Smith. Isn't it true that there was a breach 5 
years ago that just became public?
    Mr. Curling. Yes, we became aware--I, personally, became 
aware very recently of a breach that took place in the latter 
part of 2001, where we apparently got a subpoena in a 
California subsidiary, responded to that subpoena, working with 
law enforcement, closed an account down, and didn't hear 
anything else about it again until the latter part of 2004. 
Back then, going back four or 5 years, I think that the 
practice of many of us, including our company, was to work with 
law enforcement to investigate potential crimes, turn over 
information to them, prosecute the perpetrators, and law 
enforcement had the responsibility to notify and communicate 
with victims. Obviously, since the California notice law has 
gone into place, our practices have changed substantially, and 
we now spend a lot more time trying to research all kinds of 
matters to make sure we can comply with that law, and that 
something like that would be communicated much more rapidly up 
the organization, going forward.
    Senator Smith. But when this occurred 5 years ago, were 
steps taken then to technologically get in the way of theft?
    Mr. Curling. I don't know, sir. I don't--I don't believe 
that the breach was communicated outside of the local area that 
was affected--the local company affected by it.
    Senator Smith. Thank you.
    Senator Inouye?
    Senator Inouye. Thank you, Mr. Chairman.
    Mr. Sanford, how many companies can be designated as data 
brokers?
    Mr. Sanford. I don't know the exact number. I would--in our 
industry, there are dozens and dozens of businesses. From a 
competitive intelligence--we tend to focus on about a dozen of 
them, as primary competitors, but there are many, many 
businesses in which you could get personally sensitive 
information on the Internet that I wouldn't consider to 
actually be in my industry, but have access to the same 
information.
    Senator Inouye. Mr. Curling testified that most of your 
activities, both of you, are covered by the FCRA provisions.
    Mr. Curling. Most of ours are, yes, sir.
    Mr. Sanford. Most of mine are not.
    Senator Inouye. Would you be in favor of having FCRA 
provisions cover all of the activities, Mr. Sanford?
    Mr. Sanford. I don't believe the FCRA, and the FACT Act 
that reauthorized it, is the appropriate framework. I mean, the 
FCRA, as I understand it, Senator, was intended to cover very 
specific transactions--the granting of insurance, granting 
credit. The information services that we provide that are not 
governed by the FCRA are about identity authentication, finding 
and locating people. The FCRA has very limited permissive uses. 
And if we were to extend the FCRA to this industry, there are 
at least seven or eight major applications for identity theft 
and fraud-detection purposes that would be eliminated.
    Senator Inouye. Mr. Curling, would you be in favor of 
FCRA----
    Mr. Curling. Yes, sir. I think, in general, we'd be fine 
with extending the principles of FCRA to cover these records 
and products.
    Senator Inouye. At the present time, if a consumer wants to 
see his own file in your company, Mr. Sanford, would you let 
him do it?
    Mr. Sanford. We do have a consumer-access program in 
LexisNexis, and today a customer can ask for access to that 
information. We are not able to--if you recall, Senator, we 
have a--news and business information, as well, where we list 
all of the articles in the major newspapers--we're not able 
to--because we don't have personal identifiers--aren't able to 
tell that John Smith, who's asking for information, whether or 
not that's the same John Smith that's--appears in all of the 
different news articles or in the white pages, other public 
information. But we certainly would provide access to the 
information in our public/non-public-record databases.
    Senator Inouye. Can a consumer have that right in your 
company, Mr. Curling?
    Mr. Curling. Yes, sir, they do. We don't maintain dossiers 
on consumers, but we have information products that have this 
consumer data, and those products are available for consumers 
from a single point of entry, either via a website we maintain 
or a 1-800 number.
    Senator Inouye. Now, if that consumer finds that there's 
some incorrect information, is he provided the opportunity to 
correct it?
    Mr. Sanford. We have a small part of our business which is 
governed by the FCRA and there are provisions that indicate 
exactly how those corrections happen. For the part that's not 
part of the FCRA, our practice is, if the error in the 
information is related to the way in which we keyed the data or 
the way in which we stored the data in the database, we make 
the correction. If it's an error that the individual is 
claiming is in the public record, the way in which a mortgage 
record or tax lien is recorded in a county courthouse, we then 
point the individual to the county courthouse, because we don't 
have authority to change a public record, and we can't have a 
database where our version of the public record is different 
than what's available in the public record.
    Senator Inouye. What's the situation in your company, sir?
    Mr. Curling. The majority of our products are regulated by 
the FCRA, and, as a result, there's a defined process for 
consumers to, you know, note the dispute and for us to help 
them go through and navigate that correction. For the public-
record products that we have, our present policy is similar to 
that of my colleague here, LexisNexis, although there are some 
things that, if we extend the practices we talked about earlier 
in this hearing to, we could potentially help consumers not 
only know which courthouse that record came from and how it was 
sourced, but we're also looking at ways to put disputes on the 
file much like the FCRA provides. So, even though it's a 
correction we cannot make legally on their behalf, we can note 
the dispute in future searches that we would serve up to our 
customers.
    Senator Inouye. Now, if I wanted to buy information from 
either one of your companies, would you permit me?
    Mr. Sanford. We have a new-customer authentication 
verification procedure, Senator, that you would go through, 
like any other customer, and, depending upon the documentation 
and records that you provided, depending upon the uses that you 
claimed in our investigation, you would be able to get access 
to certain types of databases. It might be our legal news and 
business information databases. It might be public records. It 
would unlikely, as a--in your current role, it would be 
unlikely to qualify you for access to a nonpublic-record 
information.
    Senator Inouye. Can I just buy information on a specific 
person?
    Mr. Sanford. Again, if you didn't qualify for permissive 
purposes, you wouldn't have access to that information.
    Senator Inouye. What is the policy in your company, Mr.----
    Mr. Curling. You could not buy sensitive, personal 
identifiable information from ChoicePoint under our customer 
credentialing procedures. There are some information products 
you could buy. You can buy records--professional license 
records on your doctor and healthcare providers. You can buy 
your own vital records on behalf of your family. You can buy 
basic public records like real-estate records and directory 
searches, et cetera. But you wouldn't be able to gain--to set 
up an account to gain access to any products that contained 
sensitive, personal identifiable information.
    Senator Inouye. Thank you very much.
    Thank you, Mr. Chairman.
    Senator Smith. Thank you, Senator Inouye.
    Senator Nelson?
    Senator Bill Nelson. Thank you, Mr. Chairman.
    Mr. Sanford, does your company compile, store, and sell 
this information only, or does it also provide analysis of this 
information to your customers?
    Mr. Sanford. We compile data, and we have data analytics 
that link data. And then when a customer does a query, we, 
hopefully, give them the answer back which is the most correct 
answer available on the analysis. But you'd have to perhaps 
give me an example, Senator, of what you mean, ``beyond the 
analysis,'' so I make sure I'm responding to your question.
    Senator Bill Nelson. Well, what kind of analysis would you 
provide, for example, to law enforcement?
    Mr. Sanford. Law enforcement can do a specific query. If 
they're looking for a particular individual, they could do a 
query on that, and they might say, ``I'm looking for John 
Smith, who has the following type of vehicle, whose last known 
address was the following,'' and they could do a query, and we 
could then provide information of other known addresses for 
that same individual, or associates of that particular 
individual.
    Senator Bill Nelson. So, there is some analysis--instead of 
just giving them information, you would compile material, and 
there would be some analysis of this information.
    Mr. Sanford. In that way that you defined it, yes, Senator.
    Senator Bill Nelson. Other than law enforcement, who else 
would you provide analysis to? Give me an example, as a 
customer.
    Mr. Sanford. Financial institutions might want to be 
ensuring, or a bank, when they're opening an account, that the 
person who's there to open the account is who they purport to 
be. They might want to use an ID product that would allow them 
to ask the individual some qualifying questions to make sure 
they really are who they purport to be. Again, they would then 
be able to access to the broader databases to see unrelated 
information that might be in different repositories.
    Senator Bill Nelson. In following up to Senator Inouye, I 
think it's absolutely critical, for the protection of the 
consumer, that they have access to this data, so that if, in 
fact, it's wrong, they can correct it. And I, further, think 
that it's essential that the consumer should have access to the 
information of who is collecting that data, other than someone 
like a client of yours such as law enforcement.
    So, would you, for the record, state again what is the 
position of your company with regard to providing the consumer 
with information that is contained within your records?
    Mr. Sanford. If the question, Senator, is about--if I 
collected the information, should I provide notice to the 
consumer about its purposes and uses--I want to make sure you 
understand this--we don't collect that kind of information, I 
would have to say. I'm not really clear on whether there should 
be legislation on that. If the question is--once I collect 
information from public and nonpublic sources--I have white-
page phone information, I have public-record documents--I would 
not be supportive of sending a notice to a consumer each and 
every time a query might have gone on a database that touched 
their name. We'd be talking about sending millions and millions 
of notices----
    Senator Bill Nelson. No, that's not the question. The 
question is, If the consumer asks you for access to see what 
kind of information is being contained on that consumer----
    Mr. Sanford. I'm sorry, Senator, I misunderstood. I thought 
there were two questions. I thought--one was access, and I 
thought I had previously indicated I was supportive of that--
and I thought the second part was, Should I send them a 
notice----
    Senator Bill Nelson. No, I didn't ask about notice.
    Mr. Sanford. I misunderstood.
    Senator Bill Nelson. No. Notice is already what you're 
required to do in the State of California, which is--and that's 
something that I think this committee will be examining--once 
that information is breached and it has been withdrawn from the 
possession that you have, then, under California law, you're 
required to notify. What we're going to consider is that--
should that be nationally, other than just the State?
    So, your testimony is that, with regard to giving the 
consumer access to the information that you contain, that you 
would be willing to do that.
    Mr. Sanford. We do that today in our LexisNexis business.
    Senator Bill Nelson. Well, then that's very helpful.
    Now, tell us something about what is the procedure for 
becoming a LexisNexis client. When somebody becomes a client, 
does the client have access to all of LexisNexis's databases, 
for any purpose? For example, if an attorney became your client 
to help locate a witness, can that attorney also use your 
database for personal and other reasons?
    Mr. Sanford. The customers go through an authentication and 
credentialing process--applications, records. We do searches on 
various databases to verify their identity. Part of the 
application is, they have to indicate the permissive uses if 
they want to access personally identifying information and 
nonpublic record databases. Generally, lawyers do not qualify 
for access to that information. We call that, in our business, 
5A access.
    Senator Bill Nelson. So, they have to qualify in order to 
be able to use the other parts of the database.
    Mr. Sanford. We have case law. We have news and business 
articles. This is not the kind of thing that goes through a 
special credentialing process. But access to, say, driver's 
license number data or credit header information, nonpublic 
information, there's a special credentialing process.
    Senator Bill Nelson. How do you monitor that?
    Mr. Sanford. Customers in each and every search session 
have to indicate what their permissive use is. We do have 
detection software. Under DPPA, I believe, each time you use a 
search where you access a driver's license, you make a 
statement subject to criminal sanctions. It's against the law 
to have an impermissive use under DPPA.
    We've instituted some recent procedures to do 
recredentialing, on a periodic basis, for customers when 
contracts are up for renewal. We're enhancing procedures all 
the time. We're looking at having systems administrators 
recertify on a monthly basis, or a 60-day basis. We're working 
with our customers to figure out how we do that. Because we are 
in a mobile society, and people do have employees that come and 
go from their business, we want to make sure that the people 
who have the passwords and IDs are still, you know, legitimate 
users in those businesses.
    Senator Bill Nelson. Mr. Chairman, I see my time is up. I 
will have some more questions in the next round.
    Senator Smith. We'll have another round.
    Senator Bill Nelson. Thank you.
    Senator Smith. Senator Lautenberg?
    Senator Lautenberg. Thanks, Mr. Chairman.
    Just curious about the material that's accessible when 
someone becomes a client of your firm, either one of you. Now, 
if--are most of these people likely to be looking for lists for 
mailing solicitations?
    Mr. Sanford. In LexisNexis, we don't have a marketing 
business, except for a--there's a very, very small business 
that helps people in bankruptcy, doesn't have personally 
identifying information or driver's license numbers. But 99 
percent of what we do has nothing to do with marketing. We 
don't have financial----
    Senator Lautenberg. How about ChoicePoint?
    Mr. Curling. We have a collection of businesses, one of 
which is purely direct marketing, but those--all of our 
customers are credentialed and have access to separate product 
platforms. There is no common ChoicePoint access or single 
database with all the information in it. The information is 
kept separate by product. So, for example, in direct marketing, 
the customers would have access to no sensitive, personal 
identifiable information. As I indicated in my testimony, it's 
about 9 percent of ChoicePoint's revenue.
    Senator Lautenberg. Yes, so if someone was a United States 
Senator, and they wanted to compile a mailing list for campaign 
solicitation, could they have that list, sorted out by--a list 
sorted out by income levels?
    Mr. Curling. Well, that's not a market we serve, so I can't 
answer that, but if it was in a market that I do serve--well, 
we're principally serving financial institutions and insurance 
companies. The preponderance of our revenue is in the insurance 
market. So, for insurance companies what they're typically 
trying to do is look at the people they have insured today for 
auto and home policies and try and find more----
    Senator Lautenberg. So it would have to be specific----
    Mr. Curling. Typically, they're going after a particular 
product.
    Senator Lautenberg. And when they sign up for your 
services, do they have to identify those lists that--or the 
area of listing that they might want to access?
    Mr. Curling. Yes. As a part of our credentialing--in 
marketing, as a part of that process, we would understand what 
products they wanted to buy----
    Senator Lautenberg. So, they're limited. They can't----
    Mr. Curling. They're completely separate from other 
products.
    Senator Lautenberg. What--when people have--are expected--
or suspected to be a substantial risk for identity and fraud, 
is it in the consumer's best interest for the company to make 
that call or to inform consumers when there's any breach at 
all? How do you anticipate that someone might be an easy target 
for identity theft? Do you?
    Mr. Sanford. Well, it's very much the process we went 
through beginning in February. We have a chief security officer 
in the business. We investigate security issues. No company is 
immune to the constant attempts at hacking and penetration of 
their services. And what we did in our situation was, we looked 
at security breaches where a customer had said, ``This is not 
my billing activity.'' And when we could see that that was an 
employee who left the company, who went across the street, say, 
figuratively, to work at the collection company across the 
street, and continued to conduct searches in the normal course 
of their business, that doesn't present a risk of harm to the 
consumer. When a employee in a business is searching 
celebrities on a database, that doesn't suggest a risk of harm 
to consumers.
    And so, what we looked for was anything in a search that we 
couldn't authenticate, where there was some suggestion of risk 
of harm to a consumer. So, for example if the IP address of 
where that search emanated from came from a foreign country, 
and this was a domestic business, that was suggestive of a 
problem, given the body of literature on this issue. If people 
were using anonymiers, or if there was a virus or spyware 
inside of a customer's environment, we said there's some risk 
of harm. And the real challenge, Senator, is this trigger--is, 
When do you make notice? Because if there's any risk of harm, 
or no risk of harm, I think you do run the risk of this over-
notification.
    This is a very serious matter. But the facts, so far in our 
notices, have indicated, you know, next to no financial harm, 
at least, for those individuals. It's very discomfiting to 
them, it's a very serious matter, but I think we do have to 
wrestle with, What is it that's going to trigger notice? 
Because the intent of notice, I hope, is to help someone 
protect themselves, not to make them immune to the notices they 
get so they don't protect themselves that one time when they 
should.
    Senator Lautenberg. If someone--if a company is interested 
in debt collection, is that information fairly discernible in 
any of the groups that you have?
    Mr. Sanford. Debt collectors, credit departments, financial 
institutions, and collection organizations are a part of our 
business, and what they're looking for is authentication and 
location of the individual; so they may collect the debt from 
the correct person. Again, there are many, many John Smiths, 
and they're trying to find out which John Smith is the right 
John Smith for this particular debt.
    Senator Lautenberg. Thanks, Mr. Chairman.
    Senator Smith. Thank you, Senator Lautenberg.
    Senator Dorgan?

              STATEMENT OF HON. BYRON L. DORGAN, 
                 U.S. SENATOR FROM NORTH DAKOTA

    Senator Dorgan. Mr. Chairman, thank you. And thanks to the 
witnesses.
    This is a complicated set of issues for those of us who 
don't work in the business. And my understanding is that there 
is no Federal law prohibiting the use and sale of Social 
Security numbers. Would that be correct?
    Mr. Sanford. I think there are a number of laws. The most--
GLBA would be most applicable, where it talks about the use 
of----
    Senator Dorgan. GLBA?
    Mr. Sanford. Gramm-Leach-Bliley Act.
    Senator Dorgan. OK.
    Mr. Sanford. Excuse me, Senator--where it talks about our 
business, for example, as a recipient of information from a 
financial institution. Our use of that credit-header 
information, which includes the Social Security number, is 
restricted.
    Senator Dorgan. Do both of you do business in Europe and 
the United States?
    Mr. Sanford. Yes.
    Senator Dorgan. And can we go----
    Mr. Curling. We do, principally, business in the United 
States.
    Senator Dorgan. Do you do business in Europe?
    Mr. Curling. We do very, very small amounts of business in 
Europe, there are a few financial institutions that buy data 
for customer enrollment purposes, Patriot Act compliance, but 
very little; 99-plus percent of our revenue is domestic.
    Senator Dorgan. Mr. Sanford, can you describe for us the 
difference that exists with respect to the European approach 
protecting confidentiality, versus the U.S. approach at this 
point, given current law?
    Mr. Sanford. I'm not an expert on the European privacy 
issues. I can speak to the U.S. I'd be happy to give you the 
information. Our business in Europe is principally a legal news 
and business information service, as it is in Asia, Pacific, 
and Latin America. Our risk-management business focusing on 
public records is principally a U.S. business.
    Senator Dorgan. But if you--because you do business in 
Europe, you are required to comply with the--I believe it's 
called the Data Protection Directive in Europe?
    Mr. Curling. We don't collect public-record information or 
data from--on European citizens.
    Senator Dorgan. Well, the reason I was asking that--I was 
going to ask you your assessment of the approach the Europeans 
take, versus the approach that we take, under present law. And 
that, I think, goes to the heart of what we might ought to 
consider. Should we consider doing something that is much more 
restrictive, much more protective? And I believe that the 
Europeans do that. As I understand it, they require companies 
to provide consumers with notice, the ability to opt out with 
respect to nonsensitive commercial marketing of personal 
information, opt in with respect to sensitive, personal 
information, the right of access to personal information 
collected, reasonable security protections for the information, 
and so on, which I think is different than now exists in this 
country. Is that right?
    Mr. Sanford. I think some of them are the same, and some of 
them are different. It depends, again, if we're talking about 
FCRA applications, where I think you'd see opt-in--or, excuse 
me, opt-out, you would see notice and correction.
    Senator Dorgan. Tell me about, if you would--I expect 
neither of your companies are involved in this, but I think my 
colleague, Senator Inouye, was getting to it--if you, Mr. 
Sanford, go to the Internet today and decide you want to know 
about Senator Bill Nelson--you want to learn about him, you 
want to know everything there is to know about him, you want--
you'd like to get his Social Security number, you want to find 
out about his driving record, you want to know everything about 
him. And my guess is there are many options for you on the 
Internet to pay $100, $50, or $150 to gather information about 
Senator Nelson. Is that correct?
    Mr. Sanford. I believe there are.
    Senator Dorgan. And what kinds of companies are they that, 
on the Internet, are marketing that information? Do you know? 
It's obviously----
    Mr. Sanford. Yes, I wouldn't want to speculate as to the 
business purposes. You wouldn't be able to do that on our 
service.
    Senator Dorgan. I understand that.
    Mr. Sanford. You'd be able to access news articles and 
public information that might be otherwise in a blog or, you 
know, in a Google-type search.
    Senator Dorgan. I understand that. And I'm not making a 
comparison that either of you are involved in that. I'm just 
saying that that's another type of data collection. Somebody is 
collecting information about Senator Nelson, and, for $150 or 
so, we can go find out what information they've collected, 
which I assume would probably almost always include his Social 
Security number and a whole range of issues relating to his 
life. And that is also part of this data-collection industry, 
albeit smaller companies, likely, companies that aren't 
operating within the guidelines that you operate within. But as 
we consider all of these issues, you, of course, will always 
have to bear the burden of others in this industry that are 
marketing information in different ways. How do you feel about 
that?
    Mr. Sanford. We have policies and practices which are more 
restrictive than some of the existing laws. I would certainly 
welcome enforcement of existing laws on my competitors. It is a 
competitive disadvantage for us, where we comply with laws, but 
people find ways to gain access to information that they 
shouldn't.
    Senator Dorgan. Is Social Security the critical identifier 
with respect to personal information?
    Mr. Sanford. The Social Security number would probably be 
the most commonly agreed item. California statute also 
suggested driver's license numbers. If you think about identity 
theft and getting a photo ID with a driver's license number, I 
would include that as a sensitive piece of data, as well.
    Senator Dorgan. Is identity theft a crisis or a very 
serious problem in this country, or is it overblown, in your 
judgment?
    Mr. Sanford. I think it's a very serious problem, but I 
think it's been a very serious problem for a long, long, long 
time. I've learned quite a bit from the research and--I mean, 
identity thefts's been going on, and fraud associated with 
identity theft's been going on for decades and decades. 
Technology, while it's very powerful, has facilitated it more 
recently. And that's--you know, again, without downplaying the 
seriousness of us having very strong security safeguards, the 
reality is--is that the bad guys now have technology tools 
available to them to go out and commit all kinds of fraud. And 
part of the solution has to be to create tools to stop them. 
Restricting access to data is certainly, in some people's 
minds, a way to do that. I think if the restriction goes too 
far, we will, in fact, enable the bad guys to do even more than 
they're doing now.
    Senator Dorgan. Mr. Chairman, first of all, I think it's a 
service for you to hold this hearing. And I know the work that 
Senator Nelson has done, and others, is very important. You 
know, I think, frankly, most people would be aghast--most of 
our citizens would be aghast at the information that's being 
collected with respect to their personal lives. And I think, as 
we dig into this issue and mine this issue a bit to understand 
it better, we have a lot of interesting choices to make about 
how to protect American citizens with respect to the gathering 
of their personal information by other companies.
    Senator Smith. I think you're right, Senator. Thank you.
    Next, Senator Pryor. And we have been joined by Senator 
Nelson--we'll go to your questions after that, Senator Ben 
Nelson. And then back to Senator Bill Nelson for round two.

                 STATEMENT OF HON. MARK PRYOR, 
                   U.S. SENATOR FROM ARKANSAS

    Senator Pryor. Thank you, Mr. Chairman.
    Let me ask both of you a question, because, as I 
understand, what we're talking about here today is, the two 
entities you represent have very different business models, 
right? You all have different business models from one another. 
And they're--and I think what it shows is, there's kind of a 
diversity within the information-providers sector of our 
economy, if you will. What implications does the fact that you 
all have different business models--what implications does that 
have on possible legislation? In other words, when I see 
something like what you're talking about today, I'm concerned 
that a one-size-fits-all solution probably won't work. So, 
could you discuss a little bit, if you can do it fairly 
briefly, about, you know, how you're different and how you 
think we need to--as we look at legislation, how we should be 
careful to craft that to meet those differences?
    Mr. Sanford. Well, we're both alike, to the extent that if 
we have an FCRA solution, we're governed by the FCRA and the 
FACT Act. We're both alike to the extent that if we're dealing 
with information from financial institutions, we're governed by 
the privacy provisions of the Gramm-Leach-Bliley Act. We're 
different in our product mix. And that's our distinction. Now, 
our business practices may be different, and our policies, but, 
from a legislative standpoint, we are covered by the same laws; 
we just happen to have different concentrations.
    Senator Pryor. Do you agree with that, Mr. Curling?
    Mr. Curling. Well, I think, generally, that's probably an 
accurate characterization. I mean, we--our product mix is 
principally consumer-driven transactions that are regulated by 
FCRA or software and services. So, the segment of public-record 
sales that are non-FCRA, that are nongovernmental, it's a very 
small business for ChoicePoint. I think that the--some of the 
legislative proposals that have been put forth do deal with 
things, though, that all businesses and all enterprises should 
agree on. I think that, you know, identity theft is a crime 
that doesn't stay inside state borders. I think it's a crime 
that doesn't contain itself to a particular industry. You know, 
the breaches that were mentioned by the Committee members 
earlier in the meeting happened to universities, nonprofits, 
government agencies, commercial enterprises. So, I think that 
some of the topics under discussion, you know, notice, you 
know, how we're going to help affect the consumers. The things 
that we all need to do to try and provide more support for law 
enforcement to drive fraud and identity theft out of our 
society are things we all agree on, regardless of the industry 
we're in. And I think there is legislation there that everyone 
would agree on, and it would fit under one tent.
    Senator Pryor. Let me follow up on that, if I can, Mr. 
Curling, because there has been security breaches that have 
happened in a wide variety of companies and, as you said, some 
nonprofits, some--even some government entities. Should a 
security safeguards rule be applied only to information--only 
to information-service providers, or should it be broader than 
that and cover all businesses and even nonprofits and 
government agencies?
    Mr. Curling. We believe that consumers' interests are going 
to be best protected when, you know, it applies to all 
entities, regardless of the type of organization or structure 
of that company. As I indicated, you know, if you collect, 
assemble, maintain, transfer, or manage sensitive data, a 
breach is a breach, and, whether that took place in a 
commercial enterprise or a nonprofit organization, consumers 
need to be noticed.
    Senator Pryor. Mr. Sanford, you said, in your written 
testimony, that you acknowledge that maintaining security is 
not a static process. In other words, you have to continually 
evaluate new or--new types of security breaches. And, 
obviously, I know you have your hands full there. Do you think 
it is possible for a small company data-broker to maintain 
database security as diligently as they need to in order to 
prevent identity theft? It seems to me they might be at a 
disadvantage.
    Mr. Sanford. There are certainly high fixed costs for 
security. I mean, having credentialing programs, having 
detection software, monitoring, having resources to investigate 
certainly would be a disadvantage to a small business.
    Senator Pryor. What about third-party security audits? Do 
you use those in your company, right?
    Mr. Sanford. We do use them.
    Senator Pryor. And has that been a successful approach for 
you?
    Mr. Sanford. The third-party tends to be objective, has no 
loyalties, points it out to you, makes suggestions on things 
that are now available in the industry, state-of-the-art 
technology, different practices and procedures.
    Senator Pryor. Do you know how widespread third-party 
security audits are in the industry? I mean, do the smaller 
companies use them? Do we know?
    Mr. Sanford. I don't know, Senator.
    Senator Pryor. OK. Well, it looks like I'm just about out 
of time, so let me ask my last question here.
    Do you think that a consumer should have the ability to see 
his own file with your company?
    Mr. Sanford. In our non-FCRA businesses, we don't maintain 
consumer files or consumer reports, but we do have the ability 
for them to get access to the information, running a search to 
see what information's there.
    Senator Pryor. Is that available to them now?
    Mr. Sanford. Yes.
    Senator Pryor. And is that free?
    Mr. Sanford. No. There's a fee for that. I've asked the 
team to look at, you know, what that fee should be. Unlike a--
in a credit transaction, where data is pushed to you to 
assemble credit reports, we incur extraordinary cost to go 
collect and maintain all this information. We're not making a 
profit on giving them the reports. We have to authenticate 
the--I'm sorry, Senator----
    Senator Pryor. Yes.
    Mr. Sanford.--we have to authenticate the individual to 
make sure who they are when they call up. We're not just going 
to turn that information over to somebody over the phone. Then 
we have to prepare the report, and we mail it out to them.
    Senator Pryor. And, just as a very brief follow-up to that, 
because we're out of time, is--should the consumer have the 
ability to correct information in your file?
    Mr. Sanford. If the information has an error, is related to 
work we've done with it--let's say we transposed data 
inadvertently when we were loading the file--we would certainly 
correct that. If it's a public-record file, or a non-public-
record file, like a credit header, we need--we generally point 
them right back to the source and say, ``This is where we got 
this file from, let's get the public-record source collected so 
that we have the correct public-record information.''
    Senator Smith. Thanks, Senator Pryor.
    Senator Nelson?
    Senator Ben Nelson. Thank you, Mr. Chairman.
    Mr. Curling, you mentioned that if information is 
breached--security is breached, information is now out--that 
there's a notice that should be sent out to the parties. Should 
that security breach also be a violation of the specific law? 
Should there be strict liability for anything that comes from 
the misuse or the access of that information?
    Mr. Curling. Well, as we indicated, I think, Senator, we do 
agree that, you know, if there is a breach, we should send 
notice. And we would prefer the legislature draw a bright line 
as to what that notice criteria should be, because we don't 
feel like we're in a position to judge whether or not that 
breach posed a significant risk. In the event there is a 
notice, you know, we do have obligations and responsibilities 
that we need to fulfill. The first is, we help those consumers 
that are affected, you know, try and do what they can to 
understand the breach, understand the significance of the 
effect on them, and give them access to information products 
that would help them monitor whether or not they're going to be 
a victim of identity theft. And we believe we've done that.
    Senator Ben Nelson. What about strict liability? In other 
words, if you have--if you have control over the information, 
and it gets accessed, should you have strict liability for 
anything that occurs that is damaging to the name whose 
identity theft has occurred?
    Mr. Curling. Well, I'm not a lawyer, I don't know that I'm 
prepared to understand----
    Senator Ben Nelson. Well, no, I'm not necessarily saying 
you should you know right now, but do you think, as a matter of 
law, if you're not strictly liable now, that that might be the 
kind of imposition of responsibility that would be appropriate?
    Mr. Curling. Well, there are certainly penalties and fines 
already in place for breaches like this. I think that the 
primary, you know, view that ChoicePoint would have, as a 
commercial enterprise, is, we have market forces at play, as 
well, that already put, you know, tremendous pressure on 
companies to not only do the right thing, but maintain the 
appropriate safeguards. And I think that the, you know, primary 
liability is with the criminals. And I think what we want to 
try and support is law enforcement, getting the fraudsters out 
of our system.
    Senator Ben Nelson. Well, if you were faced with the 
question we're faced with--How does this get resolved?--what 
would be the first thing you would suggest we do?
    Mr. Curling. Well, I think there are many good proposals in 
place. You know, I previously testified in the Judiciary 
Committee that the proposal by Senator Schumer and Senator 
Nelson has a lot of good principles that we agree with. We 
believe in notice. We think notice is an important thing. You 
need to give a consumer a notice that a breach has occurred, 
and give them an opportunity to take the steps necessary to 
protect themselves. We believe that there need to be standards. 
And I think all of us, you know, would like to have a level 
playing field, whether that's for us to better understand the 
expectations that various constituencies place on us so we can 
feel like we're honoring and acting responsibly in our 
obligations, but also from a competitive and marketplace 
standard to understand what it is the rules should be.
    In my case, most of our products, as I indicated, that 
contain personally identifiable information, are already 
regulated by the FCRA, which, as you well know, has been a 
tried and true kind of 30-year standard for how this kind of 
information should be managed and what you should do if there 
is a breach or if there is some kind of dispute. We think 
that's a good model.
    Senator Ben Nelson. Mr. Sanford?
    Mr. Sanford. Senator, I would recommend that the three most 
important things that this committee could consider, if the 
ambitioning goal is to make a dent in the amount of fraud 
associated with identity theft, is, one, look at what the 
penalties are for the identity thieves, and make it a crime 
that nobody wants to commit. It's a very hard crime to prove. 
Sometimes the value of the theft is difficult to prove, and the 
penalties sometimes makes these misdemeanors, while the harm to 
society and the harm to the individuals and the financial 
institutions, the banking industry, is in the billions. So, 
that's one.
    Second, I do think a national notification standard is in 
order. California does have a law. Many, many states are 
considering, as we are here today, different notification bills 
across the United States, and I think having a national 
notification standard that has Federal preemption will ensure 
that when someone gets a notice, no matter where they live--
because, remember, our people in this country move around quite 
a bit--they'll understand what that notice means, and it won't 
depend upon which State it came from.
    And, third, I think insisting--as Mr. Curling pointed out 
earlier, insisting on data-security safeguards, regardless of 
where that data repository is, would make sense--not just for 
commercial organizations like us--so that we make it harder to 
get that information. And I--as indicated in my testimony, I 
believe that the Safeguard Rules, if they're modeled after 
what's in GLBA, would be a good start.
    I think that this framework needs to be flexible, because 
every company's business is a bit different, technologies are 
different, the size of the business is different, and the 
threats are evolving. I think proscribing specific security--
within a year or 18 months, we would have companies that might 
be in compliance with that, but would have ineffective security 
safeguards in place.
    Senator Ben Nelson. What about the--my question about 
strict liability for any kind of damages that the victim of 
identity theft might get as a result of information you held 
that was accessed by an identity thief?
    Mr. Sanford. It's not something that I've previously 
considered. I'd be glad to give it some thought. I, top of 
mind, wonder if it wouldn't provide some incentive for 
companies not to make notice--who were worried about the 
penalties--but it's something I'd be glad to work with your--
you and your staff on and consider.
    Senator Ben Nelson. Thank you. Thanks to both of you.
    Thank you, Mr. Chairman.
    Senator Smith. Thank you very much, Senator Nelson.
    As we go to a second round, I know Senator Inouye has 
expressed an interest, but if there is no objection, Senator 
McCain, a Member of this Committee, has asked that we include 
in the record his statement. It relates to the leadership, 
tragically, of Arizona on this issue, and it's an issue about 
which he is very concerned.
    Is there objection?
    [No response.]
    Senator Smith. We'll include it.
    [The prepared statement of Senator McCain follows:]

   Prepared Statement of Hon. John McCain, U.S. Senator from Arizona
    Our Nation--along with the rest of the world--is experiencing a 
data revolution. Thanks to information technology, innovative business 
models, and globalization, data is flowing faster, more widely, and 
more freely than ever before. This current of information is helping 
our economy grow, but like many other revolutions, this one has not 
been bloodless. The dark side of our Nation's information-based economy 
is that the wider availability of data--including personal identifiable 
information--has contributed to the theft of millions of American 
identities.
    Unfortunately, identity theft is especially common in my home 
State. Federal Trade Commission data indicates that there were more 
reported cases of identity theft per capita in Arizona than in any 
other state in 2004. In addition, the FTC reports that the Phoenix area 
leads other U.S. metropolitan areas in the incidence of the crime. This 
has led one Arizona newspaper to christen my home State the ``identity 
theft capital of the Nation,'' a distinction that no Arizonan is proud 
of and that I will continue working to shed.
    Today's hearing touches on yet another chapter in this country's 
battle against identity theft. And, though I'm extremely concerned 
about the security breaches at companies like ChoicePoint and 
LexisNexis, I am not surprised by the news. ChoicePoint, for example, 
has compiled 19 billion records covering virtually every American adult 
according to press reports. Targets do not get bigger and more 
predictable than that, and I have to say that I am disappointed to know 
that a company that should have had better security measures in place 
did not. I look forward to hearing what ChoicePoint and LexisNexis are 
doing to restore integrity to their businesses.
    I trust that this will be the first of many hearings that the 
Committee will have on the issues of information security and privacy, 
and that the Committee will build on the work it has done in the past 
by taking a broad look at security and privacy issues during this 
Congress. Our purpose in doing so should be to protect consumers while 
maintaining the integrity and viability of our information economy. I, 
for one, believe that those goals are not mutually exclusive.
    I thank Chairman Stevens for holding this important hearing and the 
witnesses for coming before the Committee.

    Senator Smith. Also, I'll include in the record the data 
security incidents in 2005 relating to public institutions, 
primarily universities, and the tremendous levels of identity 
theft that has occurred at some of the major universities of 
our Nation.
    [The information previously referred to follows:]

                      Data Security Incidents--2005
   (As of 5/9, at least 35 incidents have been disclosed, potentially
              affecting more than 5.2 million individuals)
------------------------------------------------------------------------
        Date                         Entity                   Affected
------------------------------------------------------------------------
01/03/05             George Mason University..............        30,000
                     --Officials discover that hackers had
                      accessed private information and
                      Social Security numbers on students
                      and staff..
01/06/05             University of Kansas.................         1,400
                     --Administrators send letters to
                      individuals whose personal
                      information, including Social
                      Security numbers, passport numbers,
                      countries of origin, and birthdates,
                      might have been compromised when a
                      hacker accessed a server in November
                      2004..
01/18/05             University of California, San Diego..         3,500
                     --Officials reveal a mid-November
                      breach may have compromised names
                      and SSNs of students and alumni..
01/25/05             Science Applications International          Unknown
                      (SAIC).
                     --Desktop computers were stolen from
                      the offices of Science Applications
                      International Corp., an online
                      payroll services company,
                      compromising personal information of
                      current and past stockholders.
01/27/05             Purdue University....................         1,200
                     --An unknown person or group accessed
                      a computer in the College of Liberal
                      Arts' Theatre Division containing
                      names and SSNs of faculty, staff,
                      students, alumni and business
                      affiliates..
02/02/05             Indiana University...................       Unknown
                     --Officials reveal that the F.B.I.
                      and campus police are investigating
                      a computer security breach that left
                      employees' personal information
                      vulnerable. It is unknown at this
                      point how many have been affected..
02/14/05             ChoicePoint..........................       145,000
                     --Company confirms it was victimized
                      by a customer fraud in which public
                      records information about
                      approximately 30,000 consumers may
                      have been compromised; number of
                      potentially affected consumers later
                      increased to 145,000..
02/20/05             T-Mobile.............................           400
                     --Mobile phone accounts of Paris
                      Hilton and 400 T-Mobile customers
                      compromised by hackers.
02/24/05             Westlaw..............................  ``Millions''
                     --Accused by U.S. Sen. Charles
                      Schumer of having ``egregious
                      loopholes'' in one of its Internet
                      data services that would allow
                      thieves to harvest SSNs and
                      financial identities of millions of
                      people..
02/25/05             Bank of America......................   1.2 million
                     --Announced it had lost computer data
                      tapes containing personal
                      information on Federal employees,
                      including some members of the U.S.
                      Senate..
02/05                PayMaxx..............................        25,000
                     --Flaws in the online W-2 service of
                      PayMaxx exposed customers' payroll
                      records..
03/08/05             DSW Shoes............................   1.4 million
                     --Announced that credit card
                      information from customers of more
                      than 100 DSW Shoe Warehouse stores
                      was stolen from a company computer's
                      database. The company announces on
                      April 18, the number of affected
                      consumers could be 1.4 million..
03/08/05             Harvard University...................           200
                     --Intruder gains access to its
                      admission systems and helped
                      applicants log on to learn whether
                      they had been successful weeks
                      before they were to find out..
03/09/05             Reed Elsevier, Seisint Unit                 310,000
                      (LexisNexis).
                     --Announced that hackers gained
                      access to sensitive, personal
                      information of about 32,000 U.S.
                      citizens on databases owned by Reed
                      Elsevier. The company in April
                      updates the actual number of
                      potentially affected consumers to
                      310,000..
03/11/05             Boston College.......................       120,000
                     --Announced that hackers had accessed
                      personal information of alumni in a
                      computer system used for fund-
                      raising..
03/11/05             University of California-Berkeley....       100,000
                     --Laptop computer stolen from a
                      graduate division office contained
                      the names and Social Security
                      numbers of 98,369 individuals..
03/11/05             Nevada Department of Motor Vehicles..        8,900+
                     --Personal information compromised
                      when thieves stole a computer from a
                      Nevada DMV office..
03/14/05             California State University, Chico...        59,000
                     --Hackers broke into a housing and
                      food service computer system, which
                      contained names and SSNs of current,
                      former and prospective students, as
                      well as faculty and staff..
03/18/05             University of Nevada, Las Vegas......         5,000
                     --Administrators reveal that a hacker
                      had been accessing the personal
                      information of international
                      students..
03/23/05             Mutual funds.........................       Unknown
                     --Wall Street Journal reveals
                      numerous mutual funds reported data
                      security breaches, including Armada
                      Funds; Pimco, a unit of German
                      insurance giant Allianz AG; The
                      Dreyfus unit of Mellon Financial
                      Corp.; Bank of America Corp.'s
                      Columbia Funds unit; Nuveen
                      Investments; The First American
                      Funds unit of U.S. Bancorp; AmSouth
                      Bancorp's fund unit; CNI Charter
                      fund unit of City National Bank of
                      Los Angeles..
03/25/05             Northwestern University..............        21,000
                     --Hackers broke into a graduate
                      school server, exposing the Social
                      Security numbers of students,
                      faculty, and alumni..
03/28/05             San Jose Medical Group...............       185,000
                     --Someone stole two computers that
                      contained patient billing
                      information, including names,
                      addresses, Social Security numbers
                      and confidential medical
                      information..
03/28/05             University of Chicago Hospital.......       Unknown
                     --Announced an employee had been
                      selling patient records..
04/08/05             Eastern National (vendor for National        15,000
                      Park Service).
                     --Hacker infiltrated its
                      ``eParks.com'' computer system and
                      may have gained access to customer
                      names, credit card numbers and
                      billing addresses..
04/10/05             Christus St. Joseph Hospital,                16,000
                      Houston, Texas.
                     --Published reports on 4/26 said the
                      hospital had sent letters to 16,000
                      patients saying their medical
                      records and SSNs were comprised due
                      to the theft of a computer in a
                      January burglary..
04/10/05             Carnegie Mellon University,                   5,000
                      Pittsburgh.
                     --Published reports on 4/21 said the
                      university had sent letters to more
                      than 5,000 students, employees and
                      graduates that their SSNs and other
                      personal information was comprised
                      in a breach of the school's computer
                      network that was discovered on 4/10..
04/12/05             Tufts University.....................       106,000
                     --Announced it was sending letters to
                      106,000 alumni, warning of
                      ``abnormal activity'' on a computer
                      that contained names, addresses,
                      phone numbers, and, in some cases,
                      Social Security and credit card
                      numbers..
04/13/05             HSBC North America...................       180,000
                     --Credit card issuer sending letters
                      to consumers who used General Motors-
                      branded MasterCards to make
                      purchases at Polo Ralph Lauren,
                      stating that criminals may have
                      obtained access to their credit-card
                      information..
04/19/05             Ameritrade...........................       200,000
                     --Online discount broker reported it
                      has notified current and former
                      customers that it has lost a backup
                      computer tape containing their
                      personal information..
04/23/05             Georgia Southern University,           ``Thousands'
                      Statesboro, GA.                                  '
                     --Associated Press reports on 4/28
                      that hackers broke into a GSU server
                      that contained thousands of credit
                      card and Social Security numbers
                      collected over more than three
                      years..
04/26/05             Foster Wheeler, Clinton, NJ..........  (est.) 6,700
                     --Engineering/construction company
                      writes to employees, retirees,
                      advising them that a hacker broke
                      into the company's computer system
                      in February and might have stolen
                      personal data, including SSNs and
                      bank deposit information..
04/28/05             Banks in New Jersey..................       500,000
                     --NBC reports scheme by bank managers
                      and employees who sold personal data
                      of about 500,000 holders of accounts
                      of Bank of America, Wachovia, and
                      Commerce Bank branches in New
                      Jersey..
04/28/05             Oklahoma State University............       Unknown
                     --University begins notifying
                      students and alumni about the theft
                      of a laptop computer from the career
                      services office that contained
                      Social Security numbers, genders,
                      ethnicities, class levels and e-mail
                      addresses of most Stillwater and
                      Tulsa campus students and recent
                      alumni..
04/29/05             Florida International University.....       Unknown
                     --Sun-Sentinel newspaper in Orlando
                      reports on a ``recent computer break-
                      in'' potentially compromising
                      personal data of students,
                      professors and staffers. A school
                      official told the newspaper that
                      electronic intruders apparently
                      dialed into FIU's computers from
                      Europe..
05/02/05             Time Warner..........................       600,000
                     --Company announces that data on
                      current and former employees stored
                      on computer back-up tapes was lost
                      by an outside storage company..
------------------------------------------------------------------------
Total--At least 35 incidents, potentially affecting more than 5,244,300
  individuals.

    Senator Smith. Senator Inouye?
    Senator Inouye. Thank you very much.
    On the present laws and rules and regulations, I can have 
my telephone number unlisted to protect my privacy. I can also 
demand that spam callers be prohibited from using my number. 
Can I call upon your companies and say to take my name off your 
list?
    Mr. Sanford. We have a opt-out program that has 
restrictions on it. You could make a request to opt out of our 
non-public-record information databases if were a victim of 
identity theft, if you were a law enforcement official who has 
had some threat of risk of harm, or we have a general other 
category which says any other threat of risk of harm that you 
would show us. And that might be, say, for example, a domestic-
abuse victim.
    Senator Inouye. In other words, you have the final say as 
to whether I can or cannot take it out?
    Mr. Sanford. That's correct, Senator.
    Senator Inouye. Mr. Curling?
    Mr. Curling. Many of our products already are opt-in 
products driven by the FCRA. There are products that we offer 
that do have opt-out provisions--the direct-marketing products, 
et cetera. Some of our products, though, the ones, in 
particular, I think, the subject of this hearing, the public-
record products, are products that there is not an opt-out on, 
except for a law enforcement or a government official opt-out. 
Those are generally not records that are, you know, unique to 
ChoicePoint. They are records that society has determined to be 
open public records, and people typically turn to ChoicePoint 
merely to--for cost effectiveness and convenience to acquire 
that record. Those are records that we don't source. We didn't 
originate them. We merely extract them from where--government 
repositories and courthouses around the country, and we don't 
have an opt-out provision for those.
    Senator Inouye. Thank you very much.
    Senator Smith. Thank you, Senator Inouye.
    Senator Bill Nelson?
    Senator Bill Nelson. Thank you, Mr. Chairman.
    And, before I forget it, I would like--because I'm not 
going to ask all the questions here--to submit a number of 
questions in writing, as did Senator McCain.
    Senator Smith. We will include those questions and ask for 
their answer.
    Senator Bill Nelson. Thank you.
    And thank you, Mr. Curling, for your response to the other 
Nelson with regard to this Nelson's legislation that is before 
this committee saying that, generally, the concept of it, that 
you would support it. And I want to go over those six items, 
things like creating a government industry working group to 
help develop best practices for safeguarding information, and 
creating an Assistant Secretary of Cybersecurity within the 
Department of Homeland Security, and tightening commercial 
usage of Social Security numbers. Those are things that 
certainly could be embraced. Is that accurate?
    Mr. Curling. Generally speaking, yes, Senator.
    Senator Bill Nelson. All right. How about requiring all of 
the information-broker companies to notify consumers when a 
security breach occurs? You've already answered that in 
relation to other questions, and you generally support that 
concept.
    Mr. Curling. Yes.
    Senator Bill Nelson. How about mandates in the law that all 
companies must reasonably protect sensitive consumer 
information?
    Mr. Curling. Yes, Senator.
    Senator Bill Nelson. And then having a one-stop shop? 
Whatever the regulatory agency--my suggestion is that it is the 
Federal Trade Commission, but this would be an Office of 
Identity Theft, where a consumer could get help to restore 
their identity.
    Mr. Curling. We would agree with the one-stop shop, and we 
agree with enhancing the FTC's oversight.
    Senator Bill Nelson. All right. Now, that's pretty much the 
comprehensive bill that Senator Schumer and I have filed. What 
do you think about that, Mr. Sanford?
    Mr. Sanford. Senator, it's a--it is a very comprehensive 
bill. I believe the intent, in terms of helping consumers and 
stopping identity theft and fraud, is certainly welcome. I 
think the parts of the legislation that strike me as the most 
relevant, that I would encourage this Committee, is the 
national notification standard for consumers. I would encourage 
Federal preemption so that we don't have competing notification 
standards in the market. I think data safeguards definitely 
modeled after GLBA, that flexible framework, I think, is the 
appropriate measure----
    Senator Bill Nelson. For information brokers?
    Mr. Sanford. Well, I think--as I mentioned earlier, I think 
the--if you have personally identifying information, which, if 
it got in the wrong hands--and we could agree on what 
personally identifying information is--and that posed a risk of 
harm to individuals, then I would say if you are maintaining 
that database, and you have a breach, then notice--you should 
give notice to individuals when you have that breach.
    Senator Bill Nelson. But a law that would mandate that the 
companies must reasonably protect this sensitive consumer 
information?
    Mr. Sanford. I agree, Senator, that the safeguards that I 
have mentioned, in GLBA, I believe are the right--is the right 
framework. I think that would go a long way in protecting data 
for, not just us, but other people who maintain personally 
identifying information.
    Senator Bill Nelson. What do you think about the one-stop 
shopping?
    Mr. Sanford. I'm not sure anybody could argue with 
additional help in oversight and funding for the Federal Trade 
Commission to help in identity theft. I know that Chairman 
Majoras testifies how many thousands of calls a week they get, 
and I'm sure that that would just be something that would be 
very helpful.
    Senator Bill Nelson. I've talked to her personally about 
it, and she is--without endorsing it, she is clearly very 
positively inclined.
    Let me ask Mr. Curling, because, my previous round, I had 
the chance to talk to Mr. Sanford. ChoicePoint has described 
itself as a ``private intelligence service.'' ChoicePoint 
markets itself as ``selling actionable intelligence.'' Could 
you explain what this means for your company to be in the 
intelligence business, and explain how consumers would feel 
comfortable with that?
    Mr. Curling. Sure. I'm not sure that we characterized 
ourselves as a private intelligence agency. I believe that was 
an author of a book that characterized that. But we do--we do 
use----
    Senator Bill Nelson. One of your staff yesterday told my 
staff attorney that it had been characterized that way.
    Mr. Curling. Well, I'll have to have a conversation with my 
staff. But we are a company that provides identification and 
credential verification solutions to principally commercial 
enterprises. And what we try and do is help them understand and 
manage the risks that they face. So, what we want to give 
them--as you're aware, data is expensive to acquire and time-
consuming to analyze--what we want to give them is just the 
right information at the right time. So, our services are all 
oriented around things like helping an insurance company 
understand how to evaluate and price the risk of an applicant 
for auto insurance, so that consumer gets the insurance policy 
that they want at a price that's fair for them; how to help a 
commercial employer do a background check on a prospective 
employee, so that that employee is able to get the job that 
they want, but the employer is able to effectively manage the 
risk that the society puts on them to know who's engaged in 
their work force. That's the kind of actionable intelligence 
that ChoicePoint products offer.
    Senator Bill Nelson. You have a product named AutoTrackXP, 
and it's not subject to the Fair Credit Reporting Act, and it 
appears to contain some of the sensitive consumer information 
that is in other products that you admit are regulated, as are 
detailed and full credit reports. Explain to the Committee why 
ChoicePoint believes that the AutoTrackXP is not regulated 
under the Fair Credit Reporting Act.
    Mr. Curling. Well, that's a search engine, not really a 
report, but that product is used for investigative purposes. 
The largest customer set is law enforcement. But, again, as 
you've heard today in the testimony, there are other markets, 
like fraud prevention for insurance fraud research, as well as 
investigative research by commercial financial enterprises, 
that run searches to try and get information back. For those 
customers, that search does contain sensitive, personally 
identifiable information. Since we've made the business changes 
to our business, we don't offer that product with personally 
identifiable information in it to any segments other than law 
enforcement, large financial institutions, and insurance 
companies.
    Senator Bill Nelson. So, the theft that occurred by the 
Nigerians faking the identity could not have occurred in that 
sensitive information.
    Mr. Curling. No, it did, in fact, occur in that sensitive 
information, but, as a result of that fraud, we have changed 
our product, and won't offer--and do not offer that product to 
those parts of the market.
    Senator Bill Nelson. All right. And, if I may, just this 
last question. ChoicePoint has estimated that identity thieves 
obtained sensitive, personal information on about 145,000 
people. I believe----
    Mr. Curling. That's correct.
    Senator Bill Nelson.--I believe that's what you've stated.
    Mr. Curling. Yes.
    Senator Bill Nelson. Now, the L.A. Sheriff's Department 
estimates that figure to be four million. Can you explain why 
those figures are so different?
    Mr. Curling. Sure. I think that the quoted number of four 
million was a very early estimate by the L.A. Sheriff's 
Department, going back to September or October of last year. 
That was long before the investigation had actually gone 
through the searches that had been done, anybody had determined 
how many potentially affected consumers were affected by that. 
We've appointed Robert McConnell, a 28-year veteran of the 
Secret Service and, for the last 5 years of his career, the 
head of the Federal Government's Interagency Nigerian Organized 
Crime Task Force. I spoke with Robert yesterday. He has 
confirmed to me that L.A. Sheriff's Department now believes 
that our estimate is accurate.
    Senator Bill Nelson. Gentlemen, I look forward to working 
with you on this legislation.
    Senator Smith. Thanks, Senator Nelson.
    We're pleased to be joined by Senator Kerry. We've 
completed a second round of questions, Senator. If you have an 
opening statement or questions for this first panel, we'll be 
happy to----

               STATEMENT OF HON. JOHN F. KERRY, 
                U.S. SENATOR FROM MASSACHUSETTS

    Senator Kerry. Thank you, Mr. Chairman. No, I apologize for 
being late, but we had competing meetings, as is always the 
case here. I apologize to the witnesses.
    I've tried to get an update as fast as possible so I'm not 
overly repetitive here. And I know a lot of questions, good 
questions, have been asked.
    Obviously, from the participation here today, you can get a 
sense of the importance. But you already knew that before you 
came here, because of the outcry, publicly, and the concerns 
that people are expressing. And the moving, sort of, model 
statewide, beginning with California, of regulation is, 
obviously, an indication of people's desire to do something.
    I understand your business models, and I understand that 
the information you provide is, obviously, often used for very 
valid purposes, but, as we move forward, the question of how to 
protect this is, needless to say, critical. During the campaign 
last year, and I think it came to fruition yesterday or today, 
President Bush and I both talked about e-medical records and 
the need to try to reduce costs in the medical system. And, 
obviously, that's critical. And I just wonder if you could 
share with us a little bit, sort of, first of all, what types 
of personal information currently do your--do you maintain in 
your product lines, including information based on biometrics, 
DNA, and medical records?
    Mr. Curling?
    Mr. Curling. We don't maintain any data on biometrics, DNA, 
or medical data. The data----
    Senator Kerry. Might you, as this opens up now with a 
certain amount of money? I mean, is this not a lucrative 
business prospect?
    Mr. Curling. I don't know whether it's a lucrative business 
prospect or not, but it's not an area where we have a lot of 
expertise or traction. We do have a DNA laboratory that 
supports our law enforcement initiatives, but that laboratory, 
Bode Labs, merely takes specimens on behalf of law enforcement 
agencies, processes the DNA, maintains chain of custody, and 
turns that back over to them for forensic purposes. Our 
scientists have been to the--Thailand to work on the tsunami. 
We identified the victims of the World Trade Center tragedy 
through that laboratory. But it's a forensic-science laboratory 
that's really an extension of the services we do to support law 
enforcement, not a business--part of our business model that we 
necessarily embrace.
    I think it is possible that the identifiers that we all 
begin to see used more in our society are perhaps biometric 
identifiers you're seeing today, technological solutions 
beginning to be deployed. They use authentications exceeding 
User IDs and passwords, and incorporating things like 
biometrics. But that's not something that, in the industry that 
I'm in, is in heavy use today.
    Senator Kerry. Mr. Sanford?
    Mr. Sanford. We don't collect medical information, Senator, 
or biometrics, or DNA, either.
    Senator Kerry. What about that information, Mr. Curling, 
that you do collect, in terms of the forensic chain-of-
custody--is there any intrusive link in there that should be of 
concern?
    Mr. Curling. No, sir. That data doesn't get--the data 
repositories in ChoicePoint are generally housed at the product 
level. None of the information in Bode Laboratories, which is 
in Springfield, Virginia, goes out of the laboratory into other 
places in ChoicePoint.
    Senator Kerry. When you say you changed your business 
model, and essentially have tightened procedures, what 
loopholes did you tighten?
    Mr. Curling. Well, I don't know that I would say we 
tightened loopholes. We made business decisions that we thought 
were in the best interest of our company, given the experiences 
that we've had, and they were basically twofold. One, there are 
businesses that are hard to credential. Those are small 
businesses. And, given that the preponderance of our revenue is 
in large, either government contracts, or government--or 
commercial enterprises, small businesses are simply something 
that's awful hard for us to adequately credential and ensure 
that we know exactly who, on the other end, is buying the 
information products. We chose to exit the market of selling 
sensitive, personal information to those businesses, even 
though they have legitimate business interests to get at. And, 
you know, certainly small businesses face many of the 
challenges that big businesses do.
    Second, there are products that we sell that, while legal, 
don't have direct consumer benefit. And so, we chose to not 
sell to certain segments of the marketplace, sensitive, 
personal data that they're legally entitled to get, but they 
don't fit our business model.
    Senator Kerry. Was that small-business change specifically 
in response to the Nigerian----
    Mr. Curling. Yes, it was.
    Senator Kerry. It was, OK.
    Is it your judgment now that those two problems were the 
only two problems? Or are you taking further steps that we 
should be aware of?
    Mr. Curling. Well, our investigations, and those of law 
enforcement, continue. There's--you know, we tend to think of 
security risks in five different categories--you know, basic 
physical-possession risk, which you can think of as common 
burglary or the--just loss of data; second, the hacking 
potential--and we have, like most in our industry, you know, 
monitoring software and extensive tools to try and monitor and 
track, and preventing hacking attempts; you have properly 
credentialed customers that have an employee that does a search 
they're not permitted to do, you know, the typical scenario of 
doing a background check on somebody's girlfriend or neighbor; 
you have properly credentialed customers that lose track of 
passwords and User IDs, which you've already heard of--
testimony today; and then, last, you have, you know, customers 
that get past credentialing procedures that simply should not 
have been credentialed as customers, and that's the experience 
we most recently had, where the notices were driven by.
    Senator Kerry. With respect to the law enforcement 
agencies, I gather you sell information to about 7,000 
agencies. Is that correct?
    Mr. Curling. We serve 7,000 agencies. A lot of those don't 
buy data. They're buying software or tools from us.
    Senator Kerry. So, is there any limitation on the sale of 
that information to law enforcement?
    Mr. Curling. Well, we're limited by the type of information 
we're able to legally obtain from the repositories. The States 
have laws, as does the Federal Government, about what data can 
be sold and under what conditions it can be used.
    Senator Kerry. So, that's established by the States.
    Mr. Curling. And by Federal Government. But, Senator, 
largely--and, as I testified earlier today, largely the Federal 
agencies are turning to us to buy otherwise readily available 
public-record information. They're merely turning to us for 
convenience and cost-effectiveness.
    Senator Kerry. And which law enforcement agencies do you 
currently sell this--what I assume can be termed sensitive 
consumer information?
    Mr. Curling. We sell to a wide variety of Federal--we serve 
most of the Federal law enforcement agencies, and many State 
and local law enforcement agencies.
    Senator Kerry. Is there any standard of probable cause?
    Mr. Curling. There are--we have circumstances under which 
they inform us they want to buy data for investigations, but 
we're not privy, nor would you want us to be, to the actual 
investigations those law enforcement agents are conducting.
    Senator Kerry. So, it's an automatic affirmative response 
for information.
    Mr. Curling. In most cases, yes, sir.
    Senator Kerry. No matter what.
    A few years ago, you acquired VitalChek, which is a company 
responsible for handling vital records--birth, death, marriage, 
divorce--in all 50 states. How is that information shared with 
ChoicePoint?
    Mr. Curling. It's not. That's an ordering and payment 
platform where a consumer orders a vital record directly from a 
vital-records office. We provide a technology infrastructure to 
those vital-records offices. They receive the customer order, 
they pull the vital record, and they deliver it through secured 
carrier, directly back to the consumer. The records never come 
through ChoicePoint.
    Senator Kerry. So, there's no transfer of any of that 
information outside of VitalChek, itself.
    Mr. Curling. No, sir.
    Senator Kerry. Do both of you accept the premise that I 
think has been bouncing around here today that reasonable 
security standards ought to apply universally to any custodian 
of sensitive, personal information?
    Mr. Sanford. Yes, Senator.
    Senator Kerry. And Mr. Curling?
    Mr. Curling. Yes.
    Senator Kerry. Well, I think most of the other questions 
were touched on. Let me just ask you, for my own edification, 
How do you collect and maintain, store, and protect the 
information? What's the process by which you do that, if you 
could go through that?
    Mr. Curling? How do you collect the information and 
maintain it and store it? How do you go about that?
    Mr. Curling. It varies widely by market. In the largest 
market we serve, which is the insurance market, we gateway 
directly to states to get motor-vehicle records and driver's-
license records, in most cases, and we deliver those back 
directly to our insurance customers an application at a time. 
So an application comes in, we break that application down 
against some decision rules the insurance company has given us, 
and then we begin to buy information products. Sometimes we--
their products that we database and warehouse, sometimes we go 
gateway to them.
    Senator Kerry. Do you gateway to credit-check companies, 
credit companies?
    Mr. Curling. We do.
    Senator Kerry. Do you see any distinction between the 
information that you use and sell, and the information that's 
on somebody's credit record?
    Mr. Curling. In many cases, from a regulatory standpoint, 
there's not a difference. We are a consumer reporting agency 
governed by the FCRA in many of the information products we 
have. The insurance products would be FCRA products. We would 
be treated similar to a credit-reporting company. The same is 
true for our pre-employment workplace solutions products and 
our tenant screening products.
    Senator Kerry. Do you think, from a legal point of view, 
that any individual in America, as a citizen, has a proprietary 
interest in their own information?
    Mr. Curling. I think citizens are obviously very concerned 
about the data----
    Senator Kerry. Proprietary information, proprietary 
interest. In other words, should you be trafficking in their 
information, and they have no participation in the process?
    Mr. Curling. Again, the majority of our transactions that 
contain sensitive consumer information are initiated directly 
by consumers, so the transaction would not happen if a consumer 
hadn't initiated it.
    Senator Kerry. But, of course, that depends on knowledge, 
right? The knowledge standard. I mean, the opt-in----
    Mr. Curling. Well, they----
    Senator Kerry.--or out, whether they know or don't know----
    Mr. Curling. Well, they applied for an automobile insurance 
policy, and, on the application----
    Senator Kerry. But they didn't apply to have their 
information go to you to be winning you a profit for the 
transfer of whatever their life is, did they?
    Mr. Curling. I wouldn't know, Senator.
    Senator Kerry. Mr. Sanford?
    Mr. Sanford. I don't believe that a proprietary standard is 
workable. We use public-record information to provide very 
vital services that----
    Senator Kerry. Is----
    Mr. Sanford.--actually help consumers----
    Senator Kerry.--is the information of a credit company 
public record, or is it private----
    Mr. Sanford. We are not----
    Senator Kerry.--privately held----
    Mr. Sanford.--we don't collect----
    Senator Kerry.--on a specific kind of contract 
relationship, the contract between the individual and that 
particular entity?
    Mr. Sanford. Yes. We do not collect financial or credit 
information on individuals, so we're not in that business.
    Senator Kerry. Mr. Curling, what about that? Is it 
specifically----
    Mr. Curling. I'm not an expert in the Fair Credit Reporting 
Act, but I believe that a consumer--a credit-reporting agency 
has opt-in and opt-out, both provisions, on it with respect to 
certain uses of their products. And, in many cases, our 
products are regulated by the FTC under FCRA, just as they are.
    Senator Kerry. Well, I think one of the things, Mr. 
Chairman, we're going to have to think through very carefully 
as we go forward is, sort of, what is the level of knowledge 
and options available to anybody as to how far and how wide 
their information goes. I think that's central to this. And I 
thank you.
    Senator Smith. Thank you, Senator Kerry.
    We do need to go to our second panel, but Senator Nelson 
has one final brief, burning question.
    Senator Bill Nelson. Yes. And I think this will illustrate 
the extent to which information can be covered.
    Both of you have indicated that you don't collect and store 
medical records. Isn't that correct?
    Mr. Curling. That's correct.
    Mr. Sanford. That's correct, Senator.
    Senator Bill Nelson. Well, for example, Mr. Curling, you 
said you specifically represent, as clients, insurance 
companies.
    Mr. Curling. We do.
    Senator Bill Nelson. So, some of those are life-insurance 
companies.
    Mr. Curling. No. Mostly property and casualty, sir. I 
should have been more specific. Auto and home insurance.
    Senator Bill Nelson. No life insurance companies.
    Mr. Curling. No, sir. We have--may have some life-insurance 
customers in the marketing business, but we don't do 
underwriting of life-insurance products.
    Senator Bill Nelson. Well, if you represent life-insurance 
companies--and you're saying you don't--they have the medical 
records----
    Mr. Curling. That is not----
    Senator Bill Nelson.--for someone getting a life-insurance 
policy that they require a physical exam.
    How about you, Mr. Sanford? Do you represent any life-
insurance companies?
    Mr. Sanford. We have life-insurance companies who are 
customers, but not in the medical-records business. For 
example, the legal departments of insurance corporations. But 
we don't collect medical records, we don't underwrite 
insurance, we don't have a business that does that.
    Senator Bill Nelson. You said, last October, that you 
bought a Florida company, in Boca Raton, named Seisint. Seisint 
has a program called Matrix. It's one of the most extensive 
tools that is used by law enforcement. As a matter of fact, the 
officials of that company told me, within a few days after 
September 11, that they could determine who were the hijackers, 
who were the perpetrators of September 11. That information, 
how do you protect that information?
    Mr. Sanford. The Matrix program was a federally funded 
pilot, which has ceased. I believe it stopped last month, 
actually. Matrix is a--was a search engine that allowed law 
enforcement to search our services for public-record 
information, and they could also, at the same time, search 
their own databases. We did not maintain or manage that. That 
was managed, I believe, by the Florida Department of Law 
Enforcement on behalf of the other States that participated in 
that.
    Senator Bill Nelson. And so, that system wouldn't have any 
biometric information, no DNA information, no medical 
information?
    Mr. Sanford. Again, the Matrix program, our participation 
in it, is to share our technology and access to our data. What 
the State law enforcement organizations are searching, I 
believe, are things like sexual offender databases, correction 
records, arrest records when they're trying to locate a 
suspect. I'm not aware--I'll be glad to check with my staff and 
get back to you if there was any medical information, access to 
that. I don't believe there was.
    Senator Bill Nelson. Blood types, diseases, scars, 
identification marks, et cetera, et cetera.
    Mr. Sanford. I'll have to get back to you, Senator.
    Senator Bill Nelson. I would appreciate it very much.
    Senator Bill Nelson. Mr. Chairman, I think you see the 
concern welling up here of the extent of which if these folks, 
which, thankfully, you all are very, very accommodating here to 
want to help us develop this legislation, but if we are not 
successful, you can see that no one in America is going to have 
any privacy left if people can invade your databases. You say 
you want to present--prevent that. That's what we're trying to 
do.
    Thank you very much.
    Senator Kerry. Could I just have one quick follow-up?
    Senator Smith. You bet, absolutely.
    Senator Kerry. Would either of you sell to a political 
committee?
    Mr. Sanford. I think you--Senator, we have legal research 
business, news and business information services. There's 
nothing that would stop them from having access. I don't think 
they would qualify for a permissive use under GLBA or the DPPA, 
though. I mean, those are around fraud detection and prevention 
and law enforcement type of permissive uses.
    Senator Kerry. But is there anything to stop a committee 
from--have you sold anything to a political----
    Mr. Curling. Not that I'm aware of, no, Senator.
    Senator Kerry. But could they buy it?
    Mr. Curling. I don't believe that's a customer segment we 
serve.
    Senator Kerry. But could they?
    Mr. Curling. I don't believe they would get credentialed. 
But I can find out. I'm not--It's not a question I've heard 
before. But I don't believe--I've never heard--I've been around 
with the company----
    Senator Kerry. Well, do you have a----
    Mr. Curling.--since its inception, and----
    Senator Kerry.--do you have a means of checking, sort of, 
the----
    Mr. Curling. We have a business-purpose criteria upon which 
we'll enroll people as customers. I don't believe political 
committees meet the business purpose; therefore, I don't 
believe we would set up a customer----
    Senator Kerry. What about a----
    Mr. Curling.--account for them.
    Senator Kerry.--political consultant who's doing 
sophisticated political analysis----
    Mr. Curling. We don't----
    Senator Kerry.--polling analysis?
    Mr. Curling. I don't believe they're customers of ours, nor 
do I believe we'd serve them.
    Senator Kerry. You don't believe. But there's no set of 
guidelines with respect to----
    Mr. Curling. I'm trying to be very specific. There are very 
specific guidelines about who we serve as customers. I've never 
heard of this customer segment being anybody we serve. The 
preponderance of our customers are large insurance companies, 
large financial institutions trying to process transactions so 
a consumer can get some kind of benefit--an insurance policy, a 
job--large retailers or large customers of ours. We don't have 
very many customers that aren't in the large commercial space 
or government enterprises.
    Senator Bill Nelson. May I ask a follow-up on that?
    But if one of your large commercial customers asked for 
this information, and you had some reason to know that they 
were going to use it for political purposes----
    Mr. Curling. Our customers, by and large, have to send us--
they're asking questions an application at a time, so I'm not 
sure how they'd come in and ask that question, anyway. The most 
likely way they could present themselves is through the direct 
marketing business, where we don't sell sensitive, personal 
identifiable information anyway. But, again, I'll be happy to 
get back to the Senator and the Committee on that. I'm not 
aware this is a market we have any interest or any services to.
    Senator Smith. Like I said at the--earlier in the hearing, 
Senator, this was a question that didn't register Republican or 
Democrat, but maybe both sides are pretty interested now.
    [Laughter.]
    Senator Smith. But I think you raise----
    Senator Kerry. Well, I've seen some pretty sophisticated 
analysis based on those things.
    [Laughter.]
    Senator Smith. Yes. But in all seriousness, I think your 
point is well taken, and I think both sides do have an interest 
in making sure that people's rights and privacy are protected.
    And so, we appreciate very much, gentlemen, your being here 
today and for the contribution you've made to our understanding 
of this issue and the kind of problem we're trying to wrestle 
with and get some results for the American people. So, we thank 
you.
    And we'll now call forward our second panel. It will 
consist of Ms. Jennifer T. Barrett, Chief Privacy Officer of 
Acxiom Corporation, in Little Rock, Arkansas; Mr. Paul Kurtz, 
Executive Director of the Cyber Security Industry Alliance, 
Arlington, Virginia; Mr. Marc Rotenberg, President and 
Executive Director, Electronic Privacy Information Center, in 
Washington, D.C.; and Ms. Mari Frank, of Mari J. Frank, 
Esquire, & Associates, of Laguna Niguel, California.
    Senator Pryor will introduce Ms. Barrett. Thank you all for 
being here.
    Senator Pryor. Thank you, Mr. Chairman.
    It's really an honor for me to introduce to the Committee 
today Jennifer Barrett. She's the Chief Privacy Officer at 
Acxiom Corporation. And I think that title is very significant, 
because, as I understand it, Ms. Barrett was one of the first 
chief privacy officers anywhere in the Nation, and I think it 
underscores a commitment that this particular company has, of 
trying to find that balance between privacy issues and also the 
burgeoning information age and the needs that we have there.
    So, Acxiom is a company that was founded in 1969. I think 
she's been with the company for a number of years--maybe not 
since the very beginning, but from the early days, at least. 
And it is based in Arkansas. And it employs more than 6,300 
people in eight countries, with an annual revenue of $1.2 
billion.
    So, we're fortunate in our State to have, really, the 
industry leader there, and we look forward to hearing her 
insights on this subject matter today.
    Senator Smith. Ms. Barrett, why don't we start with you?

               STATEMENT OF JENNIFER T. BARRETT, 
           CHIEF PRIVACY OFFICER, ACXIOM CORPORATION

    Ms. Barrett. Thank you, Senator Smith and Senator Pryor. 
And thank you for allowing Acxiom the opportunity to 
participate in this important hearing.
    I ask that my written statement be inserted in the record.
    Senator Smith. Without objection.
    Ms. Barrett. Mr. Chairman, let me be blunt. The bad guys 
are smart, and they're getting better organized and using their 
skills to illegally and fraudulently access information. Acxiom 
must, therefore, remain vigilant and innovative by constantly 
improving, auditing, and testing our systems--and, yes, even 
learning from security breaches in the marketplace. Information 
is an integral part of the American economy, and Acxiom 
recognizes its responsibility to safeguard the personal 
information it collects and brings to market.
    As FTC Chairman Majoras recently stated in her testimony 
both before the Senate and the House, there's no such thing as 
perfect security, and breaches can happen even when a company 
has taken every reasonable precaution. Although we believe this 
is true, no one has a greater interest than Acxiom in 
protecting the information we have, because our very existence 
depends on it and how well we do that.
    Acxiom's U.S. business includes two distinct components, 
our computer services and a line of information products. Our 
computer services, which represent more than 80 percent of the 
company's business, helps businesses, not-for-profit 
organizations, political parties, and government manage their 
own information. Less than 20 percent of Acxiom's business 
comes from its four information product lines--a fraud-
management product line, background screening products, 
directory products, and marketing products. Our fraud 
management and background screening products are the only 
Acxiom products containing sensitive information, and they 
represent less than 10 percent of our business.
    Acxiom would like to take this opportunity to set the 
record straight in a number of misunderstandings that have 
developed about the company:
    First, Acxiom does not maintain one big database containing 
dossiers on anyone. Instead, we maintain discreet, segregated 
databases for each product.
    Second, Acxiom does not commingle our clients' information 
from our computer services business with our information 
products. Such activity would constitute a violation of our 
contracts and of consumer privacy.
    Third, Acxiom's fraud-management products are sold only to 
a handful of large companies and government agencies who have a 
legitimate need for them. The information utilized in these 
products is covered under the Safeguards Rules and Use Rules of 
Gramm-Leach-Bliley, and both State and Federal driver privacy 
protection laws.
    Fourth, Acxiom's fraud-management verification services 
only validate information already in the client's possession. 
Access to additional information is available only to law 
enforcement and the internal fraud departments of large 
financial institutions and insurance companies.
    Fifth, our background screening products are covered under 
the Fair Credit Reporting Act, and we do not pre-aggregate any 
of the information provided.
    Beyond these protections, there are additional safeguards 
that exist:
    First, because public information is blended with regulated 
information in both our fraud-management and background 
screening products, Acxiom voluntarily applies the more 
stringent security standard to all such blended data, even 
though not required to by law.
    Second, since 1997, Acxiom has posted its privacy policy on 
our website, describing our online and offline practices; thus, 
voluntarily subjecting the company to FTC rules governing 
unfair or deceptive conduct.
    Third, the company has imposed our own internal, more 
restrictive guidelines for the use of sensitive information 
such as Social Security numbers.
    Fourth, all of Acxiom's information products and practices 
have been audited on an annual basis since 1997, and our 
security policies are regularly audited, both internally and by 
many of our clients.
    Two years ago, Acxiom experienced a security breach on one 
of our external file-transfer servers. Fortunately, the vast 
majority of information involved was of a nonsensitive nature, 
and law enforcement was able to apprehend the suspects and 
ascertained that none of the information was used to commit 
identity fraud. Since then, Acxiom has put in place even 
greater protections for the benefit of both consumers and our 
clients.
    In conclusion, ongoing privacy concerns indicate that the 
adoption of additional legislation may be appropriate. Acxiom 
supports efforts to pass federally preemptive legislation 
requiring notice to the consumers in the event of a security 
breach which places consumers at risk of identity fraud. Acxiom 
also supports the recent proposal from FTC Chairman Majoras for 
extension of the Gramm-Leach-Bliley Safeguards Rules.
    Senator Smith, on behalf of Acxiom, I want to express my 
gratitude for the opportunity to participate in this hearing. 
I'll be happy to answer any questions the Committee may have.
    [The prepared statement of Ms. Barrett follows:]

              Prepared Statement of Jennifer T. Barrett, 
               Chief Privacy Officer, Acxiom Corporation
Summary
    Acxiom has an inherent responsibility to safeguard the personal 
information we collect and bring to the market, and we have focused on 
assuring the appropriate use of these products and providing a safe 
environment for this information since 1991 when the company brought 
its first information products to market.
    Information has become an ever growing and ever more integral part 
of the American economy. Information is the facilitator of convenience 
and competition, and it provides the tools that reduce fraud and 
terrorism. As such, we believe that it is Acxiom's obligation to 
provide effective safeguards to protect the information we bring to 
market regardless of the difficulties encountered in doing so.
    Only Acxiom's fraud management and background screening products 
involve the transfer of sensitive information. These products, 
therefore, are subject to law, regulations and our own company policies 
that help protect against misuse.

        GLBA and DPPA: Our fraud management products utilize 
        information covered under the Gramm-Leach-Bliley Act (GLBA), 
        and driver's license information covered under both State and 
        Federal driver's privacy protection acts (DPPAs).

        FCRA and FACTA: Our background screening products are covered 
        by all of the regulations and consumer protections established 
        by the Fair Credit Reporting Act (FCRA) and the Fair and 
        Accurate Credit Transactions Act (FACTA).

        Safeguarding Public Record Information: Although a heightened 
        level of protection is not mandated for public record 
        information, by virtue of the fact that such public information 
        is blended with regulated information, Acxiom voluntarily 
        chooses to apply the more stringent standards of the above-
        mentioned regulations to the resulting products.

    Although Acxiom's directory and marketing products do not contain 
any sensitive information that could put a consumer at risk for 
identity fraud, Acxiom is still subject to the following critical 
safeguards: various industry guidelines, compliance with all 
requirements in the original notice to consumers at the time the data 
was collected, and voluntary compliance with those laws to which our 
clients themselves are subject.
    There has been much discussion, especially in recent weeks, about 
whether existing Federal law sufficiently protects consumers from harm. 
In this regard, Acxiom does believe that additional, appropriately 
tailored measures, such as Federal preemptive legislation requiring 
notice to consumers in the event of a security breach, would assist 
Acxiom, the rest of the information services industry and businesses in 
general in ensuring that consumers are protected from fraud and 
identity theft. But, as FTC Chairman Majoras has said, even the best 
security systems imaginable and the strongest laws possible can 
nonetheless be circumvented by inventive criminals' intent on 
committing fraud.
Introduction
    Chairman Stevens, Senator Inouye, and distinguished members of the 
Committee, thank you for holding this hearing to explore the treatment 
of data broker services under existing State and Federal laws as well 
as possible solutions to the crime of identity theft. Acxiom 
appreciates the opportunity to participate in today's hearing.
    Acxiom has an inherent responsibility to safeguard the personal 
information we collect and bring to the market, and we have focused on 
assuring the appropriate use of these products and providing a safe 
environment for this information since 1991 when the company brought 
its first information products to market.
    It is important that we all recognize that information has become 
an ever growing and ever more integral part of the American economy. 
Information is the facilitator of convenience, competition and provides 
the tools that reduce fraud and terrorism. As such, we believe that it 
is Acxiom's obligation to provide effective safeguards to protect the 
information we bring to market regardless of the difficulties 
encountered in doing so.
    Let me be blunt. The bad guys are smart and getting more organized. 
They will use all of the skills available to them to try to find ways 
to obtain the information they need to commit fraud. Acxiom must 
therefore remain vigilant and innovative, and that is why we employ a 
world-class information security staff to help us fend off criminals 
who attempt to access Acxiom's data. Acxiom is constantly improving, 
auditing and testing its systems. Yes, Acxiom is even learning from 
security breaches when they occur, and we are certain that other 
responsible companies are doing so as well.
    As Chairman Deborah Majoras of the Federal Trade Commission 
recently stated in her testimony before the Senate, ``[T]here is no 
such thing as perfect security, and breaches can happen even when a 
company has taken every reasonable precaution.'' Even though we believe 
that this is true, no one has a greater interest than Acxiom in 
protecting information because the company's very existence depends on 
securing personal information pertaining to consumers.
    In order to enjoy the benefits provided by a robust information-
based economy and also to keep our citizens safe from fraudulent 
activity, there are no quick fixes or easy solutions. We believe that 
it is necessary that cooperation exists among policy makers, 
information service providers, Acxiom's clients, law enforcement and 
consumers. We applaud your interest in exploring these issues and we 
very much want to be a resource in helping you achieve the proper 
legislative balance we all seek.
About Acxiom Corporation
    Founded in 1969, Acxiom is headquartered in Little Rock, Arkansas, 
with operations throughout the United States, and with processing 
centers in Arkansas, Illinois, Arizona, Ohio and California. The 
company also has offices in nine other countries across Europe and 
Asia. From a small company in Arkansas, Acxiom Corporation has grown 
into a publicly traded corporation with more than 6,000 employees 
worldwide
    Acxiom's U.S. business includes two distinct components: customized 
computer services and a line of information products. Acxiom's computer 
services represent the vast majority of the company's business and they 
include a wide array of leading technologies and specialized computer 
services focused on helping clients manage their own customer 
information. These services are offered exclusively to large 
businesses, not-for-profit organizations, political parties and 
candidates, and government agencies. Acxiom's private sector computer 
services clients represent a ``who's who'' of America's leading 
companies. Acxiom helps these clients improve the loyalty of their 
customers and increase their market share, while reducing risk and 
assisting them with their compliance responsibilities under State and 
Federal law. Finally, Acxiom helps government agencies improve the 
accuracy of the personal information they currently hold.
    The balance of Acxiom's business comes from information products 
that are comprised of four categories: fraud management products, 
background screening products, directory products and marketing 
products. These four product lines represent less than 20 percent of 
the company's total business and the fraud management and background 
screening products represent less than 10 percent. While each product 
plays a unique role, all of Acxiom's information products help fill an 
important gap in today's business-to-consumer relationship.
    To understand the critical role Acxiom plays in facilitating the 
Nation's economy and safeguarding consumers, it is important to 
understand what the company does not do. Over the years, a number of 
myths have developed about Acxiom that require clarification. Please 
allow us to set the record straight:

   Acxiom does not maintain one big database that contains 
        detailed information about all individuals. Instead, the 
        company safeguards discrete databases developed and tailored to 
        meet the specific needs of Acxiom's clients--entities that are 
        appropriately screened and with whom Acxiom has legally 
        enforceable contractual commitments. I cannot call up from the 
        company's databases a detailed dossier on myself or any 
        individual.

   Acxiom does not provide information on particular 
        individuals to the public, with the exception of Acxiom's 
        telephone directory products. These products, which are 
        available on several Internet search engines, contain 
        information already available to the public. The other 
        information Acxiom processes is provided only to legitimate 
        businesses for specific, legitimate business purposes.

   Acxiom's does not have any information in either its 
        directory or marketing products which could be used to commit 
        identity fraud. Acxiom also does not include detailed or 
        specific transaction-related information, such as what 
        purchases an individual made on the Internet or what websites 
        they visited. The company's directory products include only 
        name, address, and telephone information. The company's 
        marketing products include only information that is general in 
        nature and not specific to an individual purchase or 
        transaction.

   Acxiom does not commingle client information that the 
        company processes in its computer services business with any of 
        our information products. Such activity would constitute a 
        violation of the company's services contracts with those 
        clients and a violation of consumer privacy. A client for whom 
        the company performs services may have a different agreement 
        with us as a data contributor, but these two relationships are 
        kept entirely separate.

    Acxiom's fraud management products are sold exclusively to a 
handful of large companies and government agencies--they are not sold 
to individuals. The company's verification services only validate that 
the information our client has obtained from the consumer is correct. 
Only law enforcement, government agencies and the internal fraud 
departments of large financial institutions and insurance companies 
have access to additional information.
    Acxiom's background screening products provide employment and 
tenant screening services which utilize field researchers who do in-
person, real-time research against public records and make calls to 
past employers to verify the information provided by the consumer. 
Where permitted by law, a pre-employment credit report can also be 
obtained. Acxiom does not pre-aggregate information for these products.
    Acxiom's directory information products contain only contact 
information on consumers such as name, address and telephone number. 
They are collected so businesses and consumers can locate other 
businesses or consumers. They are compiled from the white and yellow 
pages of published U.S. and Canadian telephone directories and from 
information available from the various directory assistance services 
provided by the telephone companies.
    Acxiom's marketing information products provide demographic, 
lifestyle and interest information to companies to reach prospective 
new customers who are most likely to have an interest in their products 
and to better understand and serve the needs of existing customers. 
They are compiled from pubic records, surveys and summarized customer 
information primarily from publishers and catalogers.
Respecting and Protecting Consumers' Privacy
    Acxiom has a longstanding tradition and engrained culture of 
protecting and respecting consumer interests in our business. The 
company is today, and always has been, a leader in developing self-
regulatory guidelines and in establishing security policies and privacy 
practices. There are, as explained below, numerous laws and regulations 
that govern our business. Ultimately, however, Acxiom's own 
comprehensive approach to information use and security goes far beyond 
what is required by either law or self-regulation.
Safeguards Applicable to Products Involving the Transfer of Sensitive 
        Information
    Only Acxiom's fraud management and background screening products 
involve the transfer of sensitive information. These products, 
therefore, are subject to law, regulations and our own company policies 
that help protect against identity fraud. These legal protections and 
additional safeguards are addressed below:

        GLBA, DPPAs, and FTC: Our fraud management products utilize 
        information covered under the Gramm-Leach-Bliley Act (GLBA), 
        and driver's license information covered under both State and 
        Federal driver's privacy protection acts (DPPAs). These 
        obligations include honoring GLBA and DPPA notice and choice 
        related to sharing and use of the information, the GLBA 
        Safeguard Rules and FTC Privacy Rule and Interagency 
        Guidelines. Any uses of data must fall within one of the 
        permitted uses or exceptions specified in these laws.

        FCRA and FACTA: Our background screening products are covered 
        by all of the regulations and consumer protections established 
        by the Fair Credit Reporting Act (FCRA) and the Fair and 
        Accurate Credit Transactions Act (FACTA). These protections 
        include: the requirement that a consumer authorize the creation 
        of employment reports; notice of adverse actions taken based on 
        such report; and the right of consumers to obtain a copy of 
        such reports and to dispute inaccuracies. Finally, such 
        regulations require that re-verification or correction of 
        disputed information be performed in a timely manner.

        Safeguarding Public Record Information: Public records are used 
        in both Acxiom's fraud management and background screening 
        products. Although a heightened level of protection is not 
        mandated for such public record information, by virtue of the 
        fact that such public information is blended with regulated 
        information, Acxiom voluntarily chooses to apply the more 
        stringent standards of the above-mentioned regulations to the 
        resulting products.

Safeguards Applicable to Other Products
    Although Acxiom's directory and marketing products do not contain 
any sensitive information that could put a consumer at risk for 
identity fraud, Acxiom is still subject to the following critical 
safeguards: various industry guidelines, compliance with all 
requirements in the original notice to consumers at the time the data 
was collected, and voluntary compliance with those laws to which our 
clients themselves are subject.

        Telephone Directory Safeguards: Acxiom's directory products 
        comply with all applicable policies regarding unpublished and 
        unlisted telephone numbers and addresses. In addition, because 
        Acxiom recognizes that consumers may object to published 
        listings being available on the Internet, Acxiom itself offers 
        an opt-out from such use. Further, Acxiom voluntarily 
        suppresses all telephone numbers found on the Federal Trade 
        Commission's Do-Not-Call Registry and the eleven other State 
        Do-Not-Call registries, when providing phone numbers for 
        targeted telemarketing purposes.

        Marketing Product Safeguards: Acxiom's marketing products 
        comply with all the self-regulatory guidelines issued by the 
        Direct Marketing Association. These requirements include notice 
        and the opportunity to opt-out. Consumers have the ability to 
        opt-out from Acxiom's marketing products by calling the 
        company's toll-free Consumer Hotline, accessing its website, or 
        by writing to the company. Since Acxiom does not have a 
        customer relationship with individual consumers, Acxiom 
        coordinates with its industry clients to research and resolve 
        consumer inquiries.

Additional Safeguards
    Acxiom takes seriously its responsibility to assure that all the 
information we bring to market is appropriate for the use to which it 
is intended and to provide adequate safeguards specifically aimed at 
protecting against unauthorized use.

        Privacy Policy/FTC Jurisdiction: Since 1997, long before it was 
        a common practice, Acxiom has posted its privacy policy on the 
        company's website. The privacy policy describes both Acxiom's 
        online and offline consumer information products. The policy 
        further describes: what data Acxiom collects for these 
        products; how such data is used; the types of clients to which 
        such data is licensed; as well as the choices available to 
        consumers as to how such data is used. By making these 
        extensive disclosures, Acxiom has voluntarily subjected itself 
        to Section 5 of the Federal Trade Commission Act, which 
        prohibits unfair or deceptive conduct in the course of trade or 
        commerce, as well as various State statutes governing unfair 
        and deceptive acts and practices.

        Consumer Care Department/Consumer Hotline: Acxiom maintains a 
        Consumer Care Department led by a Consumer Advocate whose team 
        interacted with more than 50,000 consumers in the past 12 
        months by way of answering questions, resolving issues, 
        processing opt-outs, and handling requests for access to 
        Acxiom's fraud management, background screening, directory and 
        marketing products. Acxiom provides consumers who contact the 
        company (through the company website, or by calling a toll-free 
        Consumer Hotline or by writing to the company) the options of: 
        opting-out of all of Acxiom's marketing products; receiving an 
        information report from the company's fraud management and 
        directory products; or receiving a consumer report as specified 
        in the FCRA from the company's background screening products. 
        Acxiom encourages consumers to notify the company if the 
        information in any of these reports is inaccurate and it is the 
        company's policy either to correct the information, to delete 
        it or to refer the consumer to the appropriate source to obtain 
        the requested correction, such as a county or State agency.

        Certification and Compliance with Federal and State Law: 
        Acxiom's privacy policy is designed to adhere to all Federal, 
        State, and local laws and regulations on the use of personal 
        information. The company is also certified under the Department 
        of Commerce's European Union Safe Harbor and the Better 
        Business Bureau's Online Seal.

        Consumer Education: Acxiom believes that consumers should be 
        educated about how businesses use information. To that end, 
        Acxiom publishes a booklet, entitled ``Protecting Your Privacy 
        in the Information Age--What Every Consumer Should Know About 
        the Use of Individual Information,'' which is available for 
        free both on the company's website and upon written or 
        telephone request.

        Voluntary Acxiom Policies: Above and beyond the industry-
        accepted guidelines with which Acxiom complies, Acxiom also has 
        established its own internal guidelines, which are more 
        restrictive than industry standards. For example, Acxiom only 
        collects the specific information required to meet its clients' 
        information needs, and the company properly disposes of the 
        remaining data, when information is compiled from public 
        records. Acxiom has also implemented specific guidelines 
        regarding the use and protection of information that could be 
        involved in identity fraud, such as Social Security numbers.

        Information Practice and Security Audits: Acxiom has had a 
        longstanding focus on the appropriate use of information in 
        developing and delivering its information products. While the 
        creation of strong information use policies is a business 
        imperative, assuring these policies are followed is equally 
        important. To this end, all of Acxiom's information products 
        and practices have been internally and externally audited on an 
        annual basis since 1997.

        Since many of Acxiom's computer service clients are financial 
        institutions and insurance agencies, Acxiom has been regularly 
        audited for many years by these clients. Furthermore, Acxiom 
        must honor the safeguards and security policies of the 
        company's clients. Since Acxiom's security program is 
        enterprise-wide, it is the company's policy to institute these 
        high levels of protection across all lines of business. These 
        client audits, along with Acxiom's own internal security 
        audits, provide Acxiom with regular and valuable feedback on 
        ways to stay ahead of hackers and fraudsters who may attempt to 
        gain unauthorized access to Acxiom's systems.

Lessons Learned
    Two years ago, Acxiom experienced a security breach on one of the 
company's external file transfer servers. The hackers were employees of 
an Acxiom client and a client's contractor. As users with legitimate 
access to the server, the hackers had received authority to transfer 
and receive their own files. The hackers did not penetrate the 
firewalls to Acxiom's main system. They did, however, exceed their 
authority when they accessed an encrypted password file on the server 
and successfully unencrypted about 10 percent of the passwords, which 
allowed them to gain access to other client files on the server. 
Fortunately, the vast majority of the information involved in this 
incident was of a non-sensitive nature.
    Upon learning of the initial breach from law enforcement, Acxiom 
immediately notified all affected clients and, upon further forensic 
investigation, the company informed law enforcement regarding a second 
suspected security incident. Fortunately, in both instances, law 
enforcement was able to apprehend the suspects, recover the affected 
information and ascertain that none of the information was used to 
commit identity fraud. One of the hackers pled guilty and was recently 
sentenced to 48 months in Federal prison. The other is currently 
awaiting trial.
    As a result of the breach, Acxiom cooperated with audits conducted 
by dozens of its clients, and both the Federal Trade Commission and the 
Office of the Comptroller of the Currency examined Acxiom's processes 
to ensure that the company was in compliance with all applicable laws 
and its own stated policies.
    This experience taught Acxiom additional valuable lessons regarding 
the protection of information. For example, Acxiom now requires the use 
of more secure passwords on the affected server. The process for 
transferring files has been changed, specifically by keeping 
information on the server for much shorter periods of time. And while 
it was always a recommended internal policy, Acxiom now requires that 
all sensitive information passed across such servers be encrypted. In 
addition, while Acxiom has had in place a Security Oversight Committee 
for many years, the company has also now appointed a Chief Security 
Officer with more than 20 years of IT experience. In short, Acxiom's 
systems are more secure today as a result of the company's experience 
and dedication to the privacy of consumers.
The Need For Additional Legislative Safeguards
    There has been much discussion, especially in recent weeks, about 
whether existing Federal law sufficiently protects consumers from harm. 
In this regard, Acxiom does believe that additional, appropriately 
tailored legislation would assist Acxiom, the rest of the information 
services industry and businesses in general in ensuring that consumers 
are protected from fraud and identity theft. But, as FTC Chairman 
Majoras has said, even the best security systems imaginable and the 
strongest laws possible can nonetheless be circumvented by inventive 
criminals' intent on committing fraud.

        Breach Notification: Acxiom supports efforts to pass Federal 
        preemptive legislation requiring notice to consumers in the 
        event of a security breach, where such breach places consumers 
        at risk of identity theft or fraud. California implemented 
        similar legislation several years ago, and over thirty other 
        states are involved in passing similar laws. The bottom line is 
        that consumers deserve a nationwide mandate that requires that 
        they be notified when they are at risk of identity theft, so 
        they can take appropriate steps to protect themselves.

        Extension of the GLBA Safeguards Rule: Currently, Acxiom 
        voluntarily subjects itself to the GLBA Safeguards Rule with 
        respect to the company's computer services and information 
        products. Acxiom also complies with the California safeguards 
        law (AB 1950). FTC Chairman Majoras recently has proposed an 
        extension of the GLBA Safeguards Rule to the information 
        services industry as a whole. Acxiom supports her 
        recommendation.

    Mr. Chairman, Acxiom appreciates the opportunity to participate in 
this hearing and to assist Congress in identifying how best to 
safeguard the Nation's information and data. Acxiom is available to 
provide any additional information the Committee may request.

    Senator Smith. Thank you, Ms. Barrett.
    Mr. Kurtz?

STATEMENT OF PAUL B. KURTZ, EXECUTIVE DIRECTOR, CYBER SECURITY 
                    INDUSTRY ALLIANCE (CSIA)

    Mr. Kurtz. Thank you, Senator Smith. It's a pleasure to be 
here today. Thank you for inviting the Cyber Security Industry 
Alliance to testify before this Committee. As Executive 
Director of CSIA, I'm pleased to speak about the importance of 
securing personal identity information.
    Prior to leading CSIA, I served for 16 years in the Federal 
Government, 12 years at the State Department and 4 years at the 
White House, where I served on the National Security Council 
and the Homeland Security Council, working on counterterrorism 
and critical infrastructure protection.
    CSIA is an organization of 15 CEOs consisting of the 
world's top security providers who offer the technical 
expertise and depth of focus and encourage a better 
understanding of cybersecurity policy issues. We believe 
ensuring the security, the integrity, and the availability of 
global information systems is fundamental to economic and 
national security.
    We need, simply, to come to terms with our reliance on 
information systems and the vast amount of personal information 
in storage and in transit in such systems. Our information 
systems must be secure and reliable--in particular, protecting 
personal information from unauthorized disclosure. We need a 
strategic approach that is more preventative or preemptive in 
nature, rather than largely reactive and defensive, as a recent 
CRS study on cybersecurity indicates.
    Every electronic breach of personal information is another 
reason for consumers to lose trust in our information systems. 
A recent survey conducted by the Poneman Institute revealed 
that 57 percent of consumers with high trust in their primary 
banks say they would cease all online services with their 
current bank in the event of a single security breach. The loss 
of trust or confidence in our information systems inhibits 
economic growth, the security of our citizens and Nation.
    CSIA believes the right approach to securing consumers' 
personal data requires a blend of appropriate policies, 
technical expertise, and security technologies. Let me be 
clear, we are not mandating specific technology solutions. A 
key question before this Committee is defining the government's 
role, whether directly or indirectly, in fostering the 
protection of personal information on information systems owned 
and operated by the private sector. This Committee, rightfully, 
will also examine where the marketplace is succeeding at 
protecting personal information, and where it is failing.
    At this critical time of technology development and 
innovation, the United States, as an economic force and a 
global technology leader, must carefully chart a public-policy 
approach to information security that continues to encourage 
innovation while also providing protection.
    There is no silver-bullet approach solution. There are two 
fundamental areas requiring protection: the storage of personal 
information, such as names, addresses, and Social Security 
numbers, and the movement of the data. Movement of the data 
amplifies the challenge of security, because it creates weak 
points, if you will, in the system. The movement of data makes 
it difficult to define the set of users who should take action 
to secure the personal information.
    So, what is the solution set? It involves a combination of 
technologies, policies, and expertise. Key policies and 
technologies include vetting employees, establishing and 
enforcing corporate security policies, encryption, auditing, 
monitoring, anti-virus, intrusion detection, and firewalls, 
strong authentication and access controls. These technologies, 
in particular, are critical, as passwords are inherently weak 
and easily compromised.
    Market adoption of security technologies, however, is 
mixed. Some enterprises, however, are beginning to see security 
as a means to differentiate themselves from their competition. 
Congress should examine the protection of personal information 
more broadly than just the data brokers, as other organizations 
possess significant amounts of personal data. We have seen 
evidence of those breaches in recent days.
    In this context, CSIA recommends Congress consider the 
following:
    Take a holistic approach to understanding what 
cybersecurity problems are, such as spyware, phishing, data-
warehouse security. They are, in fact, all related. In each 
case, the target is personal information in order to commit 
electronic fraud.
    Two, harmonize any legislation with existing legislation at 
the Federal level, filling gaps rather than duplicating 
requirements already contained in existing law.
    Use existing standards wherever possible, rather than 
creating new ones.
    Preempt State law, where appropriate, in order to avoid a 
patchwork quilt of regulations relating to the security of 
personal information.
    Encourage the broader use of security technologies without 
mandating such solutions. California, the Data base Protection 
Act, 1386, which went into effect in July 2003, encourages the 
encryption of personal information without mandating it.
    Investigate incentives, including safe harbors, tax 
benefits, third-party or self-certification, insurance, and 
adoption of best practices.
    Increase penalties for identity theft and cybercrimes, and 
ensure appropriate resources are available.
    Ratify the Council of Europe's Convention on Cybercrime, 
which will create a global framework for prosecuting and 
investigating cybercriminals. We need to see this in a global 
fashion.
    We need, also, to have leadership on the part of Federal 
Government, the formation of--or, excuse me, an Assistant 
Secretary at DHS focus on cybersecurity will be helpful.
    And we also can't forget R&D.
    Let me close by noting, again, the recent CRS study on 
cybersecurity. The study states there is currently no unified 
national framework for improving cybersecurity, and there are 
several areas of weaknesses where such a framework could be 
useful in generating improvements, and several means of 
leverage exist that could be used in the development or 
implementation of such a framework.
    We believe the points noted above offer, if you will, 
guideposts for the government's role in creating such a 
framework.
    I appreciate the opportunity to testify today. Thank you 
very much.
    [The prepared statement of Mr. Kurtz follows:]

       Prepared Statement of Paul B. Kurtz, Executive Director, 
                Cyber Security Industry Alliance (CSIA)
    Thank you Chairman Stevens and Co-Chairman Inouye for inviting the 
Cyber Security Industry Alliance (CSIA) to testify before this 
committee on Identity Theft/Data Broker Services. As Executive Director 
of CSIA, I am pleased to speak about the importance of securing 
personal identifying information.
    The Federal Trade Commission estimates that 27 million Americans 
were victims of some kind of ID theft in the past five years. Other 
studies suggest 1 in 20 U.S. citizens have been hit by electronic 
fraud. The numbers are staggering. Every electronic breach of personal 
information is another reason for consumers to lose trust in our 
information systems. A recent survey conducted by the Poneman Institute 
revealed that 57 percent of consumers with high trust in their primary 
bank say they would cease all online services with their current bank 
in the event of a single privacy breach. The loss of trust or 
confidence in our information systems inhibits economic growth, our 
security as citizens as well as a nation. CSIA believes the right 
approach to securing consumers' personal data requires a blend of 
appropriate policies, technical expertise and security technologies.
    A central question before this Committee today is defining the 
government's role--whether directly or indirectly--in protecting 
personal information residing on information systems owned and operated 
by the private sector. This Committee, rightfully, will also look at 
where the marketplace is succeeding at protecting personal information 
and where it is failing. At this critical time of technology 
development and innovation, the United States, as an economic force and 
a global technology leader, must carefully chart a public policy 
approach to information security that continues to encourage innovation 
while also providing protections.
    In my testimony today, I will cover four areas.

   A brief introduction to CSIA;
   Security challenges in securing electronic data;
   Solutions and market activity; and
   Recommendations for Congress' consideration in securing 
        electronic data.

Introduction to CSIA
    CSIA is dedicated to enhancing cybersecurity through public policy 
initiatives, public sector partnerships, corporate outreach, academic 
programs, alignment behind emerging industry technology standards and 
public education. CSIA is led by CEOs from the world's top security 
providers, who offer the technical expertise, depth and focus to 
encourage a better understanding of cyber security policy issues. We 
believe that ensuring the security, integrity and availability of 
global information systems is fundamental to economic and national 
security. We are committed to working with the public sector to 
research, create and implement effective agendas related to national 
and international compliance, privacy, cybercrime, and economic and 
national security. We work closely with other associations representing 
vendors, critical infrastructure owners and operators, as well as 
consumers.
    CSIA's initiatives range from examining the cybersecurity 
implications of Sarbanes-Oxley to the security and reliability of 
Internet telephony, also known as Voice over IP, to advocating more 
government leadership in identifying and protecting critical 
information infrastructure.
    CSIA understands that the private sector bears a significant burden 
for improving cyber security. CSIA embraces the concept of sharing that 
responsibility between information technology suppliers and operators 
to improve cyber security. Cyber security also requires bi-partisan 
government leadership.
    Members of the CSIA include BindView Corp.; Check Point Software 
Technologies Ltd.; Citadel Security Software Inc.; Citrix Systems, 
Inc.; Computer Associates International, Inc.; Entrust, Inc.; Internet 
Security Systems Inc.; iPass Inc.; Juniper Networks, Inc.; McAfee, Inc; 
PGP Corporation; Qualys, Inc.; RSA Security Inc.; Secure Computing 
Corporation; Symantec Corporation and TechGuard Security, LLC.
Challenges in Securing Electronic Data
    Many large organizations, from corporations to universities and 
health care systems, are conducting more of their business using 
network technology such as the Internet. Therefore, customers, 
employees, students and patients are having their personally 
identifiable information gathered into vast electronic data storage 
repositories. Some industries already have requirements to protect 
personally identifiable information, such as the banking and health 
communities. Laws and regulations are being created at various levels 
to address security and privacy because the criminal activity related 
to stealing these electronic data is increasing exponentially. Multiple 
laws requiring potentially different requirements will quickly make 
compliance an overly complex task.
    The problem of ensuring security and confidentiality of electronic 
data is complex. There are two fundamental areas requiring protection. 
The first is protecting the storage of personal information in data 
warehouses such as names, addresses and Social Security numbers. The 
second is protecting the movement of these data to and from the data 
warehouse.
    Technical security safeguards are used to address both the storage 
and movement issues. Policy is also crucial for it governs 
implementation of the technical safeguards and access to the data. 
Movement of the data amplifies the challenge of security because it 
creates weak points in the system. Those points are often outside the 
direct control of security administrators overseeing data warehouses. 
The movement of data makes it difficult to define the set of users who 
should take action to ensure the security of personal information by a 
select group. Therefore, policy and best practices play a pivotal role 
in shoring up weak points.
    The core information technology application of large data holders 
is a ``data warehouse.'' It accumulates disparate records then 
analyzes, stores and distributes a vast amalgamation of information--
billions of records about hundreds of millions of Americans. Many 
elements of the technology require special provisioning for security, 
including applications, systems and networks. A secure solution 
requires security provisions at the original source of data, at the 
data holder, at service providers, and at each customer location 
accessing the warehouse. The holder's control of security diminishes as 
information passes over external networks. Control vanishes once 
information is injected into the customer's internal applications.
    The data warehouse's database management system handles security 
and access control. Securing the warehouse is mostly a function of 
establishing, granting and updating access control permissions and 
rights--a configuration process based on policy. Security requirements 
extend to appropriate configuration of access controls and permissions 
for software applications feeding information into the data warehouse.
    Data warehouse technology operates on a networked system of 
servers. The servers may physically exist on premise at the data holder 
or at an external hosting service provider. Other systems for the data 
warehouse include access devices such as PCs, laptops, handheld 
computing devices, and telephones. Primary security for all systems is 
mostly a function of their operating systems. Proper installation, 
configuration and patching of bugs in the operating system software are 
crucial for secure systems.
Solutions and Market Activity
    Before considering steps the government should take to facilitate 
securing electronic data, it is appropriate to discuss solutions and 
market activity. There is no ``silver bullet'' technical or policy 
solution to secure data warehouses. A variety of technologies and 
policies are required. Key technologies and policies include:

   Policy Management: Enforces security rules and regulations. 
        Provides guidance to management on who should access what, when 
        and where.

   Vulnerability Management: Remediate vulnerabilities through 
        scanning devices that identify and patch vulnerabilities, as 
        well mitigate misconfigurations, unnecessary services, 
        unsecured accounts, and malicious code. Addressing major 
        classes of network and desktop vulnerability improves IT 
        enterprise and operational stability.

   Intrusion Detection/Prevention: Technologies that monitor 
        content of network traffic for infections and block traffic 
        carrying infected files or programs. Reducing incoming sick 
        traffic closes another window for criminals to access these 
        data.

   Authentication: A critical first step to ensuring only 
        appropriate users may access the data is using digital 
        certificates and multiple factor authentication. This is a way 
        to confirm legitimate customers and control internal end-user 
        access. Strong authentication also mitigates the problem of 
        passwords, which are inherently weak, from being hacked or 
        otherwise compromised.

   Access Controls: Ensure that authenticated users and 
        applications can access only that data and information which 
        they have been granted authority to use. Access controls may be 
        based on a number of factors, including an individual's role in 
        an organization. They are particularly important to prevent 
        insider attacks and as a deterrent to inappropriate browsing of 
        sensitive data.

   Audit Files: Detailed and protected records of computer and 
        network traffic and transactions that can help ensure policy 
        compliance and assist in forensic investigations of computer 
        crime.

   Encryption: Transforms data into password (key)-protected 
        packets that prevent reading by unauthorized users. Secure 
        communication enables data warehouse vendors to safely and 
        efficiently serve their customers.

   Anti-Virus: Software automatically checks new files for 
        infection. Inoculates PCs and applications from diseased 
        software code attempting to cause harm.

   Firewall: Blocks unauthorized traffic from entering PCs and 
        servers from the Internet. Protects end-users from unwanted 
        activity on their PCs.

    Some enterprises are beginning to see security as a means to 
differentiate themselves from their competition. For example, a well 
known e-trading firm is working with a CSIA member to use two factor 
authentication to improve the security of customer accounts. Some 
Internet Service Providers (ISPs) are differentiating themselves from 
others by highlighting the steps they are taking to protect personal 
information. Other CSIA member firms are providing managed security 
services, encryption technologies, intrusion prevention, vulnerability 
management services to a variety of owners and operators of 
infrastructure.
Policy Considerations for Securing Electronic Data
    The security of data warehouses will require a blend of appropriate 
policies, technical expertise, and security technologies. Technical 
provisions for security are aimed to thwart unauthorized access to 
personally identifiable information--whether by electronic hackers who 
break in by securing a legitimate password (e.g. NexisLexis), or by in-
person fraud (e.g. ChoicePoint). Technical provisions are only as 
strong as the security policy which implements them.
    Security breaches of data warehouses can adversely affect the life 
of any American so it is appropriate for Congress to establish national 
policies in conjunction with the private sector for the protection and 
privacy of personal information.
    While Congress is largely focused on data brokers, the protection 
of personal information is also critical in other businesses where data 
warehouse technology is used and where similar risks exist. Congress 
should examine the issue more broadly as it contemplates the need for 
legislation.
    In this context, CSIA recommends Congress to consider the 
following:

   Take a holistic approach to addressing cyber security. 
        Currently, Congress is considering cyber security problems such 
        as spyware, phishing, and data warehouse security on an 
        individual basis. In fact, each of these problems has at least 
        one issue in common: the attacker is seeking an individual's 
        personal information in order to commit financial fraud. We can 
        anticipate similar exploits in the future.

   Harmonize any new legislation with existing legislation at 
        the Federal level, filling gaps rather than duplicating 
        requirements already contained in existing law, such as Gramm-
        Leach-Bliley Act (GLBA), the Health Insurance Portability and 
        Accounting Act (HIPAA), and the Fair Credit Reporting Act 
        (FCRA). Use existing security standards wherever possible, 
        rather than creating new ones. This approach would provide a 
        framework for identifying areas of risk, as well as encouraging 
        industry best practices.

   A piecemeal approach by Congress, in conjunction with the 
        numerous laws states are passing will present consumers and 
        businesses with a ``patchwork'' quilt of confusing laws and 
        complicated compliance issues. Already states are stepping into 
        the void and creating a confusing patchwork of legislation on 
        the issue. Legislation regulating spyware has been introduced 
        in 24 State legislatures this year, with approaches ranging 
        from studies to changes in criminal code. Anti-phishing 
        legislation is sitting on the Governor's desk in Hawaii, and 
        pending in states including Texas and Florida. And there are 
        more than 300 bills pending on identity theft in our Nation's 
        State legislatures. A Federal preemption of the many laws 
        recently passed or currently contemplated at the State level 
        related to spyware, phishing, and data broker security would 
        alleviate much of the concern and consternation within the 
        private sector as a whole. However, any preemptive Federal law 
        should maintain, at the minimum, the security standards already 
        put in place by corresponding state legislation.

   Encourage broader use of security technologies without 
        mandating specific technology solutions. Urge adoption of the 
        approach utilized in CA 1386 which calls for disclosure of a 
        breach involving unencrypted data.

   To encourage stronger cyber security, Congress should 
        investigate incentives, including ``safe harbors'', tax 
        benefits, third-party or self certification, insurance and the 
        adoption of best practices, without mandating specific 
        technology solutions. Dictating a specific technology is 
        counterproductive as it stifles innovation and discourages 
        creativity.

   Congress should increase penalties for identity theft and 
        other cyber crimes as well as ensure appropriate resources are 
        available to law enforcement authorities. The Senate should 
        swiftly ratify the Council of Europe's Convention on Cybercrime 
        which would create a global framework for investigating and 
        prosecuting cyber criminals.

   Congress should also take a long-term view of information 
        security. There is no coherent cyber security R&D agenda. 
        Significant Federal funding is closeted in classified programs. 
        While our national security needs must be met, we must 
        anticipate that privately owned and operated networks will be 
        attacked as well. We need to develop resilient, fault tolerant 
        networks which degrade gracefully under attack.

    Leadership in information technology is a constantly moving target. 
As the technology changes and improves, so must its security. Likewise, 
as the need for public protection evolves, so must our public policy. 
We call on Congress and the Administration to work with the private 
sector to develop a holistic approach to protecting our Nation's 
personal information.

    Senator Smith. Thank you very much.
    Mr. Rotenberg?

  STATEMENT OF MARC ROTENBERG, PRESIDENT/EXECUTIVE DIRECTOR, 
          ELECTRONIC PRIVACY INFORMATION CENTER (EPIC)

    Mr. Rotenberg. Senator Smith, Senator Nelson, Senator 
Pryor, thank you for the opportunity to testify today.
    My name is Marc Rotenberg. I'm an Executive Director at the 
Electronic Privacy Information Center. EPIC is a nonpartisan 
research organization, and we focus our work on emerging civil-
liberties and privacy issues. We'd like to thank you for 
holding this hearing today on identity theft and data brokers.
    We have a particular interest in this topic. Over the last 
several months, you, many of your constituents, and the 
American public have read quite a bit about the massive data 
disclosures taking place across the United States. But it was 
actually last year that EPIC wrote to the Federal Trade 
Commission and urged the FTC to begin an investigation of 
ChoicePoint and other companies in the data-broker industry. 
And we expressed particular concern about the products that 
were not covered under the Fair Credit Reporting Act. Our view 
was that these products contained much of the same sensitive 
information that would otherwise be regulated under Federal 
law. And, because this information wasn't covered under Federal 
law, we explained to the FTC, there was heightened risk of the 
loss of privacy of American consumers, of data breaches. And, 
in fact, many of the problems that we wrote about last year to 
the FTC came to pass over the last several months. So, we're 
very pleased that you're holding this hearing today.
    I'm going to focus my testimony this afternoon on the 
legislative proposals that have been put forward, because I 
think it's very important to understand the need to pass 
legislation at this point in time.
    Now, I will say, also, that, clearly, the companies have 
taken important steps, since the breaches have occurred, to try 
to improve their business practices and reduce the likelihood 
that future problems will arise, and they should be applauded 
for this.
    Senator Smith. But those steps, in your view, are not 
sufficient.
    Mr. Rotenberg. No, I don't think they are sufficient, sir.
    Senator Smith. So legislation is necessary.
    Mr. Rotenberg. I think legislation is part of the solution.
    Now, just to put this in context, this is not unlike the 
situation that the Congress faced when it first considered the 
Fair Credit Reporting Act. People understood that information 
about American consumers would be important for credit 
determinations and for loans. But it was also the case that 
that information had to be accurate and used only for 
appropriate purposes. So, Congress was able to pass the FCRA, 
improve the accuracy and reliability of the information for the 
businesses that had an appropriate reason to use it, and, at 
the same time, safeguard the privacy of American consumers.
    And what I'm suggesting today is that I think a similar 
approach should be taken with the information-broker industry.
    Now, you've heard quite a bit so far about industry's 
support for a notification bill. And we think this is also a 
good starting point. Certainly, the notification law in 
California made it possible for people to learn when this 
breach occurred, and to protect themselves so that they could 
minimize the risk resulting from the improper use of their 
personal information. And I think that approach will likely be 
adopted across the United States.
    But I don't think notification is adequate. And it is the 
two bills that are pending before this Committee, S. 500 and S. 
768, that I think point us in the direction of how we reduce 
the likelihood that future problems will occur.
    S. 500, for example, will give the FTC the authority to 
establish basic regulations to ensure that companies in the 
information-broker industry--make sure that the information is 
accurate and reliable, and establish privacy safeguards.
    But I think the better approach, and the one that I know 
Senator Nelson has spent a great deal of time on, is S. 768. 
This legislation really gets to the key problems today in the 
United States, not only ensuring the accuracy of this 
information, but dealing directly with the problem if the 
misuse of the Social Security number, which is clearly 
contributing to the problem of identity theft--limiting the 
circumstances under which personal information may be sold, 
giving individuals a private right-of-action, and ensuring that 
the types of safeguards are established, that international 
cooperation is made possible, and that the FTC reports to you 
on an annual basis about how their work is progressing to limit 
the problem of identity theft. I think also the establishment 
of an identity theft center within the FTC would come as an 
enormous benefit to American consumers.
    As you may know, identity theft is now the number one crime 
in the United States. The FTC puts the figure at over $50 
billion. It's one out of 20 adults in this country. I think S. 
768 provides the type of framework, the type of comprehensive 
solution, consistent with the approach that was taken with the 
FCRA for the credit-reporting industry 30 years ago, that the 
American public needs today.
    So, I thank you, again, for holding this hearing, and I 
hope the Committee will be able to take action on that bill.
    [The prepared statement of Mr. Rotenberg follows:]

  Prepared Statement of Marc Rotenberg, President/Executive Director, 
              Electronic Privacy Information Center (EPIC)
    Mr. Chairman, and members of the Committee, thank you for the 
opportunity to appear before you today. My name is Marc Rotenberg and I 
am Executive Director and President of the Electronic Privacy 
Information Center in Washington, DC. EPIC is a non-partisan public 
interest research organization established in 1994 to focus public 
attention on emerging civil liberties issues. We are very pleased that 
you have convened this hearing today on Identity Theft and Data Broker 
Services.
    The main point of my testimony today is to make clear the 
extraordinary urgency of addressing the unregulated sale of personal 
information in the United States and how the data broker industry is 
contributing to the growing risk of identity theft in the United 
States. There is every indication that this problem is getting worse.
    Whatever your views may be on the best general approach to privacy 
protection, I urge you to take aggressive steps to regulate the 
information-broker industry and to protect the privacy and security of 
Americans.
The Significance of the ChoicePoint Matter
    With all the news reporting of the last few months, it has often 
been difficult to tell exactly how a criminal ring engaged in identity 
theft obtained the records of at least 145,000 Americans. According to 
some reports, there was a computer ``break-in.'' Others described it as 
``theft.'' \1\ In fact, ChoicePoint simply sold the information.\2\ 
This is ChoicePoint's business and it is the business of other 
companies that are based primarily on the collection and sale of 
detailed information on American consumers. In this most recent case, 
the consequences of the sale were severe.
    According to California police, at least 750 people have already 
suffered financial harm.\3\ Investigators believe data on at least 
400,000 individuals may have been compromised.\4\ Significantly, this 
was not an isolated incident. Although ChoicePoint CEO Derek Smith said 
that the recent sale was the first of its kind, subsequent reports 
revealed that ChoicePoint also sold similar information on 7,000 people 
to identity thieves in 2002 with losses over $1 million.\5\ And no 
doubt, there may have been many disclosures before the California 
notification law went into effect as well as more recent disclosures of 
which we are not yet aware.
    The consumer harm that results from the wrongful disclosure of 
personal information is very clear. According to the Federal Trade 
Commission, last year 10 million Americans were affected by identity 
theft. Identity theft is the number one crime in the country. For the 
fifth year in a row, identity theft topped the list of complaints, 
accounting for 39 percent of the 635,173 consumer fraud complaints 
filed with the agency last year.\6\ And there is every indication that 
the level of this crime is increasing.
    ChoicePoint is not the only company that has improperly disclosed 
personal information on Americans. Bank of America misplaced back-up 
tapes containing detailed financial information on 1.2 million 
employees in the Federal Government, including many Members of 
Congress.\7\ Lexis-Nexis originally reported that it made available 
records from its Seisint division on 32,000 Americans to a criminal 
ring that exploited passwords of legitimate account holders.\8\ That 
number was later revised to 310,000.\9\ DSW, a shoe company, announced 
that 103 of its 175 stores had customers' credit and debit card 
information improperly accessed.\10\ Last week, Time Warner revealed 
that it lost track of detailed data concerning 600,000 current and 
previous employees.
    Legislation in this area is long overdue. Regrettably, ChoicePoint 
and other information brokers have spent a great deal of time and money 
trying to block effective privacy legislation in Congress. According to 
disclosure forms filed with the U.S. House and Senate, obtained by the 
Wall Street Journal, ChoicePoint and six of the country's other largest 
sellers of private consumer data spent at least $2.4 million last year 
to lobby Members of Congress and a variety of Federal agencies. The 
Journal reports that, ``ChoicePoint was the biggest spender, with 
$970,000 either paid to outside lobbyists or spent directly by the 
company.'' \11\
    But the real cost for these activities is borne by Americans, all 
across the country. This improper disclosure and use of personal 
information is contributing to identity theft, which is today the 
number one crime in the United States. According to a 2003 survey by 
the Federal Trade Commission, over a one-year period nearly 5 percent 
of the adult populations were victims of some form of identity 
theft.\12\
Growing Dependence on the Information Broker Industry
    Mr. Chairman, the representatives of the information-broker 
industry will testify this morning that the American economy and even 
our national security are becoming increasingly dependent on this 
industry. In many respects, this is true. These companies have become 
the true invisible hand of the information economy. Their ability to 
determine the opportunities for American workers, consumers, and voters 
is without parallel. If a ChoicePoint record says you were late on a 
rent payment, whether or not that's true, you may lose a chance for a 
new apartment or a job. If one of these companies wrongfully removes 
registered voters from the voting roles, those people are denied their 
Constitutional right to vote.
    The stakes becomes even higher with homeland security. Axciom, for 
example, may play a central role in the identity verification 
procedures for Secure Flight, the new airline passenger pre-screening 
system. According to the Wall Street Journal, a Virginia company named 
Eagle Force has tested sample passenger information against commercial 
databases supplied by Arkansas-based Acxiom Corp.\13\ Acxiom is the 
same company that stirred controversy after it shared information about 
JetBlue Airways' passengers, without their knowledge, with a defense 
contractor in 2002.\14\
    Even as we become more reliant on these firms, the reports of 
problems in the industry and the skyrocketing problem of identity theft 
have made clear that Congress must step in. There are simply no market 
mechanisms that protect privacy, ensure accuracy, or limit security 
breaches where there is no direct obligation to the person whose 
personal information is at risk.
EPIC's Efforts To Bring Public Attention to the Problems With 
        ChoicePoint
    Well before the recent news of the ChoicePoint debacle became 
public, EPIC had been pursuing the company and had written to the FTC 
to express deep concern about its business practices and its ability to 
flout the law. On December 16, 2004, EPIC urged the Federal Trade 
Commission to investigate ChoicePoint and other data brokers for 
compliance with the Fair Credit Reporting Act (FCRA), the Federal 
privacy law that helps insure that personal financial information is 
not used improperly.\15\ The EPIC letter said that ChoicePoint and its 
clients had performed an end-run around the FCRA and was selling 
personal information to law enforcement agencies, private 
investigators, and businesses without adequate privacy protection.
    ChoicePoint wrote back to us to say, in effect, that there was no 
problem. The company claimed to comply fully with FCRA and that the 
question of whether FCRA, or other Federal privacy laws, should apply 
to all of its products as simply a policy judgment. It made this claim 
at the same time it was spending several million dollars over the last 
few years to block the further expansion of the FCRA.
    Mr. Chairman, hindsight may be 20-20, but it is remarkable to us 
that ChoicePoint had the audacity to write such a letter when it 
already knew that State investigators had uncovered the fact that the 
company had sold information on American consumers to an identity theft 
ring. They were accusing us of inaccuracy at the same time that State 
and Federal prosecutors knew that ChoicePoint, a company that offered 
services for business credentialing, had exposed more than a hundred 
thousand Americans to a heightened risk of identity theft because it 
sold data to crooks.
    But the problems with ChoicePoint long preceded this recent 
episode. Thanks to Freedom of Information Act requests relentlessly 
pursued by EPIC's Senior Counsel Chris Hoofnagle, we have obtained over 
the last several years extraordinary documentation of ChoicePoint's 
growing ties to Federal agencies and the increasing concerns about the 
accuracy and legality of these products.\16\ So far, EPIC has obtained 
FOIA documents from nine different agencies concerning ChoicePoint. One 
document from the Department of Justice, dated December 13, 2002, 
discusses a ``Report of Investigation and Misconduct Allegations . . . 
Concerning Unauthorized Disclosure of Information.'' \17\ There are 
documents from the IRS that describe how the agency would mirror huge 
amounts of personal information on IRS computers so that ChoicePoint 
could perform investigations.\18\ Several documents describe 
ChoicePoint's sole source contracts with such agencies as the United 
States Marshals Service and the FBI.\19\
    Among the most significant documents obtained by EPIC were those 
from the Department of State, which revealed the growing conflicts 
between the United States and foreign governments that resulted from 
the efforts of ChoicePoint to buy data on citizens across Latin America 
for use by the U.S. Federal law enforcement agencies.\20\ One document 
lists news articles that were collected by the agency to track outrage 
in Mexico and other countries over the sale of personal information by 
ChoicePoint.\21\ A second document contains a cable from the American 
Embassy in Mexico to several different government agencies warning that 
a ``potential firestorm may be brewing as a result of the sale of 
personal information by ChoicePoint.\22\ A third set of documents 
describes public relations strategies for the American Embassy to 
counter public anger surrounding the release of personal information of 
Latin Americans to ChoicePoint.\23\
Lessons of ChoicePoint
    The ChoicePoint incident proves many important lessons for the 
Congress as it considers how best to safeguard consumer privacy in the 
information age.
    First, it should be clear now that privacy harms have real 
financial consequences. In considering privacy legislation in the past, 
Congress has often been reluctant to recognize the actual economic harm 
that consumers suffer when their personal information is misused, when 
inaccurate information leads to the loss of a loan, a job, or 
insurance. Consumers suffer harms both from information that is used 
for fraud and inaccurate information that leads to lost opportunities 
through no fault of the individual.
    A clear example of how the company has contributed to the growing 
problem of identity theft may be found in ChoicePoint's subscriber 
agreement for access to AutoTrackXP, a detailed dossier of individuals' 
personal information. A sample AutoTrackXP report on the ChoicePoint 
website shows that it contains Social Security Numbers; driver license 
numbers; address history; phone numbers; property ownership and 
transfer records; vehicle, boat, and plane registrations; UCC filings; 
financial information such as bankruptcies, liens, and judgments; 
professional licenses; business affiliations; ``other people who have 
used the same address of the subject,'' ``possible licensed drivers at 
the subject's address,'' and information about the data subject's 
relatives and neighbors.\24\ This sensitive information is available to 
a wide array of companies that do not need to articulate a specific 
need for personal information each time a report is purchased. 
ChoicePoint's subscriber agreement shows that the company allows access 
to the following businesses: attorneys, law offices, investigations, 
banking, financial, retail, wholesale, insurance, human resources, 
security companies, process servers, news media, bail bonds, and if 
that isn't enough, ChoicePoint also includes ``other.''
    Second, it should be clear that market-based solutions fail utterly 
when there is no direct relationship between the consumer and the 
company that proposed to collect and sell information on the consumer. 
While we continue to believe that privacy legislation is also 
appropriate for routine business transactions, it should be obvious to 
even those that favor market-based solutions that this approach simply 
does not work where the consumer exercises no market control over the 
collection and use of their personal information. As computer security 
expert Bruce Schneier has noted, ``ChoicePoint doesn't bear the costs 
of identity theft, so ChoicePoint doesn't take those costs into account 
when figuring out how much money to spend on data security.'' \25\ This 
argues strongly for regulation of the information-broker industry.
    Third, there are clearly problems with both the adequacy of 
protection under current Federal law and the fact that many information 
products escape any kind privacy rules. ChoicePoint has done a 
remarkable job of creating detailed profiles on American consumers that 
they believe are not subject to Federal law. Products such as 
AutoTrackXP are as detailed as credit reports and have as much impact 
on opportunities in the marketplace for consumers as credit reports, 
yet ChoicePoint has argued that they should not be subject to FCRA. 
Even their recent proposal to withdraw the sale of this information is 
not reassuring. They have left a significant loophole that will allow 
them to sell the data if they believe there is a consumer benefit.\26\
    But even where legal coverage exists, there is insufficient 
enforcement, consumers find it difficult to exercise their rights, and 
the auditing is non-existent. According to EPIC's research, while 
ChoicePoint claims to monitor their subscribers for wrongdoing, there 
is no public evidence that the company has referred a subscriber to 
authorities for violating individuals' privacy. In other words, in the 
case where a legitimate company obtains personal information, there is 
no publicly available evidence that ChoicePoint has any interest in 
whether that information is subsequently used for illegitimate 
purposes.
    Law enforcement, which has developed increasingly close ties to 
information brokers such as ChoicePoint, seems to fall entirely outside 
of any auditing procedures. This is particularly troubling since even 
those reports that recommend greater law enforcement use of private 
sector databases for public safety recognize the importance of auditing 
to prevent abuse.\27\
    And of course there are ongoing concerns about the broad 
permissible purposes under the FCRA, the use of credit header 
information to build detailed profiles, and the difficulty that 
consumers continue to face in trying to obtain free credit reports that 
they are entitled to under the FACTA.
    Fourth, we believe this episode also demonstrates the failure of 
the FTC to aggressively pursue privacy protection. We have repeatedly 
urged the FTC to look into these matters. On some occasions, the FTC 
has acted.\28\ But too often the Commission has ignored privacy 
problems that are impacting consumer privacy and producing a loss of 
trust and confidence in the electronic marketplace. In the late 1990s, 
the FTC promoted self-regulation for the information-broker industry 
and allowed a weak set of principles promulgated as the Individual 
References Service Group to take the place of effective legislation. It 
may well be that the ChoicePoint fiasco could have been avoided if the 
Commission chose a different path when it considered the practices of 
the information-broker industry.
    The FTC has also failed to pursue claims that it could under 
section 5 of the FTC Act, which prohibits unfair practices. Practices 
are unfair if they cause or are likely to cause consumers substantial 
injury that is neither reasonably avoidable by consumer nor offset by 
countervailing benefits to consumers and competition.\29\ It may be 
that the unfairness doctrine could be applied in cases where there is 
no direct relationship between the consumer and the company, but to 
date the FTC has failed to do this.\30\
    Fifth, we believe the ChoicePoint episode makes clear the 
importance of state-based approaches to privacy protection. Congress 
simply should not pass laws that tie the hands of State legislators and 
prevent the development of innovative solutions that respond to 
emerging privacy concerns. Many states are today seeking to establish 
strong notification procedures to ensure that their residents are 
entitled to at least the same level of protection as was provided by 
California.\31\
    In this particular case, the California notification statute helped 
ensure that consumers would at least be notified that they are at risk 
of heightened identity theft. This idea makes so much sense that 38 
attorneys general wrote to ChoicePoint to say that their residents 
should also be notified if their personal information was wrongly 
disclosed.\32\ ChoicePoint could not object. It was an obvious 
solution.
Recommendations
    Clearly, there is a need for Congress to act. Although ChoicePoint 
has taken some steps to address public concerns, it continues to take 
the position that it is free to sell personal information on American 
consumers to whomever it wishes where ChoicePoint, and not the 
consumer, believes there is a ``consumer-driven benefit or 
transaction.'' \33\ Moreover, the industry remains free to change its 
policies at some point in the future, and the steps taken to date do 
not address the larger concerns across the information-broker industry.
    Modest proposals such as the extension of the Gramm-Leach-Bliley 
Act's Security Safeguards Rule are unlikely to prevent future debacles. 
The Safeguards Rule merely requires that financial institutions have 
reasonable policies and procedures to ensure the security and 
confidentiality of customer information. Recall that the disclosure by 
ChoicePoint did not result from a ``hack'' or a ``theft'' but from a 
routine sale. Moreover, the Security Safeguards Rule will do nothing to 
give consumers greater control over the transfer of their personal 
information to third parties or to promote record accuracy.
    Extending notification statutes such as the California bill would 
be a sensible step, but this is only a partial answer. Notification 
only addresses the problem once the disclosure has occurred. The goal 
should be to minimize the likelihood of future disclosures. It is also 
important to ensure that any Federal notification bill is at least as 
good as the California state bill and leaves the states the freedom to 
develop stronger and more effective measures. What happens for example, 
when at some point in the future, we must contend with the 
extraordinary privacy problems that will result from the disclosure of 
personal information contained in a database built on biometric 
identifiers?
    There are several proposals pending in the Senate to address the 
growing problem of identity theft. In particular, the Notification of 
Risk to Personal Data Act, S. 751, and the Comprehensive Identity Theft 
Prevention Act, S. 768, provide strong complimentary safeguards. The 
Committee should act quickly to ensure their passage.
Notification of Risk to Personal Data Act, S. 751
    One of the lessons of the recent disclosures about the information-
broker industry is that we could not understand the scope of the 
problem without information about actual security breaches. Imagine 
trying to legislate airline safety or the reliability of medical 
products without even basic information about the extent of the problem 
or the number of people affected. That is where the information 
security problem was before the passage of the California notification 
law. That critical State law ensured, for the first time, that those 
whose personal information had been wrongfully disclosed would be 
notified of the breach and given the opportunity to take additional 
measures. Not surprisingly, once the problem became known, other states 
urged ChoicePoint to provide notification to their residents. Thirty-
eight State attorneys general wrote to the head of ChoicePoint. Many 
State legislatures are now considering bills that would establish 
similar notification obligations.
    Given this experience, Senator Feinstein's bill, the Notification 
of Risk to Personal Data Act, is an obvious first step in the effort to 
help ensure that Americans can protect themselves when security 
breaches occur. The bill would require Federal agencies and private 
sector businesses that engage in interstate commerce to provide 
notification when personal information is acquired by unauthorized 
persons. The bill recognizes that there may be delayed notification 
where this is necessary to aid a law enforcement investigation. The 
bill also provides certain exceptions for national security and law 
enforcement, though sensibly does not allow these exceptions to be used 
to hide violations of law or to protect poor administration. There are 
a number of alternatives for notification that recognize that there may 
be more efficient and less costly ways to notify individuals in certain 
circumstances.
    While this is a good measure, we are concerned that the bill will 
preempt stronger State laws that may be developed to address the 
problem of notification where risks to personal data arise. We 
understand the interest in a single national standard, but this is an 
area where the states should retain the freedom to innovate and explore 
new solutions to this far-reaching problem. We urge the Committee to 
remove Section 5 of the Act, which would preempt State law.
    We also caution against any effort to limit the circumstances under 
which notification might occur. As a matter of fairness, it should be 
the individual's right to know when his or her personal information has 
been improperly obtained. And it should be equally obvious that given 
the choice businesses will choose not to provide notice unless they are 
required to do so.
Comprehensive Identity Theft Prevention Act, S. 768
    Improved notification will play an important role in assisting 
consumers where security breaches occur, but clearly the long-term goal 
must be to reduce the risk of these disclosures and to minimize harm 
when these breaches occur. This is not a new problem. Congress has 
worked for more than thirty years to provide privacy safeguards and to 
protect against the risks associated with the automation of personal 
information. A good privacy bill works for both consumers and 
businesses. The Fair Credit Reporting Act, for example, was a benefit 
to both consumers and the credit reporting industry because it 
established privacy safeguards and helped ensure greater accuracy in 
the information that was made available to credit grantors.
    The problem today is that information brokers are operating outside 
of any comprehensive regulatory scheme. Moreover, they have no direct 
relationship with the individuals whose personal information they 
routinely sell to others. So, there are inadequate incentives to 
protect privacy or to ensure accuracy. There is a clear need to 
establish comprehensive protections for the information-broker 
industry.
    The Comprehensive Identity Theft Prevention Act, S. 768, provides 
an excellent framework for privacy protection in the information-broker 
industry. Building on the general approach of the FCRA and other 
privacy statutes, the bill aims to ensure that when personal 
information is collected, it will be used for appropriate purposes, and 
that when problems arise there will be meaningful remedies.
    The Act requires the Federal Trade Commission to establish rules 
for information brokers and for the protection of personal information. 
The rules cover data accuracy, confidentiality, user authentication, 
and detection of unauthorized use. Significantly, the Act also gives 
individuals the opportunity to review the information about them held 
by data brokers. This helps ensure accuracy and accountability and is 
similar to provisions currently found in the Fair Credit Reporting Act.
    The Information Protection and Security Act also provides 
meaningful enforcement by ensuring that the states are able to pursue 
investigations and prosecution, after appropriate notice to the FTC and 
the attorneys general. The Act also gives individuals, who of course 
are the ones that suffer the actual harm, to pursue a private right-of-
action.
Additional Safeguards
    Furthermore, to the extent that information brokers, such as 
ChoicePoint, routinely sell data to law enforcement and other Federal 
agencies, they should be subject to the Federal Privacy Act. A 
``privatized intelligence service,'' as Washington Post reporter Robert 
O'Harrow has aptly described the company, ChoicePoint should not be 
permitted to flout the legal rules that help ensure accuracy, 
accountability, and due process in the use of personal information by 
Federal agencies.\34\ It would be appropriate to consider legislation 
that would establish safeguards for the use of commercial information 
by government agencies.\35\
    Also, Professor Daniel Solove and EPIC's Chris Hoofnagle have put a 
very good framework forward.\36\ This approach is similar to other 
frameworks that attempt to articulate Fair Information Practices in the 
collection and use of personal information. But Solove and Hoofnagle 
make a further point that is particularly important in the context of 
this hearing today on ChoicePoint. Increasingly, the personal 
information made available through public records to enable oversight 
of government records has been transformed into a privatized commodity 
that does little to further government oversight, but does much to 
undermine the freedom of Americans. While EPIC continues to favor 
strong, open government laws, it is clearly the case that open 
government interests are not served when the government compels the 
production of personal information, sells the information to private 
data vendors, who then make detailed profiles available to strangers. 
This is a perversion of the purpose of public records.
    Looking ahead, there is a very real risk that the consequences of 
improper data use and data disclosure are likely to accelerate in the 
years ahead. One has only to look at the sharp increase in identity 
theft documented by the Federal Trade Commission, the extraordinary 
rate of data aggregation in new digital environments, and the enormous 
efforts of the Federal Government to build ever more elaborate 
databases to realize that the risk to personal privacy is increasing 
rapidly. Congress can continue to deal with these challenges in 
piecemeal fashion, but it seems that the time has come to establish a 
formal government commission charged with the development of long-terms 
solutions to the threats associated with the loss of privacy. Such a 
commission should be established with the clear goal of making specific 
proposals. It should include a wide range of experts and advocates. And 
it should not merely be tasked with trying to develop privacy 
safeguards to counter many of the government new surveillance 
proposals. Instead, it should focus squarely on the problem of 
safeguarding privacy.
    Congress needs to establish a comprehensive framework to ensure the 
right of privacy in the twenty-first century. With identity theft 
already the number one crime, and the recent spate of disclosures, any 
further delay could come at enormous cost to American consumers and the 
American economy.
The REAL ID Act
    Finally, Mr. Chairman, I would like to say a few words about the 
REAL ID Act, a sweeping proposal for a new Federal identification 
system, that may be taken up tonight as part of the supplemental 
appropriation for the troops in Iraq.
    As you know, this bill, which was rejected in the last Congress, 
has gone forward in this Congress without even a hearing. It would 
require State agencies to collect sensitive, personal information on 
every American citizen who drives a car. It would put the State DMVs in 
the position of enforcing the country's immigration laws. It would give 
the Federal Government broad authority to regulate a traditional State 
function. Whatever one's views may be about the merits of the 
legislation, it should concern all sides that this proposal could pass 
in the Senate without a hearing or even debate.
    I make this point today in this hearing on identity theft because 
the State DMV record systems have actually become the target of 
identity thieves. In recent months, three State DMVs have been attacked 
by identity thieves. In March, burglars rammed a vehicle through a back 
wall at a DMV near Las Vegas and drove off with files, including Social 
Security numbers, on about 9,000 people. Recently, Florida police 
arrested 52 people, including 3 DMV examiners, in a scheme that sold 
more than 2,000 fake driver's licenses. Two weeks ago, Maryland police 
arrested three people, including a DMV worker, in a plot to sell about 
150 fake licenses.
    It is obviously the case that the establishment of new 
identification requirements in the United States, the dramatic 
expansion of the authority of the Department of Homeland Security, and 
the requirement that we all now deposit with State agencies the very 
documents that establish our proof of identity will have a profound 
impact on the issues under consideration today.\37\
    Under any reasonable policy process, there would be an opportunity 
to examine these issues in more detail and to assess the risks that 
will surely result from the implementation of this legislation. Before 
there is a vote on this proposal, there should be a hearing in this 
Congress on this bill.\38\ That power still remains with the Senate. I 
urge you to exercise it.
Conclusion
    For many years, privacy laws came up either because of the efforts 
of a forward-looking Congress or the tragic experience of a few 
individuals. Now we are entering a new era. Privacy is no longer 
theoretical. It is no longer about the video records of a Federal judge 
or the driver registry information of a young actress. Today privacy 
violations affect hundreds of thousands of Americans all across the 
country. The harm is real and the consequences are devastating.
    Whatever one's view may be of the best general approach to privacy 
protection, there is no meaningful way that market-based solutions can 
protect the privacy of American consumers when consumers have no direct 
dealings with the companies that collect and sell their personal 
information. There is too much secrecy, too little accountability, and 
too much risk of far-reaching economic damage.
    There are two important bills now before the Committee. The 
Notification of Risk to Personal Data Act, S. 751, would provide 
meaningful notice to individuals when their personal information is 
wrongfully disclosed. The Comprehensive Identity Theft Prevention Act, 
S. 768, would help reduce the likelihood of future breaches. I hope the 
Committee will be able to act quickly on these proposals.
    I appreciate the opportunity to be here today. I will be pleased to 
answer your questions.
References
    EPIC ChoicePoint Page, available at http://www.epic.org/privacy/
choicepoint/.
ENDNOTES
    \1\ Associated Press, ``ChoicePoint hacking attack may have 
affected 400,000,'' Feb. 17, 2005, available at http://www.ledger-
enquirer.com/mld/ledgerenquirer/news/local/10920220.htm.
    \2\ Robert O'Harrow Jr., ``ID Theft Scam Hits D.C. Area 
Residents,'' Washington Post, Feb. 21, 2005, at A01.
    \3\ Bob Sullivan, ``Data theft affects 145,000 nationwide,'' MSNBC, 
Feb. 18, 2005, available at http://www.msnbc.msn.com/id/6979897/.
    \4\ Associated Press, ``ChoicePoint hacking attack may have 
affected 400,000,'' Feb. 17, 2005, available at http://www.ledger-
enquirer.com/mld/ledgerenquirer/news/local/10920220.htm.
    \5\ David Colker and Joseph Menn, ``ChoicePoint CEO Had Denied Any 
Previous Breach of Database,'' Los Angeles Times, March 3, 2005, at 
A01.
    \6\ Federal Trade Commission, ``FTC Releases Top 10 Consumer 
Complaint Categories for 2004,'' (Feb. 1, 2005), available at http://
www.ftc.gov/opa/2005/02/top102005.htm.
    \7\ Robert Lemos, ``Bank of America loses a million customer 
records,'' CNet News.com, Feb. 25, 2005, available at http://
earthlink.com.com/Bank+of+America+
loses+a+million+customer+records/2100-1029_3-
5590989.html?tag=st.rc.targ_mb.
    \8\ Jonathan Krim and Robert O'Harrow, Jr., ``LexisNexis Reports 
Theft of Personal Data,'' Washingtonpost.com, March 9, 2005, available 
at http://www.washingtonpost
.com/ac2/wp-dyn/A19982-2005Mar9?language=printer.
    \9\ LexisNexis Data on 310,000 People Feared Stolen, New York 
Times, Apr. 12, 2005, available at http://www.nytimes.com/reuters/
technology/tech-media-lexis
nexis.html?.
    \10\ Associated Press, ``Credit Information Stolen From DSW 
Stores,'' March 9, 2005, available at http://abcnews.go.com/Business/
wireStory?id=563932&CMP=OTC-
RSSFeeds0312.
    \11\ Evan Perez and Rick Brooks, ``Data Providers Lobby to Block 
More Oversight,'' Wall Street Journal, March 4, 2005, at B1.
    \12\ Federal Trade Commission, ``Identity Theft Survey Report'' 
(Sept. 2003), available at http://www.ftc.gov/os/2003/09/
synovatereport.pdf.
    \13\ ``US To Require Airline Passengers' Full Names, Birth Dates,'' 
Wall Street Journal, May 4, 2005, available at http://online.wsj.com/
article/0,BT_CO_20050504
_012176,00.html.
    \14\ EPIC pursued a complaint against JetBlue and Axcio at the 
Federal Trade Commission, arguing that ``JetBlue Airways Corporation 
and Acxiom Corporation have engaged in deceptive trade practices 
affecting commerce by disclosing consumer personal information to Torch 
Concepts Inc., an information mining company with its principal place 
of business in Huntsville, Alabama, in violation of 15 U.S.C. 
Sec. 45(a)(1).'' Although the FTC chose not to take action in response 
to the complaint, it continues to be our position that when a company 
represents that it will not disclose the personal information of its 
customers to a third party and subsequently does so, it has engaged in 
an unfair and deceptive trade practice.
    \15\ Letter from Chris Jay Hoofnagle, Associate Director, EPIC, and 
Daniel J. Solove, Associate Professor, George Washington University Law 
School, to Federal Trade Commission, Dec. 16, 2004, available at http:/
/www.epic.org/privacy/choicepoint/fcraltr12.16.04.html.
    \16\ EPIC v. Dep't of Justice et al., No. 1:02cv0063 (D.D.C. 2002).
    \17\ Available at http://www.epic.org/privacy/choicepoint/
default.html.
    \18\ Id.
    \19\ Id.
    \20\ Id.
    \21\ Id.
    \22\ Id.
    \23\ Id.
    \24\ ChoicePoint, AutoTrackXP Report, http://www.choicepoint.com/
sample_rpts/AutoTrackXP.pdf.
    \25\ ``Schneier on Security: ChoicePoint'' available at http://
www.schneier.com/blog/archives/2005/02/choicepoint.html.
    \26\ Aleksandra Todorova, ``ChoicePoint to Restrict Sale of 
Personal Data,'' Smartmoney.com, March 4, 2005, available at http://
www.smartmoney.com/bn/index.cfm?story=20050304015004.
    \27\ See Chris J. Hoofnagle, ``Big Brother's Little Helpers: How 
ChoicePoint and Other Commercial Data Brokers Collect, Process, and 
Package Your Data for Law Enforcement,'' University of North Carolina 
Journal of International Law & Commercial Regulation (Summer 2004), 
available at http://ssrn.com/abstract=582302.
    \28\ See FTC's investigation into Microsoft's Passport program. 
Documentation available at http://www.epic.org/privacy/consumer/
microsoft/passport.html.
    \29\ 15 U.S.C. Sec. 45(n); Letter from Michael Pertschuk, FTC 
Chairman, and Paul Rand Dixon, FTC Commissioner, to Wendell H. Ford, 
Chairman, Senate Consumer Subcommittee, Committee on Commerce, Science, 
and Transportation (Dec. 17, 1980), available at http://www.ftc.gov/
bcp/policystmt/ad-unfair.htm.
    \30\ In FTC v. Rapp, the ``Touch Tone'' case, the FTC pursued 
private investigators engaged in ``pretexting,'' a practice where an 
individual requests personal information about others under false 
pretenses. No. 99-WM-783 (D. Colo. 2000), 2000 U.S. Dist. LEXIS 20627. 
In a typical scheme, the investigator will call a bank with another's 
Social Security Number, claim that he has forgotten his bank balances, 
and requests that the information be given over the phone. The FTC 
alleged that this practice of the defendants, was deceptive and unfair. 
It was deceptive because the defendants deceived the bank in providing 
the personal information of another. The practice was unfair in that it 
occurs without the knowledge or consent of the individual, and it is 
unreasonably difficult to avoid being victimized by the practice.
    \31\ ``ChoicePoint Incident Prompts State Lawmakers to Offer Data 
Notification Bills,'' 10 BNA Electronic Commerce & Law Report 217-18 
(March 9, 2005).
    \32\ Associated Press, ``38 AGs send open letter to ChoicePoint,'' 
Feb. 18. 2005, available at http://www.usatoday.com/tech/news/
computersecurity/infotheft/2005-02-19-ag-letter-to-choicepoint_x.htm.
    \33\ ``ChoicePoint Halts Sale of Sensitive Information, as Agencies 
Launch Probes,'' 10 BNA Electronic Commerce & Law Report 219 (March 9, 
2005).
    \34\ Robert O'Harrow, No Place to Hide: Behind the Scenes of Our 
Emerging Surveillance Society (Free Press 2005).
    \35\ See, e.g., Center for American Progress, ``Protecting Privacy 
in the Digital Age,'' May 4, 2005, available at http://
www.americanprogress.org/site/pp.asp?c=biJRJ8
OVF&b=651807.
    \36\ Daniel Solove and Chris Jay Hoofnagle, ``A Model Regime of 
Privacy Protection,'' March 8, 2005, available at http://
papers.ssrn.com/sol3/papers.cfm?
abstract_id=681902.
    \37\ See EPIC, ``National ID Cards and REAL ID Act,'' available at 
http://epic.org/privacy/id_cards/.
    \38\ See letter from Senators Sam Brownback, R-Kan., Joe Lieberman, 
D-Conn., and 10 other Senators to Senate Majority Leader Bill Frist, 
Apr. 11, 2005 (``Because of its magnitude, this legislation should be 
referred to the Senate Judiciary Committee on a schedule that provides 
adequate time for full and careful consideration. Legislating in such a 
complex area without the benefit of hearings and expert testimony is a 
dubious exercise and one that subverts the Senate's deliberative 
process.''), available at http://www.senate.gov/&7Egov_affairs/
index.cfm?FuseAction
=PressReleases.Detail&Affiliation=R&PressReleaseg_id=953&Month=4&Year=20
05.

    Senator Smith. Mr. Rotenberg, it is a fact that--I think 
one of my colleagues--Senator Kerry was asking--if you sign up 
to buy insurance on your property, you're not signing up to 
have your information shared, necessarily. Or are there, in 
most of these transactions, opt-in and opt-out factors or 
provisions?
    Mr. Rotenberg. Well, this is a very important point, 
Senator. In most of these transactions, the individual actually 
has no direct relationship with the information broker. In 
other words----
    Senator Smith. Are they even aware?
    Mr. Rotenberg. They don't know who these companies are. 
They don't deal directly with them. If you have a privacy 
problem with a bank, for example, you might decide not to do 
business with that bank, and you would have the opportunity in 
the marketplace to find another bank to do business with. But, 
you see, these companies are very similar to the credit-
reporting companies, in that they provide information that 
affects the ability of consumers to participate in the 
marketplace, to get jobs, to rent apartments, to obtain 
insurance, but consumers have no direct relationship with them. 
And that's why we think regulation in this area is so 
important.
    Senator Smith. But if we had--if this were at all possible, 
would you recommend, in the legislation, they have a means for 
opting-in to some of this identity--identification----
    Mr. Rotenberg. Yes.
    Senator Smith. Yes.
    Mr. Rotenberg. Yes. Under circumstances where the consumer 
believes----
    Senator Smith. They want----
    Mr. Rotenberg.--there's a benefit.
    Senator Smith.--they want it known.
    Mr. Rotenberg. Absolutely. In fact, that's one of the 
approaches, we think, for credit reports, for example, 
consumers certainly would want to make their credit reports 
available if they're seeking a loan. And I don't think any 
legislation should stop them from doing that. We're concerned 
about the circumstances where their credit reports are made 
available that they haven't made that choice.
    Senator Smith. Thank you.
    Ms. Frank?

          STATEMENT OF MARI J. FRANK, ESQ., ATTORNEY, 
                MARI J. FRANK, ESQ. & ASSOCIATES

    Ms. Frank. Hi. Thank you, presiding-Senator Smith and 
honorable Committee members, invited guests. And I want to 
especially thank Senator Nelson for S. 500, which I 
wholeheartedly support. And I will be happy to help you on S. 
768, because I think there are a lot of great things in that, 
as well.
    I'm an attorney. My name is Mari, by the way--people call 
me everything, but it is Mari--my name is Mari Frank, and I'm 
an attorney and privacy----
    Senator Smith. We're called a lot of things, too.
    [Laughter.]
    Ms. Frank. I know. I know.
    [Laughter.]
    Ms. Frank. I'm an attorney and privacy consultant from 
Orange County, California. I've assisted thousands of identity-
theft victims, and I also sit as an advisor to the State of 
California Office of Privacy Protection.
    In 1996, my identity was stolen by an imposter who paraded 
as me, robbing not only my personal life, but my professional 
identity. She took over $50,000 in credit, purchased a red 
convertible, rented a car and crashed it, and I was sued by the 
rental agency. I learned that, while working as a temporary 
secretary in an office 4 hours from my home, my evil twin 
downloaded my consumer report from an information broker. 
Because there is no law requiring a data broker to inform me of 
the purchase, I couldn't do anything to prevent this heist.
    Most victims are not negligent with their personal 
information, and nothing will protect them from fraud if their 
information is acquired from a security breach or by faulty 
information practices of data aggregators.
    Your personal information is worth more than currency 
itself. A fraudster can do anything you can do with your 
identification, and, even worse, they can do things like you--
that you would not do, such as commit crimes, seek revenge, or 
even engage in terrorist activities.
    Here are some examples of the main types of identity theft:
    The first one is financial gain. These are examples of 
people who have personally contacted me.
    George had a great job in the financial industry. When he 
was up for promotion, he permitted a background check, which 
showed that he had several very expensive properties, luxury 
cars, and even a boat. Also, it showed a problem with his CPA 
license. He learned that there were many credit accounts also 
that did not belong to him. He was flabbergasted, since this 
was not true, none of these things were true. Needless to say, 
he lost the promotion.
    Second use, avoiding prosecution or avoiding arrest. Lori--
and, by the way, Lori is here with me today. I have been 
helping her since last December, and Lori drove 4 hours to meet 
me and come to this hearing. She's with me today. Lori, a 
disabled vet who--and a single mom with a set of 6-year-old 
twins, was attending school to get her B.A. degree when the 
police showed up at her door. She was arrested and convicted 
for a crime that was committed by her imposter. Neither her 
fingerprints nor her physical description matched the 
impersonator. She's hoping that we'll get a new trial for her, 
but, more worrisome than that, she's fearful that, even when we 
get this cleaned up--which I'm sure we will--that the incorrect 
data will be resold.
    And here's the reason why I'm thinking this will happen. 
Scott Lewis is another client of mine who wanted to drive from 
Ohio today, but I think he sent the Senators a note. Scott was 
laid off from a high-paying job. He had great recommendations 
and felt sure that he would be rehired. For 2 years, he was 
denied employment. After hiring a private investigator, he saw 
his file from a data broker. Included in it were two driving--
three DUIs and an arrest for murder, none of which belonged to 
him.
    After the databases were finally cleaned up, after a 
tremendous amount of time and effort, he still couldn't get a 
job. So, again, we pulled his consumer background check. And, 
what did we find? The data broker was continuing to sell the 
erroneous information to all the prospective employers. Scott 
spent hundreds of hours living the nightmare of identity theft, 
and we did get him on Dateline and finally we were able to get 
him a job.
    Revenge. This is another reason someone does this. A radio 
talk-show host called me. He was shocked to learn that his own 
identity was stolen by a disgruntled listener who bought his 
dossier from an online information broker. Aside from calling 
him at home and bullying him, he obtained access to his e-mail 
and sent embarrassing e-mails to the station, pretending to be 
the talk-show host.
    And, finally, the last, but scariest, is terrorism and the 
threat to homeland security. The 9/11 terrorists had opened 
over 14 accounts at a Florida bank, using the false Social 
Security numbers and other documents. They also received 
thousands of dollars worth of credit. Not only did they do this 
for financial gain, but over half of them had names that were 
known as suspected terrorists. So they committed total 
identity-theft takeover. And, worse, they used these false 
identities to get revenge against our country.
    Recently, at a meeting that I attended with Senator 
Feinstein in California, law enforcement reported to her that 
suspected terrorists have been apprehended with many false 
documents in California so that they could hide under the radar 
screen and come over across our borders.
    Your identity is especially vulnerable with regard to the 
mega-databases held by information brokers who are selling huge 
amounts of your sensitive information in all-inclusive profiles 
without any governmental oversight. The very essence of the 
data-broker business is selling a broad range of very private 
and highly sensitive information, which, if acquired by a 
person with a criminal intent, provides a complete 
comprehensive package ready for identity takeover.
    These databases contain your personal, professional, 
social, possibly criminal--true or not--and financial 
existence. Tapping into your data profile is a fraudster's 
dream come true.
    In my written testimony, I attached Exhibit I, which has 
the ChoicePoint AutoTrack, which will show you the kinds of 
information--it's a sample--it's not a real person, by the way; 
it's just a sample. It will shock you, as it did me.
    When I recently attended the State Bar of California annual 
meeting, a data broker in the exhibit hall pulled my background 
after I gave him just my name. I was horrified--not only 
because I felt violated by all that it revealed, but, worse, by 
the tremendous number of errors. I was told that there was no 
way to correct the egregious mistakes. I was stunned by the 
prospect that aspects of that report may have resulted from my 
imposter's actions.
    Also, I was reminded of the Amy Boyer case, where Liam 
Youens used information broker Docusearch to obtain Amy's 
Social Security number and work address to kill her and then 
himself. Police later found a message on his computer that 
said, ``It's actually obscene what you can find out about 
people on the Internet.''
    Data brokers are invisible to most citizens. Everyone in 
this room who has a birth certificate, a driver's license--or 
if there's any public record about you at all, you are in those 
secret files. And there's much more about you from the data 
aggregation. Every Senator and everyone watching this hearing 
is in those profiles. Have you seen your dossier? Do you know 
what fact or fiction is being sold about you?
    As the law stands now, you don't have the right to know 
what is in these files, nor do you have the right to correct 
the many errors, nor do you have the right to know who has had 
access to these sensitive files, nor can you limit the sale. 
Actually, none of us here, except maybe the data brokers, have 
control over anything in those files. These companies have 
operated in the shadows and have sold this often erroneous 
information to myriad companies, the government, and even to 
fraudsters.
    Most Americans don't even know who these companies are or 
what they do. This is America, the home of freedom and liberty. 
This is not a communist country or a Nazi regime where secret 
files are kept on citizens and shared with various entities and 
governmental agencies.
    Don't law-abiding citizens have a right to at least see the 
dossiers and make sure that the information is correct?
    Although the credit-reporting agencies are considered data 
brokers, they're regulated by the FCRA, the Fair Credit 
Reporting Act. And that law gives us the right to see our data, 
review it, dispute it, correct it, find out who has had access 
to it, and we can even limit the sale.
    What is the impact of security breaches of the data brokers 
that are here today? Those impacted may not yet be victims of 
identity theft, yet they are victims of a Federal crime. The 
Identity Theft and Assumption Deterrence Act of 1998, which I 
testified for back then, 18 U.S.C. 1028, makes it a Federal 
crime when anyone knowingly transfers or uses without lawful 
authority a means of identification of another person with the 
intent to commit or aid or abet any unlawful activity that 
constitutes a Federal--a violation of Federal law or that 
constitutes a felony under applicable State or local law.
    I have personally spoken with victims of many of these 
security breaches. The victims feel very violated, frightened, 
and helpless. It is well known that criminals steal the 
information, but may not use it for months, or even years, 
afterwards. Additionally, the victims have not been notified of 
exactly what was stolen. They haven't seen these dossiers. So 
they feel entirely defenseless and don't even know what to 
protect.
    All right. So, what needs to be done? I'm going to go 
quickly. I really appreciate everything in S. 500, and I have a 
lot more, 25 pages, in my written testimony, but I'm going to 
just do a quick sweep here.
    Senator Smith. We'll include it all in the record.
    Ms. Frank. Right, OK. So, you can all see it. And I would 
really like you to look at my attachments, as well. I think 
they're very important.
    Number one, what do we need? We need transparency. That 
means we need to see what they have available, in front of us, 
for inspection. We need to define the uses of this information.
    Number two, we need consent and notice. Consumers should be 
able to give their consent to disclosure of their information 
prior to disclosure.
    The consumer should be able to know when it's sold.
    And the consumer should receive a free copy once a year, 
like we do under FCRA.
    The consumer should also have access and inspection and the 
ability to correct. There should also be quality controls and 
timely correction, so that if I contact an agency and I see--
for example, what happened to me, I would like to correct 
what's in that file, yet I--at this point, I can't. And I want 
to know that I can correct it. And if it's a public record, I 
need to know where to go to correct it.
    There must be strict security controls against risk of 
loss. We know this from what recently happened.
    We need enforcement. Unfortunately, what I have seen, in 
the past 9 years since I have been a victim, is that the 
Federal Trade Commission is overwhelmed. I also now am also a 
sheriff reserve in Orange County, and I know that--and 
California is one of the top states for identity theft--about 
one in ten cases are investigated; and, of those one in ten 
cases, about one in ten are prosecuted. So, enforcement is 
really important. And the Federal Trade Commission doesn't take 
many cases on this. So----
    Senator Smith. What do they find? Do they lead to a few 
people, or to many?
    Ms. Frank. Depends. It depends on the circumstance. They 
usually won't take the case unless it's of very high 
jurisdictional value or if they think it's a fraud ring, 
because they just have to prioritize. They just have limited 
resources.
    Enforcement should be by private right-of-action. It should 
also be by attorneys general and the Federal Trade Commission.
    And it's very important that we preserve State rights. I'm 
from a State that has been very proactive. We have the best 
privacy legislation, we are the only State with an Office of 
Privacy Protection. And it's our laws--in fact, we were the 
second State to have an identity-theft statute. We have the 
best identity-theft statutes, as far as penal codes, in the 
country. We have the security-breach law. We also allow 
security freezes to lock up your credit report, so, if you're a 
victim or even a consumer, you--no one can steal your credit 
identity. So----
    Senator Smith. Are those laws working?
    Ms. Frank. Yes. And--well, we know that the security-breach 
law is working, because in July of 2003, our law became 
effective. Prior to July 2003, we know that LexisNexis and 
ChoicePoint both had security breaches that they admitted in a 
hearing before the U.S. Senate. And they did not reveal it to 
anyone--I mean, to law enforcement, yes--but they did not 
reveal to potential victims. After 2003, we have seen a 
tremendous amount of disclosure because of our security-breach 
law. If it had not been for California, you would not even be 
here today to know about all this.
    So, that and the security-freeze laws, if we did not lock 
up the credit reports--right now, there are four states that 
allow you to close up your credit report for your credit 
freeze, and they are California, Texas, Vermont, and Louisiana. 
And I know there are 19 states that have introduced such 
legislation.
    So, if you tie the hands of State legislators, you're going 
to find that there is going to be a huge amount of problems for 
victims who cannot get some regulation to help them. And a lot 
of your bills, even the bills that were introduced by Senator 
Feinstein with regard to Social Security are based on 
California law.
    I understand about Federal preemption, that companies don't 
want to have to speak to all of the various states and deal 
with that--it's expensive--but I think we need to have a floor, 
not a ceiling.
    And I'll be happy to help this committee in any way I can. 
Thank you.
    [The prepared statement of Ms. Frank follows:]

         Prepared Statement of Mari J. Frank, Esq., Attorney, 
                    Mari J. Frank, Esq. & Associates
    Good morning, Chairman Stevens, Co-Chairman Inouye, Presiding 
Senator Smith, Honorable Committee Members, and invited guests. Thank 
you very much for the opportunity to address you today regarding 
concerns about identity theft and data broker services. I am grateful 
that Congress is studying this issue to craft strong measures to 
prevent identity theft in our society. Your desire to shine the light 
on these problems and make needed changes deserves commendation. I also 
thank this panel of witnesses who will educate us about these issues 
from all perspectives and help to create solutions so that we may 
better protect our personal and confidential information and reduce 
this insidious crime. Additionally I thank Senator Bill Nelson for 
introducing S. 500, The Information Protection and Security Act, which 
I support because it addresses the need for responsible and reasonable 
oversight over the data broker services industry while providing fair 
information principles. I will be happy to assist this Committee with 
other legislative proposals such as S. 768 and others. Since this issue 
affects each one of us, I encourage a bi-partisan collaborative 
approach to protect ourselves from identity theft.
    My name is Mari Frank. I am an attorney, privacy consultant, and 
author of several books on identity theft from Laguna Niguel, 
California. (My two newest books are Safeguard Your Identity: Protect 
Yourself with a Personal Privacy Audit (Porpoise Press, 2005 and From 
Victim To Victor: A Step By Step Guide For Ending the Nightmare of 
Identity Theft 2nd Edition with CD, Porpoise Press, 2005) 
www.identitytheft.org.) I serve as a volunteer Sheriff Reserve for the 
Orange County, California Sheriff Department, and sit on the Advisory 
Board of the State of California Office of Privacy Protection which 
focuses on privacy and identity theft safeguards for California 
citizens. Additionally, I am a member of the State of California's 
Department of Motor Vehicle's Task Force on Privacy and Identity Theft, 
I've served on the Los Angeles District Attorney's Office Task Force on 
Identity Theft, and I am an advisory board member to the nonprofit 
Identity Theft Resource Center. I have personally assisted myriad 
victims across the country with my personal time and educational 
materials, and have donated hundreds of pro-bono hours to assist 
victims. I have had the privilege of testifying before several 
legislative bodies and four U.S. Congressional Committees, and have 
consulted with national corporations on how to protect their clients, 
customers, vendors, employees, and their businesses from the challenges 
of identity theft and other privacy concerns. I am a certified trainer 
for Continuing Legal Education of the State Bar of California, a former 
law professor, and I presently teach Conflict Management at the 
University of California, Irvine.
    My own identity was stolen (in 1996) by an impostor who paraded as 
me--stealing my personal as well as my professional lawyer identity. 
While wrecking my credit, she also destroyed my sense of security and 
peace of mind. My impersonator obtained over $50,000 using my name, 
purchased a red convertible Mustang, and even caused me to be 
threatened with a lawsuit by a rental car company for the auto that she 
damaged in an accident. It took me almost a year and over 500 hours to 
clear my records and regain my credit and my life. I accumulated five 
banker boxes of correspondence, and lived in fear of how else this 
invisible person might harm me and my children. I finally learned that 
while working as a temporary secretary in a law office four hours from 
my own office, my evil twin (who I never met) was able to access my 
credit history (as well as the profile of other lawyers) from an 
information broker who had a contract with that office. My impostor did 
not need to prove who she was or establish that she had a permissible 
purpose to download the profile, so it was instantly faxed to her. From 
that report, she obtained my Social Security number and other personal 
and financial facts to become my identity-clone. When that data broker, 
situated across the country, electronically transferred my consumer 
profile to a criminal in a city 4 hours from my home, it was beyond my 
control to do anything to prevent the fraud.
    From that arduous nightmare, I gained great insight into the 
tribulations that victims endure--I became an expert by necessity. 
After speaking with several thousand victims, I have learned that most 
victims are not negligent with their personal information, and that no 
amount of ``consumer education'' or vigilance will protect them from 
identity theft if their information is acquired in a security breach by 
an unscrupulous employee, or by faulty information handling practices 
of entities that maintain their data. Consumer-privacy education is 
important to minimize your risk and keep you informed as to barriers to 
erect, but it won't guarantee that your identity won't be stolen by a 
data breach.
    Your esteemed Committee has invited me to focus on the concerns and 
problems experienced by victims of identity theft and security 
breaches. I will concentrate my testimony on answering the following 
questions:

        I. What Are the Motivating Factors for Stealing Your Sensitive 
        Information?

        II. How Does Identity Theft Occur, and What Are the Unique 
        Issues as to Data Brokers?

        III. What Are Real Life Examples of Identity Theft as They 
        Relate to Information Brokers?

        IV. What Is the Impact of Security Breaches on Citizens Whose 
        Information Is Stolen?

        V. What Needs to Be Done with Regard to Minimizing the Risks of 
        Identity Theft With Regard to Information Brokers?

        VI. What Else Is Needed To Prevent and Resolve Identity Theft?

I. What Are the Motivating Factors for Stealing Your Sensitive 
        Information?
    In our data-driven society your personal information is readily 
transferred across the world in a nano-second through networks and on 
the Internet (whether or not you are a computer user). Your personal 
information, worth more than currency itself, can be used to apply for 
credit cards, credit lines, mortgages, cell phones, insurance, 
utilities, products and services, etc., all without your knowledge. A 
fraudster can do anything you can do with your identifying 
information--and worse--even do things you wouldn't do such as commit 
crimes, seek revenge, or engage in terrorist activities.
A. What Is Identity Theft and How Is It Used?
    Identity theft occurs when your personal (or business) identifying 
information such as your name, Social Security number, address, birth 
date, unique passwords, business name or logo, or even biometric 
information, is used or transferred with the intent to use it for an 
unlawful purpose. Below are the main motivations of fraudsters:
1. Financial Gain
    This includes credit, loans, new accounts, mortgages, employment, 
health care, insurance, welfare, citizenship, and other governmental 
and corporate benefits--anything that has a dollar value. The fraud may 
take place in multiple jurisdictions, and purchases and transfers can 
be made by phone, fax, online or in person. Usually, the perpetrator 
can buy or ``legally'' obtain a driver's license, create checks on a 
computer with the victim's name, obtain, buy, or create other identity 
documents including medical cards, credit cards, passports, etc.
2. Avoiding Arrest or Prosecution
    A criminal commits crimes in the real world or virtual electronic 
world, or terrorist acts using the name and identifying information of 
another person. Often the perpetrator also commits financial fraud as 
well to supplement her income. In a recent meeting I attended with 
Senator Feinstein and law enforcement, detectives and district 
attorneys in California (and also in Washington) reported that that 80-
90 percent of identity thieves who are caught also have a pending or 
prior methamphetamine charge against them as well. In my own case, my 
impersonator was a ``meth'' addict who stole the identity of several 
lawyers to obtain credit and funds to feed her drug habit.
3. Revenge
    One can remain ``invisible'' by stealing an identity to hurt 
another person. This type of fraud may occur between ex-spouses, former 
business partners, ex-employees, disgruntled staff or angry customers. 
We also see this type of fraud committed in businesses where one 
business owner will want to ruin the reputation of another. It can 
occur offline or online. I've been contacted by employees, and business 
owners who learned that their e-mail address was used to discredit 
them.
4. Terrorism (Breaching Homeland Security)
    The September 11, 2001 terrorists had opened 14 accounts at a 
Florida bank, using false Social Security numbers and other documents. 
They obtained credit cards, apartment units, leased cars, and 
fraudulently charged airline tickets. They not only did this for 
financial gain, but also over half of them likely suspected that their 
true names were in FBI files as suspected terrorists, so they committed 
total identity take-over to avoid arrest. And worse, they used false 
identities to get revenge against our country. In Senator Feinstein's 
meeting with law enforcement in California on March 29, 2005, law 
enforcement reported that suspected terrorist cells have been 
apprehended with false documents in California. It is well known that 
foreign nationals have covertly crossed our borders and have easily 
obtained stolen identity documents to hide under the ``radar screen.''
II. How Does Identity Theft Occur, and What Are the Unique Issues as to 
        Data Brokers?
A. Ways That Your Personal Information Is Stolen
    The scope and extent of the problem of identity theft is rampant. 
In 2003 the FTC conducted a survey found almost 10 million new victims 
that year, and 27.3 million victims in the previous five years, with a 
cost to consumers of $5 billion and a loss to financial institutions of 
$48 billion. (www.consumer.gov/idtheft) According to the Identity Theft 
Resource Center, victims paid an average of $1,400 in out-of-pocket 
costs (not including attorney fees) and spent an average of 600 hours 
to regain their credit and identity. (www.idtheftcenter.org) The 
monetary costs are miniscule compared to the devastation, stress and 
violation one feels when they are denied a job, unable to get an car or 
apartment, lose the opportunity for a home, lose insurance health 
benefits, or find out there is a warrant for their arrest--or worse 
yet, when they are convicted of a crime committed by their impostor. 
Victims have a great burden to ``prove'' their innocence, beg for an 
identity theft report, and spend hundreds of hours calling and writing 
various agencies and companies to get their life back.
    The epidemic of identity theft is growing because sensitive, 
personal information is acquired very easily, and the issuers of credit 
are often less than careful in verifying and authenticating the true 
identity of the applicant. There are many ways that fraudsters obtain 
data about us--it may be appropriated by, stolen mail, dumpster-diving, 
lost or stolen wallets, shoulder surfing, burglary, friends, relatives 
(only about 9 percent), unscrupulous employees, phone fraud, Internet 
fraud (phishing and pharming), spyware, hackers, unprotected wireless 
networks, unethical use of public documents that contain personal 
information, needless display of the Social Security numbers on 
government documents (such as; military and Medicare identification 
cards); the transfer sale and sharing of Social Security numbers and 
other data among financial institutions, credit reporting agencies and 
data brokers.
B. Data Brokers Files Provide Massive, Broad-Based Information When 
        Accessed by Fraudsters
    Although an identity thief has a choice of simple easy ways to 
steal your good name, as listed above, your identity is especially 
vulnerable with regard to the mega-databases held by information 
brokers who are collecting, storing, sharing, buying, transferring and 
selling huge amounts of personal and sensitive information in all 
inclusive profiles without any governmental oversight. (For example, it 
is reported that ChoicePoint has 19 billion files on citizens.) 
Although the credit bureaus also hold vast financial and personal 
data--and if accessed also reek havoc for victims, (like what happened 
to me) at least these credit reporting agencies are regulated by the 
Fair Credit Reporting Act, and there was a way for me to correct my 
file.
    The very essence of the data broker business is selling a broad 
range of very private and highly sensitive information which if 
acquired by a person with criminal intent, provides a complete 
comprehensive package ready made for total identity-takeover. These 
databases contain your personal, professional, social, (possibly 
criminal) and financial existence. Tapping into your data profile is a 
fraudster's dream come true. The huge, lengthy dossiers provide far 
more than just a Social Security number or the limited information that 
could be accessed from stealing a bank account, your mail, or even your 
un-shredded trash. Many of these companies have various products for 
sale which will tell the recipient of the report far more about you 
than your family or friends know. Most of us have seen our credit 
reports and know how all embracing they are with regard to our 
financial profile, but few of us have seen our complete dossier stored 
and sold by the data aggregators. To give you an example of one type of 
product, I have attached as Exhibit I, a sample AutoTrack report sold 
by ChoicePoint for you to see how much information may be revealed 
about you, which also includes the persons in your home, and 
surrounding neighborhood. It should startle you.
C. Viewing Your Vast Profile
    When I attended the State Bar Annual Meeting last fall, I visited 
the exhibit hall and was summoned by one of the data brokers to view my 
profile to see if I wished to purchase this data information service in 
my law office. All I provided was my name, and instantly 30 pages of 
private information (including my Social Security number) appeared on 
the computer screen. I was shocked and horrified, not only because I 
felt very violated by all it revealed, but worse yet, by the numerous 
errors! I asked the salesperson how I could correct the information and 
was told that I could not correct any information in the file; that 
this information was not subject to the Fair Credit Reporting Act. 
Please review this attached sample profile and consider how each 
category heading is labeled, i.e.: ``Possible Social Security Numbers 
Associated With This Subject; Possible Deeds Transferred; Possible 
Felony/Probation/Parole.'' As a recovered identity theft victim, I was 
stunned by the prospect that some of those items in my report could 
have been reported as a result of my impostor's actions, and I was 
fearful of what could happen to me and my family if this information 
were to be acquired by someone who wished to do harm. I was reminded of 
the Amy Boyer case a few years ago in which a young man, Liam Youens 
used an on-line information broker--Docusearch to obtain Amy's Social 
Security number, phone number, and work address in order to find her. 
He then appeared at her office and killed her and then committed 
suicide. Later in his computer, police found a message he had written 
about data broker services--``It's actually obscene what you can find 
out about people on the Internet.''
D. Data Brokers Are Operating Under the Radar Screen and Are Invisible 
        to Most Citizens
    Even with all the publicity about data brokers and recent security 
breaches, when I have spoken to large audiences in the last month about 
identity theft, most people still didn't know these companies by name 
or what they do, or how they gather data or what's in their databases. 
There is no transparency. In fact, most people tell me that if they had 
received a security breach letter from ChoicePoint or LexisNexis, they 
probably would have thrown it out as ``junk mail'' since they hadn't 
heard of the company and do not have a business relationship. Many 
potential victims who received security breach letters have not taken 
advantage of LexisNexis' offer for a year of credit monitoring (for 
example) because they didn't even open the envelope, or if they did, 
they didn't know what to worry about since they didn't know what was 
revealed from their files to cause alarm. None of the breach letters 
that I have seen contained a copy of the profile, or a detailed list of 
the data that was stolen.
E. Everyone in This Room and Reading This Testimony Has a Profile in 
        the Data Broker Files
Do You Know What Information About You Is Being Sold?
    Everyone in this room who has a birth certificate, a driver's 
license, if you've been married, divorced, have auto or homeowner's 
insurance, if you have ever worked, if you have a residence, if you 
have any government approved license, if you've been issued a speeding 
ticket--YOU ARE IN THOSE SECRET FILES. Every Senator in this room--and 
every one watching this hearing has a profile in those files. Have you 
seen your dossier? Do you know what fact or fiction is being sold about 
you? As the law stands now--you don't have the right to know what is in 
those files, nor do you have the right to correct the many errors, nor 
do you have the right to know who has had access to those sensitive 
files, nor can you limit their sale--actually none of us here (except 
perhaps the data broker persons) have control over anything in those 
files. These companies have operated in the shadows and have sold this 
often erroneous information to myriad companies, journalists and 
governmental agencies. Yet most Americans don't even know who these 
companies are or what they do. This is America--the home of freedom and 
liberty, this is not a communist country or Nazi regime where secret 
files are kept on citizens--and shared with various entities and 
governmental agencies. The FBI and other law enforcement agencies are 
purchasing this information from data brokers, so are employers, 
insurers, landlords, attorneys, private investigators, and others--
shouldn't law abiding citizens have a right to at least see the 
dossiers and make sure that the information is correct?
    Although the credit reporting agencies are also considered data 
brokers, they are regulated by the Fair Credit Reporting Act and that 
law gives us the right to see our data, review it, dispute it, correct 
it, find out who has accessed it, limit its sale and review, and give 
us the right to enforce our rights. Unfortunately, the information 
service industry only acknowledges that a small portion of its products 
apply to the FCRA (i.e., reports made for insurance, employment 
history, landlord tenant history, medical insurance). Why shouldn't the 
data brokers be subject to the same fair information principles?
III. What Are Some Real Life Examples of Identity Theft as They Relate 
        to Information Brokers?
A. Examples of Financial Identity Theft
    1. John is a recent widower. After his wife died of cancer at age 
35, (leaving him with three young children), he began receiving 
collection calls from credit card companies, a computer manufacturer, 
and a cell phone company for the items and services allegedly purchased 
by his deceased wife after her funeral. He suspects that the imposter 
got the information from the death certificate which has the Social 
Security number and birth date on the document. This could have been 
obtained in the funeral home, from public records offline or online, 
through the Social Security Administration, or from any information 
broker.
    Many public records including birth certificates, death 
certificates, marriages, pilot and captain licenses, etc. contain the 
Social Security number--which is the key to the kingdom of identity 
theft. The data brokers sell public records to almost anyone. John 
became a victim prior to July 2003 when the California Security Breach 
disclosure law became effective. If he were a victim of a security 
breach after July 2003, he hopefully would have been notified, and 
would have had a chance to put up barriers to protect his deceased 
wife's good name and his finances.

    2. Sidney, a wealthy retired executive learned that his identity 
was stolen many months after he and his wife purchased a new home. His 
loan application, with his 3-in-1 credit report attached, revealed his 
credit score, his checking, savings, and investment accounts, Social 
Security number, and all necessary information for an impostor to 
become Sidney. He believes his masquerader had gotten a copy of 
Sidney's credit report which was on the broker's laptop. The impostor 
opened new credit card accounts, purchased computers, electronic 
equipment, furniture, rented an apartment, obtained utilities, etc., 
stealing almost $100,000, and the couple are overwhelmed.
    Allowing employees to download credit reports, and maintain loan 
applications in unencrypted files on laptops, which may be easily 
stolen outside a secured office, makes customers very vulnerable to 
identity theft. It is imperative that all companies that collect data 
and transfer it for use, verify the recipient (that he or she has a 
lawful, permissible purpose), set up contracts and enforcement for the 
security of the information. It's critical for victims to get notice 
immediately of any security breach, so that they may take steps to 
intervene and stop further fraud activities.

    3. Susan, a physician, received a letter from a company that she 
did business with, that her Social Security number and other 
information about her had been acquired by unauthorized persons. She 
was terrified as to what could happen to her finances, and her 
practice. She put fraud alerts on her credit profile, changed all her 
passwords, even closed accounts and opened new ones. She felt very 
violated, angry, frightened and upset. Almost 1\1/2\ years later, she 
started receiving calls from creditors from accounts she never owned--
including cell phones, credit cards, and loans. She believed the fraud 
alert would remain on her credit profile--it did not. Even when the 
fraud alert was on her file, companies seemed to ignore the alert and 
issue credit. Since she lives in California, she was able to place a 
security freeze on her profile so no one could see her credit report to 
issue credit without her providing a password to release her file. Now 
she has sleepless nights about her impostor parading as a doctor and 
committing other crimes. She wants to see a full background check from 
the information brokers.
    This case shows us why it is so important to receive notice of a 
security breach. Susan took proactive steps to prevent fraud, and 
several companies called her and did not issue credit. Some negligent 
companies ignored the alert. Because she lives in one of the four 
states (presently California, Texas, Vermont, and Louisiana) that allow 
victims to ``freeze'' their reports, she was finally able to stop the 
financial fraud. But the fear of criminal identity theft is now 
haunting her. She should be able to put a fraud alert on her consumer 
profile and obtain a complete background check at no cost if she is a 
victim--just as victims can obtain two free credit reports in the 12 
months in which they learned of the fraud. She should also be able to 
limit the sale of her consumer report and be notified with the name, 
telephone number and address of a business or governmental entity 
(other than Homeland Security) to see who is accessing her profile.
B. Examples of Criminal Identity Theft
    1. George, a disabled veteran living in Colorado was suddenly 
denied his disability payments, and hit with a large IRS bill for the 
income that his impostor had earned while working under his name in 
Tennessee. Upon reporting this fraud to the police, we learned that 
George's impostor had also established a criminal record in yet another 
state and there was a warrant for George's arrest.
    George's information about his impostor's criminal activity and 
work related fraud would not show up on a credit report (until the IRS 
reports it), but it would show up on a background check provided by the 
data brokers who are testifying today. George found out the hard way, 
when he lost benefits and was arrested. If he had access to his 
consumer file, he would have found out about the fraud and wouldn't 
have lost his disability benefits.
    George's case demonstrates why we must be able to review, dispute 
and correct our consumer files. We should be able to get our complete 
dossiers at least once a year at no cost as is our right to get a 
credit report from each of the three credit reporting agencies under 
the Fair and Accurate Credit Transactions Act.

    2. Lori, a disabled vet from Virginia, and single mom with a set of 
six-year-old twins was attending school to get her Master's degree in 
Social Work, when the police showed up at her door. She was arrested 
for a crime that she didn't commit. The woman who committed the fraud 
used the name Laura along with Lori's last name. Her fingerprints did 
not match the prints of the perpetrator, and the description of the 
fraudster was different from Lori, yet she was convicted. With my help 
and the help of new counsel, she was sentenced to probation--but the 
felony record must be corrected with a new trial. Her greatest fear 
isn't the new trial--it is the information broker databases that may 
continue to report her as a felon even after the criminal records are 
cleared. She has reason to fear as you will read in the next case.

    3. Scott was laid off from a high-paying job in the medical 
industry in Ohio. He had great recommendations and felt sure he would 
be rehired. For two years he was denied employment after several 
positive interviews and his permission to do a background check. 
Finally Scott hired a private investigator who showed him his criminal 
profile from a data broker. It included two DUIs and an arrest for 
murder. None of which belonged to him. I spent many months helping him 
to correct the sheriff and FBI databases. But months after we cleared 
all the law enforcement databases, he applied for employment and was 
offered the job, but after reviewing his background, he was told that 
they couldn't hire him. He was in shock when the private investigator 
pulled his report again and found that a major information broker was 
still selling this false information to prospective employers without 
updating their files. Finally after a lawsuit was filed by an Ohio 
attorney, the information was corrected. But the years of anguish and 
lack of employment continues to damage his career and his personal 
life. 
    Scott had no idea why he had trouble getting a job. Although a 
potential employer is supposed to tell you if you are denied employment 
due to a consumer report, and let you know how to review the report, 
it's understandable that an employer may be reticent to tell a 
``murderer'' that he is denied employment due to his criminal history. 
Instead he was told that there were others who were more suitable for 
the position. If Scott had the right to see his file earlier and had 
the right to correct it, he would have been able to secure employment 
and perhaps not have gotten divorced, lost custody of his son, nor 
become homeless for those years.
C. Examples of Identity Theft for Revenge
    1. Linda was married to a prominent Chicago lawyer for 25 years. 
When he decided to divorce her to marry his secretary, he had a friend 
download Linda's consumer information and give it to a fraudster who 
applied for numerous credit cards, ordered furniture, and other luxury 
items. The fraudster also used Linda's name to set up e-mail accounts 
to send the estranged husband threatening messages. This was done to 
discredit Linda in court.
    Obviously, there was no lawful purpose for downloading this report 
from the data broker. There was no verification of permissive use by 
the data broker. It clearly was revenge and self-interest.

    2. The first cyber stalking case prosecuted in Orange County, 
California turned out to be identity theft. A computer expert was angry 
when a woman he liked shunned his advances. He proceeded to go online 
to a chat room and pretend to be her--stating that she had fantasies of 
being raped. From a data broker, he was able to find her home phone 
number and address and shared it in the chatroom. The woman didn't even 
own a computer. When several men appeared at her door to share her 
fantasies, she was terrified and called the police. She had an 
emotional breakdown and the violation has left scars.

    3. A radio talk show host was shocked to learn that his own 
identity was stolen by a disgruntled listener who bought his dossier 
from an on-line information broker. Aside from calling him at home and 
bullying him, he obtained access to his e-mail account and sent 
embarrassing e-mails to the station, pretending to be the talk show 
host.
    The above cases demonstrate how identity theft is facilitated by 
the data broker industry. Unless a victim gets notice of a security 
breach or unless law enforcement or a private investigator can solve 
the mystery, most victims don't have a clue how the criminal has gotten 
his sensitive records. The assaults against these victims caused great 
anguish, overwhelmed them and negatively impacted every aspect of their 
lives. The time spent trying to regain their lives, the damage to their 
reputation, and the out-of-pocket costs were miniscule compared with 
the tremendous emotional turmoil these people endured.
IV. What Is the Impact of Security Breaches on Citizens Whose 
        Information Is Stolen?
    Persons whose information has been stolen by criminals are victims 
of a crime. They may not yet be victims of identity theft--yet they are 
victims of a Federal crime. Not only has their private, sensitive 
information gotten into the hands of unauthorized persons--but those 
unauthorized persons have done so with the intent to commit an unlawful 
act. Under 18 U.S.C. 1028, as stated below the persons committing the 
act are felons and those who are adversely affected are victims of a 
Federal felony:
    The Identity Theft and Assumption Deterrence Act of 1998 (Identity 
Theft Act) 18 U.S.C. Sec. 1028) makes it a Federal crime when anyone:

        knowingly transfers or uses, without lawful authority, a means 
        of identification of another person with the intent to commit, 
        or to aid or abet, any unlawful activity that constitutes a 
        violation of Federal law, or that constitutes a felony under 
        any applicable State or local law.

    I have personally spoken with victims of security breaches who have 
received notice letters from entities such LexisNexis, ChoicePoint, 
Ameritrade, Bank of America, Wells Fargo and several universities, 
hospitals, and even smaller businesses. The victims of the breach feel 
very violated, angry, frightened and overwhelmed and helpless. It is 
well known that criminals steal the information and may often wait 
months or years to use it--or they sell it in exchange for 
methamphetamine or money. It may be transferred several times and used 
for financial gain or to commit other crimes. Because the victims of 
the breach don't know who the criminals are or their intent, they are 
anxious. Additionally, the victims are not notified as to exactly what 
information may have been taken, so they feel defenseless and don't 
even know what to protect. Although I tell these victims actions to 
take to put up barriers placing fraud alerts, instituting security 
freezes, changing passwords, changing mother's maiden name, monitoring 
credit reports, etc.), victims still feel incapable of insuring that 
their identity won't be stolen. Many are fearful that their family home 
or office may be intruded by the perpetrators who may have their 
addresses, phone numbers, bank account information and perhaps an 
entire dossier.
    Below are a couple of e-mails I received from victims of a security 
breach explaining their strong feelings of victimization.

         ``My husband and I are very upset and it is overwhelming. We 
        are very anxious and it takes a tremendous amount of time and 
        effort just to get a security freeze. The credit agencies 
        shouldn't make it so difficult. I'm spending so much time 
        monitoring accounts and credit reports--it's exhausting--I feel 
        very vulnerable and frightened that some criminal knows all 
        about me and may wait to use our stuff any time, now or in the 
        future-- what can I do?''

        ``I spend sleepless nights wondering when the phone may ring, 
        or I will open a letter from a bill collector. I'm worrying if 
        someone has obtained new identification under my wife's or my 
        name. It is scary to think that I may be pulled over by the 
        police for something I didn't do. What if they drag me or Lord 
        forbid MY WIFE, from the vehicle and handcuff us. My wife and I 
        are losing too much sleep''

    The emotional impact on these victims is intense and their fears 
are real. Why would a criminal steal the information if there was no 
intent to sell, transfer or use it for an unlawful purpose?
V. What Needs To Be Done With Regard to Minimizing the Risks of 
        Identity Theft as to Information Brokers?
    Data brokers must be regulated by imposing Fair Information 
Practices as follows:
    1. Transparency--The nature of personal data held by these 
companies should be readily available for inspection by the public. The 
uses of the information should be clearly defined.
    2. Consent and Notice--Consumers should be able to give their 
consent to the disclosure of their information prior to disclosure, 
such as the rights with regard to disclosure of credit reports. The 
exceptions would be for defined categories of law enforcement and 
Homeland Security. In other words there should be an established, 
permissible purpose; i.e.--employment background checks, insurance, 
landlord tenant, etc. When a consumer gives his consent or it is 
considered a ``permissible purpose,'' the consumer should be entitled 
to notice of the sale, and the consumer should receive a free copy from 
the entity that bought the report.
    3. Consumer Access and Inspection--Individuals should have the 
right to one free disclosure per year as they have for credit reports. 
A central website and toll free numbers should be set up for consumers 
to get their entire profile--not just a ``Clue Report.'' If a person 
has become a victim of identity theft, he should be entitled to at 
least one other free disclosure per year for 24 months after learning 
of the stolen identity. The inspection report should be the same as 
would be accessed by a company for a background check--the complete 
profile. The disclosure should also provide a list of names, addresses 
and phone numbers of all entities that received a copy of such report 
in the last 5 years. This would include governmental entities except 
for specific guidelines of Homeland security or other law enforcement 
restrictions. Employers or others who order background checks on a 
consumer should be required to provide a copy to the consumer upon 
receipt whether or not the consumer report was a factor in hiring or 
reviewing an employee or prospective employee.
    4. Quality Controls and Timely Correction--The information 
collected should be accurate, complete, updated and relevant to the 
purpose for which it is to be used. The Data Broker industry should 
allow individuals to dispute and provide prompt correction of the files 
within no more than 30 days. The broker should reinvestigate without 
cost to the consumer and make all appropriate changes if the 
information cannot be verified. If after the data broker investigates, 
it finds that the investigation verified the information, the company 
shall provide the name, address and phone number of the verifying 
entity so that the consumer can directly dispute the information.
    5. Strict Security Controls--There should be safeguards against 
risk of loss, unauthorized access, alteration, hacking, etc. Audit 
trails and limited access should be standard, as well as encryption of 
the sensitive data. Customers should be screened both initially and 
with respect to how the end-user is safeguarding the information from 
unlawful use. In the event of a security breach, the data broker must 
notify all individuals whose information was acquired either on paper 
or electronically with a letter providing the consumer the nature of 
the breach, what information was stolen, how to protect themselves with 
fraud alerts, security freezes and other useful tools. They should also 
provide a free copy of the report that was accessed. Credit monitoring 
and a background check monitoring would be needed. (Fraud resolution 
services may be necessary.)
    6. Enforcement--The data broker industry must be held accountable 
to consumers and victims. Outside audits and training should be 
mandatory. A private right-of-action is essential to allow enforcement 
of the provisions of the law. A private right-of-action provides that 
the cost of the legal system policing against acts of preventable 
corporate negligence is paid by the guilty parties rather than by 
increasing taxes or adding to the size of government. We have seen that 
many provisions of FACTA and the GLB Act have not been enforced because 
Federal agencies do not have the resources or manpower to take actions 
against all the violations, and why should our taxes be spent to right 
the wrongs of companies who violate the law. Individuals should be able 
to seek redress for their damages without having to rely on the 
government to intervene, however for large cases, enforcement should be 
available in state courts by private parties, attorneys general and the 
FTC.
    7. Preserving States Rights--Consumer reforms with regard to 
identity theft have derived from proactive States that were responsive 
to the plight of its citizens. Some examples of this are: the right to 
a free credit report, annually, the right to place a fraud alert, the 
right of victims to obtain information from businesses and creditors to 
regain their identity. More recently we have found out about the 
security breaches of two of the data brokers here today only because of 
the California Security Breach law. Both ChoicePoint and LexisNexis 
admitted in a Senate hearing that they both experienced significant 
breaches prior to July 2003, when the California law became effective, 
and did not notify any of the victims of the breach. Since February 
2005, over 4 million Americans have been victims of various security 
breaches. (See Exhibit II from the Wall Street Journal)--none of which 
we would have heard about, but for the California law. Arizona and 
California, were the first two states to make identity theft a crime--
leading all the states and the Federal Government to establish the 
consumer as a true victim. Numerous states are instituting security 
freezes to lock up a consumer's credit so fraud cannot continue. 
Federal law should serve as a floor, not a ceiling, so that states can, 
if need be, quickly address the crises of their victims.
VI. What Else Is Needed To Prevent and Resolve Identity Theft?
    1. Security Breach Notification must extend to all states--All 
governmental agencies, and private industry, schools, and other 
entities should be held accountable to quickly notify all persons whose 
sensitive and personal information (paper and electronic files) were 
acquired by an unauthorized person. There should be an exception for 
encryption only if it is robust and if the unauthorized acquisition was 
not capable of being decrypted by an unscrupulous employee or customer. 
The standard of providing notice should be triggered by the acquisition 
of the data rather than the use of it. A bank or other entity who 
experiences a breach should not be allowed to determine the possibility 
of the misuse. The only delay of notice would be for law enforcement 
upon its written request. Allowing the business or entity to make the 
call as to when there might be a risk of harm is like allowing the wolf 
to tend the henhouse. There should be enforcement by the FTC, State 
attorneys general and private individuals. Any preemption should be a 
floor and not a ceiling so that states can protect their own citizens 
regarding unique needs. As a member of the advisory board of the 
California Office Of Privacy Protection, we created a list of 
``Recommended Practices on Notification of Security Breaches Involving 
Personal Information'' as a guide for dealing with security breaches, 
please visit www.privacy.ca.gov to review those standards.
    2. Governmental agencies as well as private industry should limit 
the use of the Social Security number since it is presently the key to 
kingdom of financial fraud--Our advisory board to the Office of Privacy 
Protection in the California Office of Consumer Affairs also had the 
privilege of developing the ``Recommended Practices for Protecting the 
Confidentiality of Social Security Numbers'' (www.privacy.ca.gov). This 
document should be considered by both pubic and private sector entities 
as a guide to protect all consumers.
    The Social Security number is used as the identifier for military 
cards and ``dog-tags,'' Medicare, Medicaid, pilot's licenses, captain's 
licenses, etc. No entity should be allowed to display, post, or sell 
the SSN. The SSN in public records should be redacted before posting. 
There should be no collection of SSNs by private or governmental 
agencies except where necessary for a transaction and there is no other 
reasonable alternative. SSNs collected for a specified purpose should 
not be used for any other purpose.
    3. Mandatory Destruction of Confidential Information--Governmental 
agencies and private industry should be required to completely destroy 
personal information that they are discarding by shredding, burning or 
whatever means is necessary to protect the information from dumpster-
diving. This should extend to any confidential and sensitive 
information--not just information derived from consumer reports.
    4. Departments of Motor Vehicle Licensing--Bureaus should establish 
more stringent monitoring and matching of duplicate licensing and new 
licenses. A photo ID and a fingerprint could be matched. Rather than 
developing a ``national ID'' with various forms of biometric 
information, credit cards and other unnecessary information which would 
complicate the process and invade privacy, this license would help 
deter interstate identity theft without collecting too much information 
nor allow it to be accessed or sold to private industry.
    5. Need for an Easier Process for Victims--Problems with the Fair 
and Accurate Credit Transactions Act (which was meant to make things 
easier for victims)--

        a. An Identity Theft Report is needed in order for victims to 
        get an extended fraud alert, block the fraud on their profile, 
        and gain access to records of the fraud--FACTA was meant to 
        streamline and help victims of identity theft. However, the new 
        rules recently released by the FTC with regard to the 
        ``Identity Theft Report'' clearly show the time-consuming maze 
        that a victim must maneuver. Below is an example of the hassle 
        of exerting your victim rights with regard to the FTC rule 
        about the ``Identity Theft Report.''

        ``An Identity Theft Report may have two parts:

        Part One is a copy of a report filed with a local, State, or 
        Federal law enforcement agency, like your local police 
        department, your State attorney general, the FBI, the U.S. 
        Secret Service, the FTC, and the U.S. Postal Inspection 
        Service. There is no Federal law requiring a Federal agency to 
        take a report about identity theft; however, some State laws 
        require local police departments to take reports. When you file 
        a report, provide as much information as you can about the 
        crime, including anything you know about the dates of the 
        identity theft, the fraudulent accounts opened and the alleged 
        identity thief.

        Note: Knowingly submitting false information could subject you 
        to criminal prosecution for perjury.

        Part Two of an identity theft report (depends on the policies 
        of the consumer reporting company and the information provider) 
        (the business that sent the information to the consumer 
        reporting company). That is, they may ask you to provide 
        information or documentation in addition to that included in 
        the law enforcement report which is reasonably intended to 
        verify your identity theft. They must make their request within 
        15 days of receiving your law enforcement report, or, if you 
        already obtained an extended fraud alert on your credit report, 
        the date you submit your request to the credit reporting 
        company for information blocking. The consumer reporting 
        company and information provider then have 15 more days to work 
        with you to make sure your identity theft report contains 
        everything they need. They are entitled to take five days to 
        review any information you give them. For example, if you give 
        them information 11 days after they request it, they do not 
        have to make a final decision until 16 days after they asked 
        you for that information. If you give them any information 
        after the 15-day deadline, they can reject your identity theft 
        report as incomplete; you will have to resubmit your identity 
        theft report with the correct information:'' (FTC Rules)
        This rule is not only cumbersome it is confusing and allows the 
        credit reporting agencies to delay unnecessarily and it gives 
        victims a run around. I have already heard from many victims 
        who are frustrated, angry, and unable to block the fraud or 
        even extend the fraud alert.

        b. Law enforcement agencies at the local, State and Federal 
        level should develop a uniform ``identity theft report'' to be 
        compliant with FACTA--and the FTC should determine what 
        satisfies an ``identity theft report''--New provisions of the 
        Fair Credit Reporting Act require a detailed ``identity theft 
        report'' to send to the credit grantors, and the credit 
        reporting agencies. If a proper identity theft report is sent 
        to the credit reporting agencies they are required to do the 
        following: place an extended fraud alert for 7 years, block all 
        the fraud on the profile immediately; notify the creditor that 
        the accounts are blocked. Additionally, if the victim provides 
        a proper, identity theft report to the creditors, they must 
        provide all documentation of the fraud to the victim and to the 
        law enforcement agency within thirty days. Unfortunately, the 
        agencies themselves are deciding what is ``proper'' and many 
        victims contacted us because they are not able to appease the 
        credit reporting agencies nor the credit grantors with the 
        reports. So they cannot exert these rights afforded under the 
        law and there is no private right-of-action to enforce these 
        rights.
        The FTC should determine what will be acceptable as an identity 
        theft report and facilitate the victim's report. It should be 
        adhered to by law enforcement as well as the financial industry 
        without imposing an arduous task upon the victim. Also, the 
        victim should be able to get a police report in the 
        jurisdiction where she lives even if the impostor is in another 
        state. And, the case should be able to be prosecuted in the 
        jurisdiction where the victim lives or the jurisdiction where 
        the crime takes place. All police should be required to provide 
        a proper identity theft report even if they do not have the 
        resources to investigate the crime.

        c. Initial Fraud alert should be one year--FACTA allows a 
        victim of a breach or fraud to place a fraud alert on credit 
        profiles for at least 90 days with their first phone call. To 
        extend the alert they must write a letter and provide an 
        ``identity theft report. The initial fraud alert should be 
        changed to at least 1 year especially because victims of a 
        security breach may not be victimized for a long time.

        d. Free credit report for victim should be available by phone 
        when calling in the fraud alert--Prior to the passage of FACTA, 
        victims could order their free credit report to review their 
        files at the same time they place a fraud alert. Now, the 
        credit reporting agencies (except for TransUnion 
        ``temporarily'') do not give the victim an opportunity to get 
        the free credit reports in the initial phone notification of 
        the fraud. They are later sent a letter notifying them of their 
        right to a free report upon request. This is another delay 
        which allows the impostor more time to do his ``dirty work,'' 
        and this is an added burden for the victim and costlier for the 
        creditor. The victim should be allowed to order the first of 
        his two free reports during the initial fraud alert phone call.

        e. Victims should be provided a complete report upon disputing 
        the fraud and the victim should be able to see the report that 
        the creditors see--The CRAs are now sending corrections instead 
        of complete corrected reports to victims. This is dangerous 
        since other new fraud may appear on the report. Also--the 
        report that a creditor receives is more comprehensive than the 
        report that the victim sees, so this is not complete 
        disclosure.

    6. Funding for law enforcement for identity theft cases should be 
greatly increased since this is also a Homeland Security issue--All 
major metropolitan areas should be funded to set up identity theft task 
forces to include the Secret Service, the Postal Inspector, the Social 
Security Inspector, the FBI, INS, State attorney general and local law 
enforcement to collaborate in the investigation and prosecution of 
these crimes since suspected terrorists will need to utilize stolen 
identities to attempt their missions.
    7. Law enforcement agencies should help victims of criminal 
identity theft--A Federal law should set forth steps for law 
enforcement to take (in conjunction with the judicial system), to 
assist victims of criminal identity theft. So a victim of criminal 
identity theft in California, whose impostor is in New York, could be 
declared innocent in New York as well as California. This would entail 
a national database of the criminal information and fingerprints. It 
would contain the order of the true person's fingerprints for 
comparison with the fingerprints of the impostor-criminal in New York. 
The court would enter a declaration of factual innocence and any 
warrants for the victim would be dismissed. All databases would be 
corrected so that background checks would not show the victim as having 
an arrest or criminal record. (See California law and package for 
victims to clear their criminal record www.privacy.ca.gov).
    8. Set up State and Federal Offices for Privacy Protection--There 
should be a Federal office of privacy protection as well as State 
offices. The office of privacy protection should institute an ombudsmen 
office to assist citizens with identity theft and other serious privacy 
issues. It should also coordinate and review the various governmental 
offices of privacy to ensure oversight.
    9. Credit Reporting Agencies--
        a. Consumers should be able to put a complete freeze on their 
        credit reports in order to prevent identity theft--This would 
        enable the consumer to prevent their credit report from being 
        accessed by a creditor without the specific authorization of 
        release with a password. California, Texas, Vermont and 
        Louisiana have passed such laws. It would be impossible for an 
        impostor to apply for credit if there were a freeze on the 
        file. The consumer would have the right to release the file 
        when he so desires by a password or pin number. Every State 
        should pass this legislation or if it is Federal legislation, 
        then there needs to be a private right-of-action and no Federal 
        preemption.

        b. Credit reporting agencies should provide to victims a 
        COMPLETE REPORT when providing corrections--All reports should 
        include the names, addresses and phone numbers of the companies 
        who accessed the consumer's credit report, including inquiries 
        with the issuance of a consumer report so that potential 
        victims could verify the permissible purpose.

        c. Credit reporting agencies should notify a consumer by e-mail 
        when his/her credit report has been accessed--The agency should 
        be allowed to charge a minimal fee for this service--as to 
        actual cost (i.e., $10 per year),

        d. Credit reporting agencies should set up hotlines with live 
        persons to talk to victims of identity theft--A live employee 
        in the fraud department should be assigned to a particular 
        victim--so the victim doesn't have to re-explain all the 
        problems in numerous letters.

    10. Banks and other Creditors should be held accountable for 
protecting consumers and others from identity theft--

        a. Creditors who issue credit to an impostor after a fraud 
        alert is placed on a credit profile, should be held liable and 
        the victim should have a private right-of-action to enforce his 
        rights--Presently if a creditor ignores the fraud alert, only 
        the Federal Trade Commission or other Federal agencies may 
        bring and action and they clearly cannot enforce individual 
        rights nor do they have the resources to deal with most of the 
        violations. There should be a fixed penalty of at least $1000 
        per occurrence or actual damages, which ever is greater.

        b. Need for private enforcement of access to business records--
        If a fraud victim provides notification of fraud and includes 
        an ``identity theft report'' and an affidavit, under the FCRA, 
        a creditor is required, within 30 days, to provide copies of 
        all billing statements, applications and other documents of 
        fraud to the victim and the designated law enforcement agency. 
        Presently, victims are contacting us that many companies are 
        refusing to provide the information without a subpoena. Victims 
        presently have no private right to force a company to provide 
        this data. Only the FTC, or other Federal agencies, may bring 
        an action--but it cannot help an individual consumer. This must 
        be changed so that there will be enforcement of the provision 
        of the Act.

        c. Creditors should not be allowed to send ``convenience 
        checks'' without a prior request by the consumer--I was told by 
        a postal inspector that 35 percent of these checks are used 
        fraudulently

        d. Credit grantors should not be allowed to send pre-approved 
        offers of credit without a PRIOR the request of the consumer.

Identity Theft Conclusions
     Personal, confidential, and financial information is a valued 
commodity in our society. Data brokers have flourished abundantly while 
selling and transferring your extensive, aggregated personal profiles 
which include your income, credit worthiness, buying, spending, 
traveling habits, heath information, age, gender, race, etc. Facts 
about our personal and financial lives are shared legally, and 
illegally, without our knowledge or consent--on-line and off-line 
everyday. Privacy protection in the age of data collection is really 
more about limiting access and instituting inspection and correction to 
our records, rather than keeping the information secret. We have lost 
control over the dissemination of our sensitive data, and this has led 
to the enormous epidemic of identity theft. The huge data breaches in 
recent months have shined the light on the immensity of the problem of 
identity thieves and the havoc they cause. But it also has enlightened 
our lawmakers to collaborate to create a new framework for reasonable 
regulation of the data broker industry.
    To avert identity theft, the burden is on the data brokers, and the 
financial industry who are in the unique position on the front end, to 
take precautions, require verification, and authentication of 
employees, vendors, business associates and customers, and refuse to 
sidestep fair information principles. Data brokers, the credit 
reporting agencies and the financial industry is in a powerful position 
to prevent the fraud before the impostor can establish a parallel 
``shadow profile.''
    I am hopeful that as a result of the gigantic breaches of sensitive 
information, that this Congress will create a regulatory framework for 
the information brokers that will protect our citizens and enable the 
Data Broker industry to help society. I encourage you to strongly 
consider the thoughtful and well reasoned language of S. 500, which 
implements the Fair Information Principles, yet acknowledges the 
importance the work that the data industry provides, while safeguarding 
the identity of every American.
    Thank you for the opportunity to share these concerns and 
suggestions with this Honorable Committee.
                               Exhibit I
Sample Auto Track Data on Fictitious Person From ChoicePoint
    National Comprehensive Report Plus Associates
    Compiled on 01/05/2002 at 3:39PM
    Reference: 123456
    ZACHARY K THUL DOB: JAN 1955
    SSN 960-45-XXXX issued in New York between 1968 and 1970
    Possible AKA's for Subject
    THUL, ZACK K SSN: 960-45-XXXX
    Possible Other Social Security Numbers Associated with Subject
    THUL, ZACHARY K SSN: 690-45-XXXX
    THUL, ZACHARY K SSN: 690-45-XXXX
    **ALERT** A Death claim was filed for SSN 690-45-XXXX in FEB 1962.
    Possible Other Records/Names Associated with Social Security 
Numbers
    KIRBY, LOARDA SSN: 983-16-XXXX
    KIRBY, LORADA SSN: 960-45-XXXX
    Possible Driver Licenses
    THUL, ZACHARY K
    DL: T432117680470 issued in Ohio on 12/19/1996 expires 02/07/2001
    DOB: 01/17/1955 Height: 5,08"
    7891 W FLAGLER ST MIAMI, OH 38972
    Possible Addresses Associated with Subject
    SEP-1997/DEC-2000--7891 W FLAGLER ST
    MIAMI, OH 38972
    JUN-1995/AUG-1997--15 ROBY AVE (555) 123-4567
    HAMPTON BAYS, NY 11238
    JUN-1996/JUN-1996--1400 35TH ST K 4I
    SPRINGFIELD, FL 34090
    MAY-1995/MAY-1995--4833 STORM ST APT 33
    SPRINGFIELD, OH 34443
    JUL-1994/JUN-1996--4833 STORM ST I33
    SPRINGFIELD, OH 34443
    SEP-1994/JUL-1995--305 WAYBREEZE BLVD
    COLUMBUS, OH 34209
    DEC-1992/APR-1995--70 REARVIEW DR
    RIVERBEND, NY 11903
    438 BULLSIDE TER W
    HACKENSACK, NJ 09348
    The following is a sample National Comprehensive Report 
SM Plus Associates.
    The amount and type of records identified in a report will vary 
from subject to subject. All names and other information are fictional 
and are for illustrative purposes only. Any resemblance to real persons 
or public record information is unintentional. Some National 
Comprehensive Reports SM may locate a partial date of birth. 
Frequently, subjects of a National Comprehensive Report SM 
will be linked to other names because two public records reference two 
different names, but only one Social Security number. The most common 
reasons for these occurrences are:
    1. Typographical errors
    2. Jointly filed public records which list both the subject and the 
second name
    3. Father and son who have the same name
    4. Fraudulent use of a Social Security number The dates represent 
the approximate time period when the linked address appeared on a 
publicly available record document for the subject. The subject may or 
may not have resided at any of the addresses. Some public records link 
the subject to an address without noting a date range. Addresses 
without date ranges will appear at the bottom of the address list. Such 
an address may be current or historical. Underlined Items provide a 
Link to record details.
    Phone Listings for Subject's Addresses
    1400 35TH ST W SPRINGFIELD, FL 34090
    Over 100 phone numbers found, only same last name considered.
    4833 STORM ST SPRINGFIELD, OH 34443
    ACME RENTALS (555) 555-1935
    305 WAYBREEZE BLVD COLUMBUS, OH 34209
    THUL ZACHARY (555) 498-5525
    Possible Real Property Ownership
    4833 STORM ST SPRINGFIELD, OH 34443
    Ohio Assessment Record--County of: CLARK
    Owner Name: THUL, ZACHARY
    Parcel Number: 998-8748-9448
    Short Legal Desc: STORM ST IR PT LOT 7& ADK J S BUCKINGHAM AM EST
    Property Type: SINGLE FAMILY
    Recorded Date:
    Situs Address: 4833 STORM ST I 33
    SPRINGFIELD, OH 34443
    Mailing Address: 7891 W FLAGLER ST
    MIAMI, OH 38972
    Assessment Year: 1995 Tax Year: 1997
    Assessed Land Value: Market Land Value: $366,800
    Assessed Improvements: Market Improvements: $192,000
    Total Assessed Value: Total Market Value: $558,800
    Most Recent Sale: $305,000 Prior Sale Price:
    A manual search of Real Property using the name THUL ZACHARY K is 
recommended. 4 additional property records exist (including 
historicals) but are not included, as they do not match all necessary 
criteria.
    Possible Deed Transfers
    305 WAYBREEZE BLVD COLUMBUS OH 34209
    Ohio Deed Transfer Records--County of: FRANKLIN
    Parcel Number: T545663
    Legal Desc: LT 56 BLK 87 PB 14/38
    Sale Price: $84,000 Loan Amount: $67,200
    Contract Date: 8/14/1995
    Lender: LIBERTY SAV BK
    Situs Addr: 305 WAYBREEZE BLVD
    COLUMBUS, OH 34209
    Seller(s): THUL, ZACHARY K
    Buyer(s): SMITH, BART O
    Possible Vehicles Registered at Subject's Addresses
    1400 35th ST K 4I SPRINGFIELD, FL 34090
    Plate: K387KJ State: NY Date Registered: 08/14/1995 Expire Date: 
08/29/2000
    Title: 76174678 Title Date: 10/30/1998
    OWNER: ZACHARY K THUL
    Color: WHITE
    This message probably indicates that a multi-unit building is 
located at this address.
    By comparing the list of Possible Addresses Associated with Subject 
with the listed phone numbers in the Phones module, the report finds 
phone numbers, which have been listed at the given address. In this 
report, one property record was found in Real Property SM 
which matched the subject's name and address and the properties situs 
address. This message indicates that additional records in Real 
Property SM match the subject's name, but none of these 
records had a situs address that matched an address found at the top of 
the report. These additional properties may belong to the subject or 
may simply belong to someone with the same name. Search Real Property 
SM by name for a complete list of possible properties. A 
list of states and counties for which AUTOTRACK XP SM has 
deed transfer records can be located by choosing the Help link from the 
blue AUTOTRACK XP SM navigation bar at the top of the 
screen. The property information returned from this database may differ 
from the information found in Real Property SM. (See the 
above note on Possible Property Ownership.) A list of states for which 
AUTOTRACK XP SM has vehicle registration records can be 
located by choosing the Help link from the blue AUTOTRACK XP 
SM navigation bar at the top of the screen. Underlined items 
provide a link to record details.
    1999 DODGE GRAND CARAVAN SE
    DODGE GRAND CARAVAN SE--3.3L V6 SOHC FLEXFUE
    VIN: 2B5CD3595EK253648
    MINIVAN
    Plate: ID036H State: FL Date Registered: 04/28/1999 Expire Date: 
10/30/2000
    Title: 77465960 Title Date: 09/29/1998
    OWNER: ZACHARY K THUL
    Color: RED
    1997 CHEVROLET S10 PICKUP
    CHEVROLET S10 PICKUP--2.2L L4 EFI OHV 8V
    VIN: 1GCCS144X8144822
    PICKUP
    Possible Watercraft
    Owner: THUL ZACHARY
    Address: 70 REARVIEW DR
    RIVERBEND, NY 11903
    Year: 1988 Length: 41.9, MFG:
    Reg Number: K989495 State Registered: NY
    Hull Const.: FIBERGLASS
    Hull Number:
    Use: PLEASURE
    Propulsion: INBOARD
    Fuel: GASOLINE
    Possible FAA Aircraft Registrations
    Owner: THUL ZACHARY K
    Year: 1957
    Make: PIPER
    Model: PA-22
    N-Number: N0225J
    Aircraft: FIXED WING SINGLE ENGINE
    Address: 4833 STORM ST I33
    SPRINGFIELD, OH 34090
    Possible UCC Filings
    Original Date: 02/09/1988
    Action: INITIAL FILING Date: 1988
    File State: OHIO
    Debtor: ZACHARY THUL
    Address: 305 WAYBREEZE BLVD
    COLUMBUS OH 34209
    Secured Party: HOME SAVINGS & LOAN ASSOC
    AKRON OH
    Possible Bankruptcies, Liens and Judgments
    Court Location: EASTERN DISTRICT OF OHIO--FRANKLIN
    Filing Type: CHAPTER 7 DISCHARGE Filing Date: 08/14/1996
    Case Number: 98555555 Release Date:12/18/1996
    Creditor/Plaintiff: MARTIN T MARTINSON Amount:
    Debtor/Defender: THUYL ZACHARY K
    305 WAYBREEZE BLVD SSN: 960-45-XXXX
    A list of states for which AUTOTRACK XP SM has Uniform 
Commercial Code lien records can be located by choosing the Help link 
from the blue AUTOTRACK XP SM navigation bar at the top of 
the screen.
    COLUMBUS, OH 34209
    Attorney: MARTIN T MARTINSON
    Possible Professional Licenses
    Type: OHIO Professional License
    License Type: LICENSED SOCIAL WORKER
    Lic. Number: 42389 Status: ACTIVE
    Original Date: 01/10/1990
    SSN: DOB:
    Phone:
    Full Name: THUL, ZACHARY K
    Address: 4833 STORM ST I33
    SPRINGFIELD, OH 34090
    County: CLARK
    Possible FAA Pilot Licenses
    Pilot Name: THUL, ZACHARY K
    FAA Class: PRIVATE PILOT
    FAA Rating: SINGLE ENGINE LAND
    Medical Class: THIRD CLASS--VALID FOR 24 MONTHS
    Medical Date: 07/19/98
    FAA Region: NORTHWEST/MOUNTAIN--CO, ID, MT, OR, UT, WA, WY
    Address: 4833 STORM ST I33
    SPRINGFIELD, OH 34090
    Possible DEA Controlled Substance Licenses
    Business: PRACTITIONER
    Name: THUL, ZACHARY K MD Expires: 09/30/1999
    Address: 7891 W FLAGLER ST
    MIAMI OH 38972
    Authorized Drug Schedules: II, II, III, III, IV, V
    Possible Business Affiliations
    15 ROBY AVE HAMPTON BAYS, OH 11238
    STETSON HAULING, INC. OH 2543854
    CHAIRMAN ACTIVE
    Officer Name Match Only (NOT necessarily affiliated)
    Matching Name : THUL ZACHARY K
    OLSON FAMILY PROPERTIES & INVESTMENTS, INC. MA 789123
    REG AGENT ACTIVE
    TOO HOT TO HANDLE FL H76543
    SECRETARY INACTIVE
    Possible Relatives (* denotes match with one of subject's 
addresses)
    (R-1) THUL CLAIRE DOB: DEC 1954
    SSN 999-15-XXXX issued in New York in 1973
    SEP 1994/JUL 1998--*305 WAYBREEZE BLVD
    COLUMBUS, OH 34209
    Certain individuals and businesses are required to be registered 
under the Controlled Substance Act. Physicians, dentists, and 
veterinarians are among this group. For a more complete explanation and 
definition of the drug schedules, choose the Help link from the blue 
AUTOTRACK XP SM navigation bar at the top of the screen. A 
list of states for which AUTOTRACK XP SM has corporation 
records can be located by choosing the Help link from the blue 
AUTOTRACK XP SM navigation bar at the top of the screen. A 
person will qualify as a possible relative in the National 
Comprehensive Report Plus Associates SM if he or she has the subject's 
last name and has been linked to one or more of the same addresses 
which appear under Possible Addresses Associated with Subject on page 
1.
    The asterisks indicate an address match between the possible 
relative and the subject of the report (see Possible Addresses 
Associated with Subject on page 1).
    JUL 1995/JUL 1995--*15 ROBY AVE (555) 123-4567
    HAMPTON BAYS, NY 11238
    OCT 1994/OCT 1996--355 LAVERNE AVE
    COLUMBUS, OH 34492
    DEC 1992/DEC 1996--*70 LAKEVIEW DR
    RIVERHEAD, NY 11901
    (R-2) THUL TOMMY DOB:
    DEC 1995/DEC 1996--599 MAIN ST
    RIVERBEND, NY 11093
    APR 1995/AUG 1995--355 LAVERNE AVE
    COLUMBUS, OH 34492
    Other People Who Have Used the Same Address of the Subject
    (* denotes match with one of subject's addresses)
    15 ROBY AVE HAMPTON BAYS, NY 11238
    (O-1) GENNINE LOWELL
    SSN 972-45-XXXX issued in New York between 1966 and 1969
    SEP 1993/SEP 1994--5 NEWTON AVE
    HAMPTON BAYS, NY 12983
    12 M BAY ST
    HAMPTON BAYS, NY 13987
    *15 ROBY AVE
    HAMPTON BAYS, NY 11238
    305 WAYBREEZE BLVD COLUMBUS, OH 34209
    (O-2) MARIE G SMITH
    SSN 991-25-XXXX issued in New Jersey in 1962
    SEP 1993/SEP 1994--*305 WAYBREEZE BLVD
    COLUMBUS, OH 34209
    AUG 1995/AUG 1996--301 BAYSIDE TER
    CHARLOTTE, OH 34258
    SEP 1993/SEP 1994--*438 BULLSIDE TER W
    HACKENSACK, NJ 09348
    Possible Licensed Drivers at Subject's Addresses
    7891 W FLAGLER ST MIAMI, OH 33144
    THUL, EDWARD H
    DL: T600465 issued in Ohio on 07/27/1994 expires 09/11/2000
    DOB: 04/19/1969 Height: 5,02"
    1400 35TH ST K 4I SPRINGFIELD, FL 34090
    **No Drivers Found At This Address**
    4833 STORM ST I33 SPRINGFIELD, OH 34443
    **91 Drivers found at this address, only last name considered. **
    **No Drivers Found At This Address**
    305 WAYBREEZE BLVD COLUMBUS, OH 34209
    THUL, STACEY B
    DL: T600788 issued in Ohio on 07/24/1994 expires 04/27/2001
    DOB: 05/26/1926 Height: 5,04"
    Driver License Information is unavailable for the following states: 
NEW YORK, NEW JERSEY
    The report will attempt to locate a brief list of addresses for the 
possible relative. To possibly locate more current addresses for the 
relative, run a report by clicking on the underlined link. A person 
will qualify for this category in the National Comprehensive Report 
SM Plus Associates if he or she has a last name different 
from the report subject's last name and has been linked to one or more 
of the same addresses, which appear under Possible Addresses Associated 
with Subject on page 1. A person may be linked to one of the same 
addresses as the subject, even though he or she has never known the 
subject. Two people might be linked to the same address but at 
different time periods. For example, one person could be a former 
resident of the address where the subject now resides. Multiple address 
matches with the subject, denoted by multiple asterisks, will identify 
people who have a greater likelihood of knowing the subject.
    This message probably indicates that a multi-unit building is 
located at this address.
    Neighbor Phone Listings for Subject's Addresses (only first six 
addresses included)
    7891 W FLAGLER ST MIAMI, OH 33144
    STATER OFFICE PRODUCTS 7895 W FLAGLER ST (555) 555-0482
    BIG ED'S MUFFLER SHOP 7897 W FLAGLER ST (555) 555-3358
    BUD'S USED CARS 7900 W FLAGLER ST (555) 555-8288
    15 ROBY AVE HAMPTON BAYS, NY 11238
    FELLINGHAM MIKE 4 ROBY AVE (555) 555-8697
    SCOTT GORDON G 6 ROBY AVE (555) 555-1297
    GHERSI JOHN 8 ROBY AVE (555) 555-6819
    ELIAS SIMON 9 ROBY AVE (555) 555-2659
    SCALCIONE STAN 10 ROBY AVE (555) 555-8425
    CANGIANO F P 12 ROBY AVE (555) 555-5217
    CORCORAN STEVE 26 ROBY AVE (555) 555-9917
    1400 35TH ST K SPRINGFIELD, OH 34443
    AHRENDT DAN 1400 35 ST K (555) 555-1664
    ALPIN JEFF 1400 35 ST K (555) 555-8117
    AMBROSE A 1400 35 ST K (555) 555-7553
    APURTON J 1400 35 ST K (555) 555-0735
    ARNOLD ROBY 1400 35 ST K (555) 555-4071
    BAKER C R 1400 35 ST K (555) 555-8490
    BALCHUNAS TERRY 1400 35 ST K (555) 555-5753
    BAMBERGER RICHARD 1400 35 ST K (555) 555-8203
    The following databases were searched but data for the subject was 
not found:
    ABI Business Directory, Active U.S. Military Personnel, Broward 
County Felonies/Misdemeanors, Broward County Traffic Citations, Federal 
Firearms and Explosives License, Florida Accidents, Florida Banking and 
Finance Licenses, Florida Beverage License, Florida Boating Citations, 
Florida Concealed Weapon Permits, Florida Day Care Licenses, Florida 
Department of Education, Florida Felony/Probation/Parole, Florida 
Fictitious Name, Florida Handicap Parking Permits, Florida Hotels and 
Restaurants, Florida Insurance Agents, Florida Marriages, Florida Money 
Transmitter Licenses, Florida Salt Water Product Licenses, Florida 
Securities Dealers, Florida Sexual Predator, Florida Tangible Property, 
Florida Tobacco License, Florida Unclaimed Property, Florida Worker's 
Compensation Claims, Marine Radio Licenses, Significant Shareholders, 
Trademarks/Service Marks, and state-specific databases.
    ***End of Report SS--009/01***
    Control Numbers: 5661614--5661620--1BF47FA5975FBA0
        Exhibit II--The Wall Street Journal Online, May 2, 2005
    In the last few months, several major companies reported that 
customer data, including credit-card information, was compromised. The 
list includes:

------------------------------------------------------------------------
                Date
            announced to   Number of   Affected    Security
  Company      general      people       data       breach     Response
               public      affected
------------------------------------------------------------------------
ChoicePoin  Feb. 15       About       Addresses,  Thieves     Informed
 t--compil                 145,000     Social      posing as   Federal
 er of                     consumers   Security    legitimat   authoriti
 consumer                  had data    numbers     e           es. Will
 data.                     in the      and         customers   no longer
                           system.     credit      bought      sell
                           At least    reports.    informati   sensitive
                           750 fraud               on.         ,
                           cases are                           personal
                           known.                              data to
                                                               clients
                                                               other
                                                               than
                                                               governmen
                                                               tal
                                                               agencies,
                                                               accredite
                                                               d
                                                               corporate
                                                               customers
                                                               or other
                                                               businesse
                                                               s whose
                                                               use is
                                                               driven by
                                                               a
                                                               consumer-
                                                               initiated
                                                               transacti
                                                               on.
Bank of     Feb. 25       Holders of  Social      Computer    Contacted
 America--                 as many     Security    backup      Federal
 bank and                  as 1.2      numbers.    tapes       authoriti
 credit-                   million                 were        es, then
 card                      Federal                 lost.       consumers
 company.                  Governmen                           .
                           t charge
                           cards.
DSW Shoe    March 8       Initially,  Credit-     Hackers     Reported
 Warehouse                 the theft   and debit-  stole       to
 -shoestor                 was said    card,       data from   Federal
 e chain,                  to be       checking    a           authoriti
 a unit of                 limited     account     database    es.
 Retail                    to about    and         for 108     Customers
 Ventures                  100,000     driver's    of the      advised
 Inc.                      customers   license     chain's     to check
                           ; a month   numbers,    175         credit-
                           later, it   and         stores.     card
                           was         personal-               statement
                           raised to   shopping                s.
                           1.4         informati
                           million.    on.
LexisNexis  March 9       Initially,  Social      Unauthoriz  Informed
 -consolid                 data for    Security    ed use of   Federal
 ator of                   as many     numbers     customer    authoriti
 legal and                 as 32,000   and         logins      es and
 business                  consumers   driver's    and         consumers
 informati                 was at      license     passwords   ,
 on, a                     risk. A     numbers.    .           improved
 division                  month                               security,
 of Reed                   later,                              limited
 Elsevier                  raised to                           customer
 PLC.                      about                               access to
                           310,000,                            personal
                           though                              data.
                           only 59
                           incidents
                           of
                           illegal
                           action
                           are
                           known.
Boston      March 17      Database    Addresses   Intruder    Notified
 College*                  included    and         hacked      affected
                           records     Social      into a      alumni.
                           on          Security    school
                           120,000     numbers.    computer
                           alumni.                 operated
                                                   by an
                                                   outside
                                                   fundraise
                                                   r.
Polo Ralph  April 14      As many as  Credit-     n.a.        Card
 Lauren--c                 180,000     card                    issuer
 lothing                   customers   data.                   HSBC
 retailer.                 who hold                            notified
                           GM-                                 consumers
                           branded                             .
                           MasterCar
                           ds.
Ameritrade  April 19      About       Varies by   Backup      Notified
 -online                   200,000     customer.   computer    affected
 discount                  current                 tape was    consumers
 stock                     and                     lost in     .
 broker.                   former                  shipping.
                           customers
                           from 2000
                           to 2003.
Time        May 2         About       Social      Backup      Notified
 Warner--m                 600,000     Security    computer    those
 edia                      current     numbers     tape was    affected.
 conglomer                 and         and         lost in
 ate.                      former      details     shipping
                           U.S.        on          by an
                           employees   beneficia   outside
                           back to     ries and    data-
                           1986.       dependent   storage
                                       s.          company.
------------------------------------------------------------------------
*Other recent university-level security breaches occurred at California
  State University-Chico, University of California-Berkeley, Tufts
  University and Northwestern University.
Sources: WSJ, Associated Press, the companies.
Note: Unless where noted, these are cases of data being at risk, not of
  data being fraudulently used. In all cases the stolen data included
  the names of the affiliated consumers.

    Senator Smith. Thank you very much.
    This hearing has to conclude at 5 o'clock. And so, with 
that, I'll let Senator Nelson--I know he has a number of 
questions.
    Senator Bill Nelson. OK. And, Mr. Chairman, what I'll do is 
submit most of them in writing for the record.
    But let me just go through a couple of questions each for 
each of the four of you.
    Ms. Barrett, there was a report that, in your company, you 
had the theft of information through a person gaining illegal 
access to sensitive, personal information of 20 million people. 
When your company was alerted about this breach, Acxiom 
allegedly alerted its clients, but not the individual consumers 
that had been affected. Is it true--this report that's in a 
book that we have read, entitled, ``No Place to Hide''--is it 
true that someone gained access to the sensitive records of 20 
million people?
    Ms. Barrett. No, it's not, Senator. The incident occurred 
in 2003. It was a server that our clients use to transfer files 
to us for processing, and then we posted the results of that 
processing back on the file--on the server, to be transferred 
back to the client.
    The theft did involve many, many records. And, while that 
20 million number may be ballpark in terms of how many records 
were involved, that did not necessarily represent individuals. 
And it certainly in no way represented sensitive information.
    The standard for that particular server was that 
information of a sensitive nature--Social Security number and 
so forth--be encrypted.
    Senator Bill Nelson. Did law enforcement later search the 
perpetrator's home and find a CD that contained the Acxiom 
data?
    Ms. Barrett. Yes. There were actually two perpetrators 
involved in this. And in one incident the perpetrator had 
copied information onto a CD and had it in his possession when 
law enforcement apprehended him.
    Senator Bill Nelson. And did that include the 20 million 
records?
    Ms. Barrett. I don't know exactly how many records were on 
those CDs. We worked with law enforcement to identify the files 
that were involved. But it would have contained some of that 
information.
    Senator Bill Nelson. Well, if it--I mean, that's what--the 
purpose of this hearing. We're trying to point out what the 
problem is, and if there's a CD in somebody's home that they 
illegally stole, and it's got 20 million records, that's 20 
million potential thefts.
    Ms. Barrett. It did not have 20 million records containing 
sensitive information.
    Senator Bill Nelson. How many did it have?
    Ms. Barrett. The CD?
    Senator Bill Nelson. Yes.
    Ms. Barrett. I do not know. I can try to get an estimate of 
that information for you.
    Senator Bill Nelson. And when you say ``not sensitive 
information,'' is a Social Security number sensitive 
information?
    Ms. Barrett. Absolutely.
    Senator Bill Nelson. How about a driver's license number?
    Ms. Barrett. Absolutely.
    Senator Bill Nelson. So----
    Ms. Barrett. I would define ``sensitive information'' in 
the way that California has defined it in their notice-breach 
law.
    Senator Bill Nelson. But you don't know how many numbers 
were taken from the company.
    Ms. Barrett. How many sensitive-information----
    Senator Bill Nelson. That's correct.
    Ms. Barrett. We do not know, exactly. Our clients sent us 
this information. In some cases, it's encrypted, and--in many 
cases, the sensitive information is encrypted; in some cases, 
nonsensitive information is encrypted. When we send the files 
back to the clients, what happened after the breach was, we 
identified which files had been accessed inappropriately and 
illegally, and our clients went through an inventory of exactly 
what data was included in those files. In many cases, we did 
not have the data in our possession.
    Senator Bill Nelson. Mr. Chairman, the point that I'm 
merely making here, instead of quibbling at the numbers, is 
that, so often--obviously, the company doesn't want people to 
know that somebody has gained illegal access to the 
information. And the information is often described in a 
certain figure. And in the case of both ChoicePoint and 
LexisNexis, the first figure that was given out publicly was 
much, much less than what it ultimately was. In the case of 
LexisNexis--and I'm a little more sensitive to this, because it 
was a Florida company that they had acquired--and they first 
said it was 30,000, and then they admitted that it was 300,000. 
So, we've got--I think the whole point here is, instead of 
quibbling with you about 20 million or one million or whatnot, 
that we've got a problem.
    All right, let me ask you about--you had made some 
assertions--specifically, an e-mail, Ms. Barrett, on May 21, 
2002, to John Poindexter. And in that e-mail, you allegedly 
stated--and tell us if this is true--quote, ``The U.S. may need 
huge databases of commercial transactions that cover the 
world,'' and that Acxiom could build this mega-scale database. 
Why would such a--why would such a database of commercial 
transactions be necessary? And what steps has Acxiom taken to 
create this database?
    Ms. Barrett. Senator, I'm not familiar, specifically, with 
the e-mail that you're referring to.
    Senator Bill Nelson. Did you send----
    Ms. Barrett. Back in----
    Senator Bill Nelson.--an e-mail to John----
    Ms. Barrett. I did not----
    Senator Bill Nelson.--Poindexter?
    Ms. Barrett.--personally send an e-mail to John Poindexter, 
no. I would--could check and see if someone from our company 
did.
    We worked with the Department of Defense and some of the 
staff on John Poindexter's--in John Poindexter's organization 
back in 2002, in an advisory capacity talking about some of the 
projects that he was exploring. And, specifically, we advised 
that Department that there were significant privacy concerns 
that needed to be taken into account in the development of any 
kind of large-scale databases.
    Senator Bill Nelson. That information, supposedly--and 
we'll check it out--was obtained under the Freedom of 
Information Act by the Electronic Privacy Information Center. 
And that's----
    Ms. Barrett. I'm----
    Mr. Rotenberg. Senator, the e-mail is on our website.
    Ms. Barrett. The e-mail is an e-mail--if it's the specific 
situation we're talking about with EPIC, the e-mail is not from 
me; it is from a member of John Poindexter's staff.
    Senator Bill Nelson. OK, thank you for clarifying that. 
Rather chilling. ``The U.S. may need huge databases of 
commercial transactions to cover the world.''
    Let me ask you, Mr. Rotenberg, the Privacy Act of 1974, in 
part, prevented the Federal Government from creating central 
databases where all personal information could be stored for 
government access. It now appears at least some levels of 
government are out-sourcing this task to information brokers, 
witness my further--earlier questioning about Seisint and the 
database called Matrix. In your opinion, is the Federal 
Government complying with the letter and the spirit of the law 
of the Privacy Act of 1974?
    Mr. Rotenberg. No, it's not, Senator. In fact, one of the 
things that we realized as we pursued a Freedom of Information 
Act request involving ChoicePoint was the extraordinary amount 
of personal information that was being obtained by Federal 
agencies for law enforcement purposes.
    Now, we don't dispute that the information may have value 
for investigations. We understand that. The question is whether 
there is any legal safeguard in place to ensure that the 
Privacy Act principles, such as due process and oversight and 
protection of First Amendment freedoms, are being respected.
    And our view is that, in the absence of explicit 
application of the Privacy Act to the information brokers, the 
answer is that there is not the protection of the 1974 Act, as 
there should be.
    Senator Bill Nelson. Just quick questions here, because the 
Chairman needs to get out of here. Do you think the legislation 
that Senator Schumer and I have filed would help restore 
greater consumer privacy and reduce identity theft?
    Mr. Rotenberg. Yes, I do, Senator. And I think it is 
absolutely urgent for the Committee to act on it. One of the 
points that I make in my written statement is that the problem 
of identity theft is rapidly escalating in this country. In 
fact, today the Senate may take up the Real ID Act, a dramatic 
expansion of identification credentials in this country, 
without even any debate. And you may be interested to know that 
state DMVs have become the targets of identity thieves.
    Senator Bill Nelson. Mr. Kurtz, what do you think about the 
legislation that we filed?
    Mr. Kurtz. Well, first of all, I want to commend you and 
Senator--Senator Nelson and Senator Schumer for taking the lead 
on pulling together legislation in this space. I think there 
are several good points with regard to the legislation. First, 
notice, mandatory notice, and the scope which you've applied 
with regard to the notice. You've noted that it's broader than 
just the data brokers that we need to think about. Two, you've 
talked about reasonable security measures and the importance of 
that. And I would note, in that space, under the Privacy Act, 
there are reasonable measures that need to be taken by the 
Federal Government in order to secure Social Security numbers 
and dates of birth and the like. Three, you've given victims a 
place to go. We, at the Cyber Security Alliance, get a lot of 
calls, ``Where do we go? Who are we supposed to talk to?'' You 
can report it in to the FTC, as it is right now, but, frankly, 
they have limited means in order to deal with it. They can keep 
it in the Sentinel database and track things, but they don't 
actually have an apparatus where you can go to actually do 
follow-up.
    And, the final point that I would make--and I'm probably 
leaving something out--is the importance of leadership. You've 
identified the need to have the executive branch take a greater 
leadership role in cybersecurity overall, understanding that 
this is just not one single slice of an issue. All these issues 
that we've dealing with--phishing, spyware, data-warehouse 
security--they're all interconnected. Having an Assistant 
Secretary at DHS to be that strategic leader would be 
incredibly helpful.
    Senator Bill Nelson. Thank you for that. I mean, and that 
underscores the next part of this legislation, which is 
protection of the homeland, as well as protection of our 
individuals.
    Thank you, Mr. Chairman.
    Senator Smith. Thank you, Senator Nelson.
    Senator Pryor, do you have a question?
    Senator Pryor. Mr. Chairman, if you need to head out, I 
can----
    Senator Smith. Go ahead.
    Senator Pryor. OK. Because I don't mind taking over the 
leadership of this Committee. I don't think I can do a whole 
lot of damage from here.
    [Laughter.]
    Senator Pryor. As much as I'd like to.
    [Laughter.]
    Senator Pryor. But I can--I'll be glad to. If you need to 
run, please just--I'll try to make my questions brief.
    Mr. Rotenberg----
    Senator Bill Nelson. We can do a mark-up if he leaves.
    [Laughter.]
    Senator Pryor. That's right. If you'd just leave----
    [Laughter.]
    Senator Pryor.--and allow us a little time here by 
ourselves, we would appreciate it. Do you mind?
    [Laughter.]
    Senator Smith. I trust you guys implicitly, but I think my 
colleagues might question my wisdom, I'm sure.
    [Laughter.]
    Senator Pryor. Mr. Rotenberg, let me start with you, if I 
may. I want to know what your experience has been with credit-
freeze laws in the states. And I'm seeing a story here--I 
believe it comes out of Texas, or maybe Vermont, I'm not quite 
sure--but can you tell us, first, what credit freeze is, and 
how it's worked, if you think it's a good idea?
    Mr. Rotenberg. Sure. Senator, I think it's a very good 
idea. Simply stated, what a credit freeze does is puts your 
credit report in the off-setting. In other words, it isn't 
disclosed to others unless you decide that you want to make 
your credit report available. Currently, credit reports are 
widely available. They're used for very many purposes that most 
consumers aren't aware of. And what the four states have done 
that have passed credit-freeze legislation, has been to 
basically say to consumers, ``If you need to get a home 
mortgage, if you need a loan for the car, sure, you're going to 
want to make your credit report available. But, otherwise, that 
report will stay in the off-setting, and others won't get 
access to it.'' And we think it's a very sensible way to reduce 
the risk of identity theft.
    Ms. Frank. May I add something?
    Senator Pryor. Yes.
    Ms. Frank. Our State was the first State to ask for it, and 
I helped with that legislation. The reason we had a need for a 
security freeze is because the fraud alerts weren't working. In 
other words, when you became a victim of identity theft, you 
could call the credit-reporting agencies and put a fraud alert 
on your credit profile, and it says, ``Don't issue credit 
without calling me first.'' What we were finding is that myriad 
victims would have that fraud alert on their credit profile, 
yet there were creditors that still issued credit. So, we went 
to the legislature and said, ``We need something that is going 
to be a real key to lock the door.'' And so, the credit freeze 
is such that a victim, or even, in our State, a consumer, can 
write to the credit-reporting agencies--and if you're a victim, 
for free--you can put this credit freeze on, which gives you a 
password. So, let's say I have a credit freeze on my credit 
report and I want to go out and buy a car. I can unfreeze, or 
``thaw,'' with my password for a specific industry, like all 
the car dealerships, or I can do it for everyone. And then I 
refreeze it. Now, if you're a non-victim, you pay $10 to freeze 
it or non-freeze it.
    If fraud alerts worked, which now you know, it's written 
into the FACTA, which is the Fair and Accurate Credit 
Transactions Act--if they really worked 100 percent, and people 
called you, that would be one thing. But under FACTA, if a 
creditor issues credit when there's a fraud alert on your 
credit report, you have no private right-of-action. You have no 
recourse. And so, I'm telling all California citizens, and 
those who are in the states that have this freeze, the only way 
you can guarantee that you can protect yourself from financial 
identity theft is to use the freeze. It won't help you for 
criminal identity theft, but it will help you for financial.
    Senator Pryor. OK. Well, I--thank you for that. Ms. Frank, 
let me ask you, while we're talking about this--changing gears 
a little bit--but we know that data brokers have information 
like Social Security numbers, dates of birth, you know, street 
addresses, records of what we purchase, you know, things like 
that, but can you give me some examples of information--if you 
know any--examples of information that are so intensely private 
that the data should never be allowed to be shared?
    Ms. Frank. Well, if you look at my written testimony, on 
page 17----
    Senator Pryor. OK.
    Ms. Frank.--you will find an exhibit of an actual sample of 
AutoTrack, which is from ChoicePoint. It has not only the 
Social Security number, date of birth, aka's, and then it says 
``other possible Social Security numbers.''
    Senator Pryor. OK.
    Ms. Frank. It also has, if you look down here, driver's 
licenses, height, weight--let's see--past addresses. You go 
down here, and it has other things, like, hmm, you name it, 
it's in here, places you've lived, cars you've bought, boats or 
anything like that, if you have a pilot's--any kind of license 
you ever had, any problem with the license, if you were ever 
suspended for something, deeds, all the deeds that you've ever 
owned. Now, some of these are public records.
    Now, I want to say one thing about public records. Death 
certificates, birth certificates, marriage certificates, they 
have your Social Security number. In the State of California, 
we have passed laws to redact those numbers, because your 
mother's maiden name, for example, is on your birth 
certificate, and your parents' Social Security number is on 
your birth certificate.
    OK. So, if you look at this--I don't want to take--I'm 
seeing the red light coming on--you can look, yourself, for--
this thing goes from page 17 all the way to page 23 of all the 
things--24.
    Senator Pryor. But are you saying that some of that is so 
intensely private that it should not be shared?
    Ms. Frank. Well, if you got this, which I have seen on 
other people--if you got this, you would have an entire package 
to take someones identity--it even says your family and your 
neighbors and your family's name--the members of your family, 
who lives there, what licenses they have. And it even gives 
neighbors around the block. So, basically, if somebody wanted 
to steal your identity, Senator, they'd have everything that 
they need to talk about who you are, what properties you've 
owned, where you've lived.
    So, what I'm saying, it's the entire profile that is so 
terribly frightening, and the Social Security number, at this 
point, is the key to the kingdom of identity theft. And it's 
all in here.
    Senator Pryor. OK. One last question, if I may, Mr. 
Chairman, and this is for Ms. Barrett, and that is--you 
mentioned, during your testimony a few moments ago, that your 
company encrypts data. If we required all companies that 
handle, you know, personally identifiable data--if we required 
them to encrypt it, would that help solve this problem?
    Ms. Barrett. Yes, I think it would. Encryption is a 
wonderful tool for protecting data, both in the static state, 
as well as in transit. And as one of the--it was mentioned 
earlier, information in transit is one of the riskier areas 
where identity thieves have an opportunity to take hold of 
data.
    Encryption is not as easy as we would like for it--to think 
it is. It's not a plug-and-play kind of thing for companies to 
do. But we need all the incentives we can to make it much more 
of a universal standard.
    Ms. Frank. Senator, one thing. If we had encryption, it 
would not have helped in the ChoicePoint, when it's a dirty 
insider. So--and, also, if you have somebody in the IT 
department who can un-encrypt--so, if you had encryption, 
that's great, but you have to have an exception for security 
notice if it is a dirty insider.
    Senator Pryor. Mr. Chairman, I'm sorry, I think Mr. Kurtz 
had a----
    Mr. Kurtz. Yes. Senator, Pryor, I just wanted to add--I 
think what California 1386 did, which I thought was rather 
elegant, was, they didn't mandate that encryption be used. They 
said that, for any unencrypted breach of information, that the 
owner of the information needed to be notified. I think the 
point that I guess I'm trying to make here is, we need to think 
more broader--broadly, and not just a technology mandate of one 
type of technology--or, excuse me, no mandates of specific type 
of technologies; let's look at the whole set of tools that are 
available which are, in fact, technologies, policies, and 
expertise that need to be brought together. And I've outlined 
that in my written testimony for you folks to review.
    Senator Smith. So, it left it up to the companies and 
technologies to----
    Mr. Kurtz. Yes, in fact----
    Senator Smith.--to meet the standard, rather than to 
prescribe a standard.
    Mr. Kurtz. Yes. And, in fact, we haven't talked about 
standards today, but there are standards out there that people 
can look and turn to in order to get some guidance as to what 
they might need to do in order to secure their systems. There 
are--you know, there are international standards, there are 
American standards that people could look at that could really 
be used for folks to turn to. Now, sometimes they're criticized 
for being too broad, or to general, but there are some, you 
know, if you will, key guideposts there that companies can look 
at, or you could ask companies to look at, in order to ensure 
they're doing the right thing.
    Senator Smith. And their motivation is, they've got legal 
liability for that.
    Mr. Kurtz. That's an issue that the Congress might consider 
investigating. What type of incentives might you build into 
this in order to get folks to go down that road?
    Senator Smith. Well, what did California do? What was their 
elegant solution? What was it?
    Mr. Kurtz. Their elegant solution was, they didn't require 
encryption.
    Senator Smith. So, if they didn't require it, did they just 
give them the assignment and left open the liability?
    Mr. Kurtz. Excuse me. I don't have the language in front of 
me, but it basically said for any unencrypted breach of 
information, there's a requirement to notify. So, if you unpack 
that, it means that if you encrypt, there is not an obligation 
to notify.
    Ms. Frank. And we're thinking of amending that for--you 
know, we like the idea of encryption, but we're thinking of 
amending it for those who know that there was access without 
encryption.
    Senator Smith. What's the penalty if they don't do all of 
that?
    Ms. Frank. Well, they can be sued.
    Senator Smith. OK. That's what I'm getting at.
    Mr. Kurtz. Oh.
    Senator Smith. And do they specifically address that, or do 
they leave it open, do you recall?
    Ms. Frank. Well, I'm trying to think exactly what the 
language says, since----
    Senator Smith. That's OK.
    Ms. Frank. I can send it to you. I'll give it you.
    Senator Smith. Senator, did you have any more questions?
    Senator Pryor. All I was going to say is really just a 
comment. I notice in this month's Fortune magazine, there's a 
article called ``The Great Data Heist,'' and, in there, they 
talk about how security information typically walks out the 
door in one of three ways--hackers grab it, employees steal it, 
or companies lose it. And I think that's probably right. I 
assume you all would agree with that. And so, what you're 
saying is right. Encryption, I think, is an important piece of 
this, but it doesn't solve all the problems. It doesn't--it's 
not a cure-all.
    Mr. Kurtz. It's not a panacea.
    Senator Pryor. Yes.
    Thank you, Mr. Chairman.
    Senator Smith. Thank you, Senator Pryor.
    And, ladies and gentlemen, thank you each for the 
contribution you've made to this first very important hearing 
on a very vital topic to the American people. We will, no 
doubt, be pursuing legislative proposals. The Chairman, Senator 
Stevens, has so indicated. But I think you have laid a good 
foundation in this hearing today, and we thank you very much 
for your time and contribution.
    We're adjourned.
    [Whereupon, at 5:15 p.m., the hearing was adjourned.]
                            A P P E N D I X

Prepared statement of Gail Hillebrand, Senior Attorney, Consumers Union
      Identity for Sale? Protecting Consumers from Identity Theft
Summary
    Consumers Union, \1\ the non-profit, independent publisher of 
Consumer Reports, believes that the recent announcements by 
ChoicePoint, Lexis-Nexis, and many others about the lack of security of 
our most personal information underscores the need for Congress and the 
States to act to protect consumers from identity theft.
---------------------------------------------------------------------------
    \1\ Consumers Union is a non-profit membership organization 
chartered in 1936 under the laws of the State of New York to provide 
consumers with information, education and counsel about goods, 
services, health and personal finance, and to initiate and cooperate 
with individual and group efforts to maintain and enhance the quality 
of life for consumers. Consumers Union's income is solely derived from 
the sale of Consumer Reports, its other publications and from 
noncommercial contributions, grants and fees. In addition to reports on 
Consumers Union's own product testing, Consumer Reports with more than 
four million paid circulation, regularly, carries articles on health, 
product safety, marketplace economics and legislative, judicial and 
regulatory actions which affect consumer welfare. Consumers Union's 
publications carry no advertising and receive no commercial support.
---------------------------------------------------------------------------
    Identity theft is a serious crime that has become more common in 
recent years as we have delved further into the ``information age.'' 
According to the Federal Trade commission, 27.3 million Americans have 
been victims of identity theft in the past five years, costing 
businesses and financial institutions $48 billion and consumers $5 
billion. Victims pay an average of $1,400 (not including attorney fees) 
and spend an average of 600 hours to clear their credit reports. The 
personal costs can also be devastating; identity theft can create 
unimaginable family stress when victims are turned down for mortgages, 
student loans, and even jobs.
    And as ongoing scandals involving ChoicePoint, Lexis-Nexis, and 
others point to, American consumers cannot fully protect themselves 
against identity theft on their own. Even consumers who do ``everything 
right,'' such as paying their bills on time and holding tight to 
personal information such as Social Security numbers and dates of 
birth, can become victim through no fault of their own because the 
companies who profit from this information have lax security standards.
    Therefore, Congress and the States must enact new obligations 
grounded in Fair Information Practices \2\ on those who hold, use, 
sell, or profit from private information about consumers. In this 
context, Fair Information Practices would reduce the collection of 
unnecessary information, restrict the use of information to the purpose 
for which it was initially provided, require that information be kept 
secure, require rigorous screening of the purposes asserted by persons 
attempting to gain access to that information, and provide for full 
access to and correction of information held.
---------------------------------------------------------------------------
    \2\ The Code of Fair Information Practices was developed by the 
Health, Education, and Welfare Advisory Committee on Automated Data 
Systems, in a report released two decades ago. The Electronic Privacy 
Information Center has described the Code as based on these five 
principles: (1) There must be no personal data recordkeeping systems 
whose very existence is secret. (2) There must be a way for a person to 
find out what information about the person is in a record and how it is 
used. (3) There must be a way for a person to prevent information about 
the person that was obtained for one purpose from being used or made 
available for other purposes without the person's consent. (4) There 
must be a way for a person to correct or amend a record of identifiable 
information about the person. (5) Any organization creating, 
maintaining, using, or disseminating records of identifiable personal 
data must assure the reliability of the data for their intended use and 
must take precautions to prevent misuses of the data. Electronic 
Privacy Information Center, http://www.epic.org/privacy/consumer/
code_fair_info.html.
---------------------------------------------------------------------------
Consumers Union Recommends That Lawmakers Do the Following

   Require notice of all security breaches: Impose requirements 
        on businesses, nonprofits, and government entities to notify 
        consumers when an unauthorized person has gained access to 
        sensitive information pertaining to them. Consumers Union 
        supports S. 751, by Senator Dianne Feinstein, which would put 
        these requirements in place. We also believe that S. 768, 
        introduced by Senator Charles Schumer and Senator Bill Nelson, 
        will make an excellent notice of breach law.

   Require and monitor security: Impose strong requirements on 
        information brokers to protect the information they hold and to 
        screen and monitor the persons to whom they make that 
        information available. S. 768, as well as S. 500 and H.R. 1080, 
        introduced by Senator Bill Nelson and Representative Ed Markey, 
        respectively, would direct the Federal Trade Commission to 
        develop such standards and oversee compliance with them.

   Give consumers access to and a right to correct information: 
        Give individuals rights to see, dispute, and correct 
        information held by information brokers. This is also addressed 
        in the Schumer/Nelson and Nelson/Markey bills.

   Protect SSNs: Restrict the sale, collection, use, sharing, 
        posting, display, and secondary use of Social Security numbers.

   Require more care from creditors: Require creditors to take 
        additional steps to verify the identity of an applicant when 
        there is an indicator of possible ID theft.

   Grant individuals control over their sensitive information: 
        Give individuals rights to control who collects--and who sees--
        sensitive information about them.

   Restrict secondary use of sensitive information: Restrict 
        the use of sensitive, personal information for purposes other 
        than the purposes for which it was collected or other uses to 
        which the consumer affirmatively consents.

   Fix FACTA: A consumer should be able to access more of his 
        or her Fair and Accurate Credit Transactions Act (FACTA) 
        rights, such as the extended fraud alert, before becoming an ID 
        theft victim. Further, one of the key FACTA rights is tied to a 
        police report, which victims still report difficulty in getting 
        and using.

   Create strong and broadly-based enforcement: Authorize 
        Federal, State, local, and private enforcement of all of these 
        obligations.

   Recognize the role of states: States have pioneered 
        responses to new forms of identity crime and risks to personal 
        privacy. Congress should not inhibit states from putting in 
        place additional identity theft and privacy safeguards.

   Provide resources and tools for law enforcement: Provide 
        funding for law enforcement to pursue multi-jurisdictional 
        crimes promptly and effectively. Law enforcement also may need 
        new tools to promote prompt cooperation from the Social 
        Security Administration and private creditors in connection 
        with identity theft investigations.

    After a very brief discussion of the problem of identity theft, 
each recommendation is discussed.
The Problem of Identity Theft Is Large and Growing
    Current law simply has not protected consumers from identity theft. 
The numbers tell part of the story:

   According to the Federal Trade Commission, 27.3 million 
        Americans have been victims of identity theft in the last five 
        years, costing businesses and financial institutions $48 
        billion, plus another $5 billion in costs to consumers.

   Commentator Bob Sullivan has estimated that information 
        concerning two million consumers is involved in the security 
        breaches announced over just the six weeks ending April 6, 
        2005. Is Your Personal Data Next?: Rash of Data Heists Points 
        to Fundamental ID Theft Problem, http://msnbc.msn.com/id/
        7358558

   Based on a report to the FTC in 2003, which concluded that 
        there were nearly 10 million identity theft victims each year, 
        Consumers Union estimates that every minute 19 more Americans 
        become victims of ID theft.

    These numbers can't begin to describe the stress, financial 
uncertainty, lost work-time productivity and lost family-time identity 
theft victims experience. Even financially responsible people who 
routinely pay their bills on time can find themselves in a land of debt 
collector calls, ruined credit and lost opportunities for jobs, 
apartments, and prime credit. With more and more scandals coming out 
every week, the time has come for Congress to act to protect the 
security of our personal information.
Recommendations
Notification
    Notice of security breaches of information, whether held in 
computerized or paper form, are the beginning, not the end, of a series 
of steps needed to begin to resolve the fundamental conundrum of the 
U.S. information U.S. society: collecting information generates 
revenues or efficiencies for the holder of the information but can pose 
a risk of harm to the persons whose economic and personal lives are 
described by that information.
    The first principle of Fair Information Practices is that there be 
no collection of data about individuals whose very existence is a 
secret from those individuals. A corollary of this must be that when 
the security of a collection of data containing sensitive information 
about an individual is breached, that breach cannot be kept secret from 
the individual. Recognizing the breadth of the information that 
business, government, and others hold about individuals, Consumers 
Union recommends a notice of breach requirement that is strong yet 
covers only ``sensitive'' personal information, including account 
numbers, numbers commonly used as identifiers for credit and similar 
purposes, biometric information, and similar information. This 
sensitive information could open the door to future identity theft, so 
it is vital that people know when this information has been breached.
    Consumers Union supports a notice-of-breach law which does the 
following:

   Covers paper and computerized data.

   Covers government and privately-held information.

   Does not except encrypted data.

   Does not except regulated entities.

   Has no loopholes, sometimes called ``safe harbors.''

   Is triggered by the acquisition of information by an 
        unauthorized person.

   Requires that any law enforcement waiting period must be 
        requested in writing and be based on a serious impediment to 
        the investigation.

   Gives consumers who receive a notice of breach access to the 
        Federal right to place an extended fraud alert.

    Consumers Union supports S. 751, which contains these elements. S. 
768 contains most, but not all, of these elements and in certain other 
respects provides additional protections.
    Three of these elements are of special importance: covering all 
breaches without exceptions or special weaker rules for particular 
industries, covering data contained on paper as well as on computer, 
and covering data whether or not it is encrypted. First, a ``one rule 
for all breaches'' is the only way to ensure that the notice is 
sufficiently timely to be useful by the consumer for prevention of 
harm. ``One rule for all'' is also the only rule that can avoid a 
factual morass which could make it impossible to determine if a breach 
notice should have been given. By contrast, a weak notice 
recommendation such as the one contained in the guidance issued by the 
bank regulatory agencies \3\ cannot create a strong marketplace 
incentive to invest the time, money, and top-level executive attention 
to reduce or eliminate, future breaches.
---------------------------------------------------------------------------
    \3\ That weak recommendation allows a financial institution to 
decide whether or not its customers need to know about a breach, and 
the explanatory material even states that it can reach a conclusion 
that notice is unnecessary without making a full investigation. 
Interagency Guidance on Response Programs for Unauthorized Access to 
Customer Information and Customer Notice, 12 CFR Part 30, 12 CFR Parts 
208 and 225, 12 CFR Part 364, 12 CFR Parts 568 and 570. Other reasons 
why those guidelines are insufficient to substitute for a statutory 
requirement to give notice include that they do not apply to non-
customers about whom the financial institution has sensitive data, that 
there is no direct or express penalty for violation of the guideline, 
and that their case-by-case approach will make it extremely hard to 
determine in which circumstances the guidance actually recommends 
notice to consumers, complicating the process of showing that an 
obligation was unmet.
---------------------------------------------------------------------------
    Second, unauthorized access to paper records, such as hospital 
charts or employee personnel files, are just as likely to expose an 
individual to a risk of identity theft as theft of computer files. 
Third, encryption doesn't protect information from insider theft, and 
the forms of encryption vary widely in their effectiveness. Further, 
even the most effective form of encryption can quickly become worthless 
if it is not adapted to keep up with changes in technology and with new 
tools developed by criminals.
    A requirement to give notice of a security breach elevates the 
issue of information security inside a company. A requirement for 
swift, no-exemption notice of security breaches should create 
reputational and other marketplace incentives for those who hold 
sensitive consumer information to improve their internal security 
practices. For example, California's security breach law has led to 
improved data security in at least two cases. According to news 
reports, after giving its third notice of security breach in fifteen 
months, Wells Fargo Bank ordered a comprehensive review of all its 
information handling practices. The column quoted a memo from Wells 
Fargo's CEO stating in part: ``The results have been enlightening and 
demonstrate a need for additional study, remediation and oversight. . . 
. Approximately 70 percent of our remote data has some measure of 
security exposure as stored and managed today.'' \4\
---------------------------------------------------------------------------
    \4\ D. Lazarus, ``Wells Boss Frets Over Security,'' S.F. Chronicle, 
Feb. 23, 2005. http://sfgate.com/cgi-bin/article.cgi?file=/c/a/2005/02/
23/BUGBHBFCR11.DTL.
---------------------------------------------------------------------------
    In another example, UC Berkeley Chancellor Robert Bigeneau 
announced plans to hire an outside auditor to examine data gathering, 
retention, and security, telling employees: ``I insist that we 
safeguard the personal information we are given as if it were our 
own.'' \5\ This announcement followed the second announced breach of 
the security of data held by the University in six months, this one 
involving 100,000 people.\6\
---------------------------------------------------------------------------
    \5\ ``Cal Laptop Security Put Under Microscope,'' April 6, 2005, 
Inside Bay Area, http://www.insidebayarea.com/searchresults/ci_2642564. 

    \6\ Opinion Page, Oakland Tribune, April 5, 2005.
---------------------------------------------------------------------------
    In the Sarbanes-Oxley Act, Congress recognized the importance of 
the ``tone at the top,'' and for that reason took steps to require the 
corporate boards and CEOs work to improve the quality and accuracy of 
audited financial statements. A strong, clear notice of security breach 
law, without exceptions, could similarly focus the attention of top 
management on information security--creating an incentive for a ``tone 
at the top'' to take steps to minimize or eliminate security breaches.
Security
    Consumers Union supports S. 500 and H.R. 1080, introduced by 
Senator Bill Nelson and Representative Ed Markey, respectively. These 
measures would direct the Federal Trade Commission (FTC) to promulgate 
strong standards for information security and a strong obligation to 
screen customers, both initially and with respect to how those 
customers further protect the information from unauthorized use. They 
also provide for ongoing compliance monitoring by the FTC. S. 768, the 
Schumer-Nelson bill, contains similar provisions.
    If Congress wanted to take even stronger steps with respect to 
information brokers, it could require information brokers to undergo 
annual audits, paid for by the broker and performed by an independent 
auditor retained by the FTC, with specific authority in the FTC to 
require corrective action for security and customer screening 
weaknesses identified in the audit, as well as allowing the FTC to 
specify particular aspects of information security that should be 
included in each such audit.
    Any Federal information broker law must require strong protections 
in specific aspects of information security, as well as imposing a 
broad requirement that security in fact be effective and be monitored 
for ongoing effectiveness. Congress must determine the balance between 
the public interest in the protection of data and the business interest 
in the business of information brokering. Security breaches and the 
effects on consumers of the ongoing maintenance of files on most 
Americans by information brokers are issues too important to be 
delegated in full to any regulatory agency.
Access and Correction
    Two of the basic Fair Information Practices are the right to see 
and the right to correct information held about the consumer. S. 768, 
S. 500, and H.R. 1080 all address these issues. While the Fair Credit 
Reporting Act (FCRA) allows consumers to see and correct their credit 
reports, as defined by FCRA, consumers currently have no legal right to 
see the whole file held on them by an information broker such as 
ChoicePoint and Lexis-Nexis, even though the information in that file 
may have a profound effect on the consumer. There is also lack of 
clarity about what a consumer will be able to see even under the FCRA 
if the information broker has not yet made a report to a potential 
employer or landlord about that consumer.\7\
---------------------------------------------------------------------------
    \7\ Testimony of Evan Hendricks, Editor/Publisher, Privacy Times 
before the Senate Banking Committee, March 15, 2005, http://
banking.senate.gov/files/hendricks.pdf.
---------------------------------------------------------------------------
    Because the uses of information held by data brokers continue to 
grow and change, affecting consumers in myriad ways, consumers must be 
given the legal right to see all of the information data brokers hold 
on them, and to seek and win prompt correction of that information if 
it is in error.
Protection for SSNs
    The Social Security number (SSN) has become a de facto national 
identifier in a number of U.S. industries dealing with consumers. Some 
proposals for reform have emphasized consent to the use, sale, sharing 
or posting of Social Security numbers. Consumers Union believes that a 
consent approach will be less effective than a set of rules designed to 
reduce the collection and use of sensitive consumer information.
    Take, for example, an analogy from the recycling mantra: ``Reduce, 
reuse, recycle.'' Just as public policy to promote recycling first 
starts with ``reducing'' the use of materials that could end up in a 
landfill, so protection of sensitive, personal information should begin 
with reduction in the collection and use of such information. 
Restrictions on the use of the Social Security number must begin with 
restricting the initial collection of this number to only those 
transactions where the Social Security number is not only necessary, 
but also essential to facilitating the transaction requested by the 
consumer. The same is true for other identifying numbers or information 
that may be called upon as Social Security numbers are relied upon 
less.
    Consumers Union endorses these basic principles for an approach to 
Social Security numbers:

   Ban collection and use of SSNs by private entities or by 
        government except where necessary to a transaction and there is 
        no alternative identifier which will suffice.

   Ban sale, posting, or display of SSNs, including no sale of 
        credit header information containing SSNs. There is no 
        legitimate reason to post or display individuals' Social 
        Security numbers to the public.

   Ban sharing of SSNs, including between affiliates.

   Ban secondary use of SSNs, including within the company 
        which collected them.

   Out of the envelope: ban printing or encoding of SSNs on 
        government and private checks, statements, and the like

   Out of the wallet: ban use of the SSN for government or 
        private identifier, except for Social Security purposes. This 
        includes banning the use of the SSN, or a variation or part of 
        it, for government and private programs such as Medicare, 
        health insurance, driver's licenses or driver's records, and 
        military, student, or employee identification. Any provision 
        banning the printing of SSNs on identifying cards should also 
        prohibit encoding the same information on the card.

   Public records containing SSNs must be redacted before 
        posting.

   There should be no exceptions for regulated entities.

   There should be no exception for business-to-business use of 
        SSNs.

    Congress should also consider whether to impose the same type of 
``responsibility requirements'' on the collection, sale, use, sharing, 
display and posting of other information that could easily evolve into 
a substitute ``national identifier,'' including drivers license number, 
state non-driver information number, biometric information and cell 
phone numbers.
Creditor Identity Theft Prevention Obligations
    Information is stolen because it is valuable. A key part of that 
value is the ability to use the information to gain credit in someone 
else's name. That value exists only because credit granting 
institutions do not check the identity of applicants carefully enough 
to discover identity thieves before credit is granted.
    Financial institutions and other users of consumer credit reports 
and credit scores should be obligated to take affirmative steps to 
establish contact with the consumer before giving credit or allowing 
access to an account when there is an indicator of possible false 
application, account takeover or unauthorized use. The news reports of 
the credit card issued to Clifford J. Dawg, while humorous, illustrate 
a real problem--creditor eagerness to issue credit spurs inadequate 
review of the identity of the applicant.\8\ When the applicant is a 
dog, this might seem funny, but when the applicant is a thief, there 
are serious consequences for the integrity of the credit reporting 
system and for the consumer whose good name is being ruined.
---------------------------------------------------------------------------
    \8\ Both the news stories about Clifford J. Dawg and a thoughtful 
analysis of the larger problem of too lax identification standards 
applied by creditors is found in C. Hoofnagle, Putting Identity Theft 
on Ice: Freezing Credit Reports to Prevent Lending to Impostors, in 
Securing Privacy in the Information Age (forthcoming from Stanford 
University Press), http://papers.ssrn.com/sol3/
papers.cfm?abstract_id=650162.
---------------------------------------------------------------------------
    As new identifiers evolve, criminals will seek to gain access to 
and use those new identifiers. Thus, any approach to attacking identity 
theft must also impose obligations on those who make that theft 
possible--those who grant credit, goods, or services to imposters 
without taking careful steps to determine with whom they are dealing.
    At minimum, creditors should be required to actually contact the 
applicant to verify that he or she is the true source of an application 
for credit when certain triggering events occur. The triggering events 
should include any of the following circumstances:

   Incomplete match on Social Security number.
   Address mismatch between application and credit file.
   Erroneous or missing date of birth in application.
   Misspellings of name or other material information in 
        application.
   Other indicators as practices change.

    Under FACTA, the FTC and the Federal financial institution 
regulators are charged with developing a set of red flag ``guidelines'' 
to ``identify possible risks'' to customers or to the financial 
institution. However, FACTA stops with the identification of risks. It 
does not require that financial institutions do anything to address 
those risks once identified through the not-yet-released guidelines. 
The presence of a factor identified in the guidelines does not trigger 
a statutory obligation to take more care in determining the true 
identity of the applicant before granting credit. Congress should 
impose a plain, enforceable obligation for creditors to contact the 
consumer to verify that he or she has in fact sought credit when 
certain indicators of potential identity theft are present.
Control for Consumers Over Affiliate-Sharing, Use of Information, Use 
        of Credit Reports and Credit Scores
    Consumers are caught between the growth in the collection and 
secondary use of information about them on the one hand and the 
increasing sophistication of criminals in exploiting weaknesses in how 
that information is stored, transported, sold by brokers, shared 
between affiliates, and used to access credit files and credit scores.
    Identity theft has been fueled in part by information-sharing 
between and within companies, the existence of databases that consumers 
don't know about and can't stop their information from being part of, 
the secondary use of information, and the granting of credit based on a 
check of the consumer credit file or credit score without efforts to 
verify the identity of the applicant.\9\ Consumers Union has 
consistently supported Federal and State efforts to give consumers the 
legal right to stop the sharing of their sensitive, personal 
information among affiliates. Finally, it is essential to stopping the 
spread of numbers that serve as consumer identifiers that Congress and 
the States impose strong restrictions on the use of sensitive, personal 
information for purposes other than the purpose for which the consumer 
originally provided that information.
---------------------------------------------------------------------------
    \9\ Secondary use is use for a purpose other than the purpose for 
which the consumer gave the information.
---------------------------------------------------------------------------
Fix FACTA
    FACTA has made some things more difficult for identity theft 
victims, according to information provided to Consumers Union by 
nonprofits and professionals who assist identity theft victims. 
Moreover, FACTA gives only limited rights to those who have not yet 
become victims of identity theft, and FACTA fails to offer a pure 
prevention tool for all consumers. A consumer who asserts in good faith 
that he or she is about to become a victim of identity theft gets one 
right under FACTA--the right to place, or renew, a 90 day fraud alert. 
However, this type of alert places lower obligations on the potential 
creditor than the extended alert, which is restricted only to identity 
theft victims.
    A consumer should be able to access more of his or her FACTA 
rights, such as the extended fraud alert, before becoming an identity 
theft victim. One key FACTA right is tied to a police report, which 
victims still report difficulty in getting and using.
    Here are some key ways to make FACTA work for victims:

   Initial fraud alert should be one year, not 90 days.

   Extended alert and other victims' rights, other than 
        blocking of information, should be available to all identity 
        theft victims who fill out the FTC ID theft affidavit under 
        penalty of perjury.

   Business records should be available to any consumer who 
        fills out the FTC ID theft affidavit under penalty of perjury.

   Consumers who receive a notice of security breach should be 
        entitled to place an extended fraud alert.

   Consumers who place a fraud alert have the right under FACTA 
        to a free credit report, but this should be made automatic.

    There is also work to do outside of FACTA, including work to 
develop a police report that could be given to victims that is 
sufficiently similar, if not uniform, across jurisdictions, so that the 
victim does not find creditors or businesses in another jurisdiction 
refusing to accept a police report from the victim's home jurisdiction.
Congress Must Encourage the States To Continue To Pioneer Prompt 
        Responses to Identity Crime
    Virtually every idea on the table today in the national debate 
about stemming identity theft and protecting consumer privacy comes 
from legislation already enacted by a state. Congress must not cut off 
this source of progress and innovation. Instead, any identity theft and 
consumer privacy legislation in Congress should expressly permit states 
to continue to enact new rights, obligations, and remedies in 
connection with identity theft and consumer privacy to the full extent 
that the State requirements are not inconsistent with the specific 
requirements of Federal law.
    Criminals will always be more fast-acting, and fast-adapting, than 
the Federal Government. An important response to this reality is to 
permit, and indeed encourage, State legislatures to continue to act in 
the areas of identity theft and consumer privacy. Fast-acting states 
can respond to emerging practices that can harm consumers while those 
practices are still regional, before they spread nationwide. For 
example, California enacted its notice of security breach law and other 
significant identity theft protections because identity theft was a 
significant problem in California well before it became, or at least 
was recognized as, a national crime wave.
    Identity theft illustrates how much quicker states act on consumer 
issues than Congress. According to numbers released by the FTC, there 
were 9.9 million annual U.S. victims of identity theft in the year 
before Congress adopted the relatively modest rights for identity theft 
victims found in FACTA. The identity theft provisions adopted by 
Congress in FACTA were modeled on laws already enacted in states such 
as California, Connecticut, Louisiana, Texas, and Virginia.\10\
---------------------------------------------------------------------------
    \10\ See California Civil Code Sec. Sec. 1785.11.1, 1785.11.2, 
1785,16.1; Conn. SB 688 Sec. 9(d), (e), Conn. Gen. Stats. Sec. 36a-699; 
IL Re. Stat. Ch. 505 Sec. 2MM; LA Rev. Stat. Sec. Sec. 9:3568B.1, 
9:3568C, 9:3568D, 9:3571.1 (H)-(L); Tex. Bus. & Comm. Code 
Sec. Sec. 20.01(7), 20.031, 20.034-039, 20.04; VA Code Sec. Sec. 18.2-
186.31:E. The role of the states has also been important in financial 
issues unrelated to identity theft. Here are two examples. In 1986, 
California required that specific information be included in credit 
card solicitations with enactment of the then-titled Areias-Robbins 
Credit Card Full Disclosure Act of 1986. That statute required that 
every credit card solicitation to contain a chart showing the interest 
rate, grace period, and annual fee. 1986 Cal. Stats., Ch. 1397, 
codified at California Civil Code Sec. 1748.11. Two years later, 
Congress chose to adopt the same concept in the Federal Fair Credit and 
Charge Card Disclosure Act (FCCCDA), setting standards for credit card 
solicitations, applications, and renewals. P. L. 100-583, 102 Stat. 
2960 (Nov. 1, 1988), codified in part at 15 U.S.C. Sec. Sec. 1637(c) 
and 1610(e). The implementing changes to Federal Regulation Z included 
a model form for the Federal disclosure box which is quite similar to 
the form required under the pioneering California statute. 54 Fed. Reg. 
13855, Appendix G.
---------------------------------------------------------------------------
Strong and Broadly-Based Enforcement
    Consumers need effective enforcement of those obligations and 
restrictions Congress imposes in response to the increasing threats to 
consumer privacy, and of the growth of identity theft. A diversity of 
approaches strengthens enforcement. Each statutory obligation imposed 
by Congress should be enforceable by Federal agencies, the Federal law 
enforcement structure with the Attorney General and U.S. Attorneys, and 
State attorneys general. Where a state is structured so that part of 
the job of protecting the public devolves to a local entity, such as a 
district attorney or city attorney, those local entities also should be 
empowered to enforce anti-identity theft and privacy measures in local 
civil or, where appropriate, criminal courts.
    There is also a role for a private right-of-action. It is an 
unfortunate reality in identity theft is that law enforcement resources 
are slim relative to the size of the problem. This makes it 
particularly important that individuals be given a private right-of-
action to enforce the obligations owed to them by others who hold their 
information. A private right-of-action is an important part of any 
enforcement matrix.
Money and Tools for Law Enforcement
    Even if all the recommended steps are taken, U.S. consumers will 
still need vigorous, well-funded law enforcement. At a meeting convened 
by Senator Feinstein which included some twenty representatives of law 
enforcement, including police departments, sheriffs, and district 
attorneys, law enforcement uniformly proposed that they be given tools 
to more effectively investigate identity theft. Law enforcement costs 
money, and the law enforcers noted that the multi-jurisdictional nature 
of identify theft increases the costs and time, it takes to investigate 
these crimes.
    Law enforcers in California and Oregon have noted a strong link 
between identity theft crime and methamphetamine. The Riverside County 
Sheriff noted at a March 29, 2005 event that when drug officers close a 
methamphetamine lab, they often find boxes of fake identification ready 
for use in identity theft. The drug team has closed the lab; without 
funding for training and ongoing officer time, there may be no 
investigation of those boxes of identities.
    To prove a charge of attempted identity theft, a prosecutor may 
need to prove that the real person holding a particular driver's 
license number, credit or debit card number, or Social Security number 
is different from the holder of the fake ID. Doing this may require the 
cooperation of a State Department of Motor Vehicles, a financial 
institution, or the Social Security Administration. The public meetings 
of the California High Tech Crimes Advisory Committee have including 
discussion of the difficulties and time delays law enforcement 
investigators encounter in trying to obtain this cooperation. Congress 
should work with law enforcement and groups representing interest in 
civil liberties to craft a solution to verifying victim identity that 
will facilitate investigation of identity theft without infringing on 
the individual privacy of identity theft victims and other individuals.
    Law enforcement may have more specific proposals to enhance their 
effectiveness in fighting identity theft. Consumers Union generally 
supports:

   Funding for regional identity theft law enforcement task 
        forces in highest areas of concentration of victims, and of 
        identity thieves.

   Funding for investigation and prosecution.

   An obligation on creditors, financial institutions, and the 
        Social Security Administration to provide information about 
        suspected theft-related accounts or numbers to local, State, 
        and Federal law enforcement after a simple, well designed, 
        request process.

    Consumers Union believes that the time has come for both Congress 
and State legislatures to act to stem identity theft through strong and 
meaningful requirements to tell consumers of security breaches; strong 
and detailed security standards and oversight for information brokers, 
reining in the use of Social Security numbers, increased control for 
consumers over the uses of their information, and obligations on 
creditors to end their role in facilitating identity theft through lack 
of care in credit granting. This should be done without infringing on 
the role of the states, with attention to the need to fund law 
enforcement to fight identity theft, and with attention to the need for 
private enforcement by consumers. We look forward to working with the 
Chair and Members of the Committee, and others in Congress, to 
accomplish these changes for U.S. consumers. These recommendations by 
Consumers Union have been informed by the work of victim assistance 
groups, privacy advocates, and others. \11\
---------------------------------------------------------------------------
    \11\ Many law enforcers, victim assistance workers, and consumer 
and privacy advocates were engaged in the issue of identity theft 
prevention long before the most recent ChoicePoint security breach came 
to light. Consumers Union has worked closely for many years on efforts 
to fight identity theft and protect consumer financial privacy with 
other national groups, and with consumer privacy and anti-identity 
theft advocates and victim assistance groups based in California. Our 
views and recommendations are strongly informed by the experiences of 
consumers reported to us by the nonprofit Privacy Rights Clearinghouse, 
the nonprofit Identity Theft Resource Center, and others who work 
directly with identity theft victims. These groups have worked to 
develop the State laws that are the basis for many of the proposals now 
being introduced in Congress. Consumers Union is grateful for the 
leadership of the Privacy Rights Clearinghouse in consumer privacy 
policy work, the work of the State PIRGs and U.S. PIRG on consumer 
identity theft rights which includes the preparation of a model State 
identity theft statute in cooperation with Consumers Union, for the 
work for consumers on the accuracy of consumer credit reporting issues 
done over the past decade by the Consumer Federation of America and 
U.S. PIRG, and for the contributions to the policy debate of 
organizations such as the Electronic Privacy Information Center, 
Privacy Times, and others too numerous to mention.
---------------------------------------------------------------------------

                      Consumer Reports, June 2005

                    The Fight Against Identity Theft

                        by Jim Guest, President

    ``I was mugged once, years ago,'' one of our editorial researchers 
told me. ``It was bad, but at least that guy had the guts to look me in 
the eye.'' This time, she'd gotten a call from her bank alerting her 
that someone in Oregon had just withdrawn $2,000 from her account. 
Since she and her husband were both at home in New York, that was very 
bad news.
    Like many of the estimated 10 million people a year whose lives and 
accounts are invaded by identity thieves, our staffer had been as 
cautious as she could be and still be part of today's marketplace. But 
either her financial records were leaked or a hacker typed his or her 
way through the barriers protecting her account.
    In either case, companies who hold sensitive, personal and 
financial information about us, and the lawmakers who should be 
overseeing them, are failing to build stronger protections against the 
increasingly prevalent crime of ID theft. Lawmakers and regulators must 
work fast. Here are three things that Consumers Union, the publisher of 
Consumer Reports, is pushing them to do:

   Oversee information brokers, companies that collect and sell 
        people's personal and financial data. Federal law should 
        require them to safeguard those data, sell data only to 
        carefully screened clients, tell consumers what's in their 
        files, and correct mistakes promptly, since mistakes can lose 
        you a job, a mortgage, or an insurance policy.

   Pass strong Federal and State laws that require companies to 
        notify the consumers whose personal and financial information 
        they hold when their privacy is compromised. Now, only 
        California residents have that protection.

   Pass laws in every state allowing consumers to ``freeze'' 
        their credit-bureau files. With a security freeze in place, 
        your credit report and score can't be given to potential new 
        creditors unless you choose to ``unlock'' the file when you 
        apply for, say, a car loan. Most businesses won't issue new 
        credit or loans without first checking credit records. This 
        way, thieves will hit a brick wall trying to open an account in 
        your name.

    There's no single solution to shielding consumers from the fast-
changing schemes of ID thieves, so Congress should preserve the right 
of States to continue developing ever more sophisticated guards. For 
more about what CU is doing, and for what you can do to protect 
yourself, go to our websites www.consumersunion.org/privacy and 
www.consumersunion.org/money.
                                 ______
                                 
Statement of James X. Dempsey, Executive Director, Center for Democracy 
 & Technology,\1\ before the Senate Committee on the Judiciary, April 
                                13, 2005
---------------------------------------------------------------------------
    \1\ The Center for Democracy & Technology (CDT) is a non-profit 
public interest organization dedicated to promoting privacy and other 
democratic values for the new digital communications media. Among other 
activities, CDT coordinates the Digital Privacy and Security Working 
Group (DPSWG), a forum for computer, communications, and public 
interest organizations, companies and associations interested in 
information privacy and security issues.
---------------------------------------------------------------------------
 Securing Electronic Personal Data: Striking a Balance Between Privacy 
                  and Commercial and Governmental Use
    Chairman Specter, Senator Leahy, and Members of the Committee, 
thank you for the opportunity to testify today. Recent security 
breaches at a range of companies and institutions resulting in the loss 
of sensitive, personal information have highlighted the need for a more 
substantial legal framework at the national level for entities 
collecting, using and selling personal data. A range of harms, 
including identity theft, can flow from the failure to protect 
electronic personal data and from governmental or corporate misuse of 
data or reliance on inaccurate data. We offer here today an overview of 
the policy landscape and suggest some approaches that Congress should 
consider to ensure the appropriate level of security and privacy 
protection. We look forward to working with you and interested 
stakeholders to achieve balanced solutions.
The New Marketplace for Personal Data
    In the past decade, the commercial collection and sale of personal 
information has changed dramatically, driven by a combination of 
factors, facilitated by the Internet, and resulting in an ever more 
rapid flow of sensitive, personal information in ways that most 
consumers barely understand. The implications for commerce, national 
security and personal privacy have been detailed in recent books such 
as Robert O'Harrow's ``No Place to Hide.''
    The private sector and the Federal Government have many legitimate 
needs for personal information, and the sharing of data offers benefits 
to consumers in the form of readily available credit. Businesses and 
non-profit entities, ranging from landlords to retailers, to lawyers, 
to universities, obtain and share personal information to provide 
services and facilitate economic transactions. Indeed, an important use 
of commercial data services is for anti-fraud purposes, including the 
prevention of identity theft. The Federal Government uses personal 
information to determine eligibility for government benefits, to 
support law enforcement, and to fight the war on terror.
    An important category of this information is drawn from public 
records at courthouses and other government agencies. Data brokers (we 
use the term throughout our testimony for lack of a better one, without 
intending to be derogatory and recognizing that it is not well-defined) 
add considerable value by aggregating and categorizing this information 
to provide a more complete picture of the individuals to whom it 
pertains.
    While data brokers provide important services to the government and 
the private sector, they also raise a host of privacy issues and 
concerns about the security of this information. The recent security 
breaches at ChoicePoint and LexisNexis have prompted calls for 
examination of this new industry. Already-regulated entities, such as 
Bank of America, have also lost control of sensitive, personal 
information. So have merchants whose primary business is not data 
aggregation. DSW Shoe Warehouse, a chain of shoe retailers, announced 
recently that someone had stolen customers' credit card information 
from its database. And the New York Times reported that already this 
year nine universities have reported the loss or compromise of 
sensitive, personal information.\2\ Precisely because databases of 
electronic personal data have tremendous value, they are attracting 
identity thieves.
---------------------------------------------------------------------------
    \2\ Tom Zeller, Jr., Some Colleges Falling Short In Data Security, 
New York Times, Apr. 4, 2005, at B1.
---------------------------------------------------------------------------
    Even legitimate uses of personal data can result in harm to 
individuals. For instance, individuals can suffer adverse consequences 
when data brokers sell inaccurate or incomplete information that 
results in the loss of employment opportunities. In the context of 
government use of personal information, adverse consequences could 
include being suspected of criminal or terrorist activity.
    Congress has addressed privacy and security issues with respect to 
credit reporting agencies in the Fair Credit Reporting Act (FCRA), 
financial institutions in Gramm-Leach-Bliley (GLB), and healthcare 
providers in the Health Insurance Portability and Accountability Act 
(HIPAA). But Congress's sectoral approach to information privacy has 
left gaps in the coverage of the law.
Overview of Policy Responses
    We see at least five sets of issues facing Congress at this time:

        1. As a first step towards preventing identity theft, entities, 
        including government entities, holding personal data should be 
        required to notify individuals in the event of a security 
        breach.

        2. Since notice only kicks in after a breach has occurred, 
        Congress should require entities that electronically store 
        personal information to implement security safeguards, similar 
        to those required by California AB 1950 and the regulations 
        under Gramm-Leach-Bliley.

        3. Congress should impose tighter controls on the sale, 
        disclosure and use of Social Security numbers and should seek 
        to break the habit of using the SSN as an authenticator.

        4. Congress should address the Federal Government's growing use 
        of commercial databases, especially in the law enforcement and 
        national security contexts.

        5. Finally, Congress should examinee the ``Fair Information 
        Practices'' that have helped define privacy in the credit and 
        financial sectors and adapt them as appropriate to the data 
        flows of this new technological and economic landscape.

What Is Privacy?
    Information privacy is not merely about keeping personal 
information confidential. Rather, it is well established by United 
States Supreme Court cases, the Federal Privacy Act, and privacy laws 
like the FCRA and HIPAA that the concept of privacy extends to 
information that an individual has disclosed to another in the course 
of a commercial or governmental transaction and even to data that is 
publicly available.\3\ Information privacy is about control, fairness, 
and consequences. Data privacy laws limit the use of widely available, 
and even public, information because it is recognized that individuals 
should retain some control over the use of information about themselves 
and should have redress to the consequences that result from others' 
use of that information. A set of commonly accepted ``Fair Information 
Practices'' captures this broader conception of privacy and is 
reflected, albeit in piecemeal fashion, in the various privacy laws and 
in the practices of commercial entities and government agencies. These 
principles govern not just the initial collection of data, but also the 
use of information collected and shared in the course of governmental 
and commercial transactions.
---------------------------------------------------------------------------
    \3\ In United States Department of Justice v. Reporters Committee 
for Freedom of the Press, 489 U.S. 749, 762-63 (1989), the Supreme 
Court rejected the ``cramped notion of personal privacy''that ``because 
events . . . have been previously disclosed to the public, . . . [the] 
privacy interest in avoiding disclosure of a . . . compilation of these 
events approaches zero.'' The Court held in that case that the 
government can withhold from public disclosure databases composed 
entirely of publicly available data because there is a ``distinction, 
in terms of personal privacy, between scattered disclosure of the bits 
of information . . . and revelation of the [information] as a whole.'' 
The Court based its ruling on the conclusion that, ``Plainly there is a 
vast difference between the public records that might be found after a 
diligent search of courthouse files, county archives, and local police 
stations throughout the country and a computerized summary located in a 
single clearinghouse of information.'' 489 U.S. at 764. The Court 
rejected the notion that an individual has no privacy interest in data 
that is publicly available somewhere. See id. at 770 (``In sum, the 
fact that an event is not wholly `private' does not mean that an 
individual has no interests in limiting disclosure or dissemination of 
the information.'' (quotation omitted)). See also Reno v. Condon, 528 
U.S. 141, 148 (2000) (upholding Federal statute restricting States' 
sale of driver's license information to commercial entities even though 
the information was available to the public for a range of purposes).
---------------------------------------------------------------------------
    The ``Fair Information Practices'' were first articulated in the 
1970s and have been embodied in varying degrees in the Privacy Act, the 
FCRA, and the other ``sectoral'' Federal privacy laws that govern 
commercial uses of information. The concept of Fair Information 
Practices (FIPs) has remained remarkably relevant despite the dramatic 
changes in information technology that have occurred since they were 
first developed. While mapping these principles to the current data 
landscape poses challenges, and while some of the principles may be 
inapplicable to public record data, they provide a remarkably sound 
basis for analyzing the issues associated with creating a policy 
framework for the privacy of commercial databases.
    The FIPs principles are variously enumerated, but we see eight: (1) 
notice to individuals of the collection of personally identifiable 
information, (2) limits on use and disclosure of data for purposes 
other than those for which the data was collected in the first place, 
(3) limitations on the retention of data, (4) a requirement to ensure 
the accuracy, completeness and timeliness of information, (5) the right 
of individuals to access information about themselves, (6) the 
opportunity to correct information or to challenge decisions made on 
the basis of incorrect data, (7) appropriate security measures to 
protect the information against abuse or unauthorized disclosure, and 
(8) the establishment of redress mechanisms for individuals wrongly and 
adversely affected by the use of personally identifiable 
information.\4\
---------------------------------------------------------------------------
    \4\ http://www.cdt.org/privacy/guide/basic/generic.html.
---------------------------------------------------------------------------
    A lot more work would be needed to develop a regulatory framework 
imposing all of these principles on all entities that hold or use 
personally identifiable data. Nevertheless, these principles do provide 
a framework for analyzing the current situation. They suggest certain 
immediate steps that Congress could take.
Notice of Breach
    As a first step, there should be a national requirement that 
individuals be notified when their information held by a third party is 
obtained by an unauthorized user. CDT would support appropriate Federal 
legislation modeled on the California disclosure law that would require 
holders of sensitive, personal information to notify people whose 
information might have been stolen or otherwise obtained by 
unauthorized persons.\5\ Some industry leaders have also supported 
Federal notice legislation, as did the Chairman of the Federal Trade 
Commission at earlier Congressional hearings.
---------------------------------------------------------------------------
    \5\ The California law states that any agency or business ``that 
owns or licenses computerized data that includes personal information 
shall disclose any breach of the security of the system following 
discovery or notification of the breach in the security of the data to 
any resident of California whose unencrypted personal information was, 
or is reasonably believed to have been, acquired by an unauthorized 
person.'' Cal. Civ. Code Sec. 1798.29(a), Sec. 1798.82(a).
---------------------------------------------------------------------------
    The California law worked well after the ChoicePoint security 
breach. As a result of the California law, ChoicePoint was required to 
notify individuals so they could take protective action. And public 
pressure led ChoicePoint to give nationwide notice. California is 
currently the only state with such a law on the books, but other states 
are currently considering similar legislation. Congress should enact 
Federal legislation that is as protective as the California statute.
    There has been some debate about when entities should be required 
to give notice of a breach. Some have argued that the holder of the 
information should be allowed to exercise discretion in determining 
whether the breach is one that poses a significant risk of harm to 
individuals. Concern has been expressed that if consumers are notified 
of every security breach, they would receive too many notices and 
become immune to them. While the risk of over-notification is real, 
guidance issued by the State of California on its disclosure law seems 
to address concerns about over-notification. An appropriate standard 
might be to require entities that discover a breach of security of a 
system containing unencrypted personally identifiable data in 
electronic form to notify any U.S. resident whose data was, or is 
reasonably believed to have been, acquired by an unauthorized person. 
If the entity is not certain whether the breach warrants notification, 
it should be able to consult with the Federal Trade Commission. This 
would allow the entities to avoid giving notice in the case of 
accidental unauthorized access that does not pose a risk of harm to the 
public, while ensuring that the public is adequately protected in those 
cases where data has been acquired unlawfully. Additionally, it may be 
desirable to have a two-tiered system, with notice to the FTC of all 
breaches of personal data and notice to consumers where there is a 
potential risk of identity theft. Broader notice to the FTC would help 
with oversight and would allow for adjustment in reporting thresholds.
    Notice alone, however, is not enough. Consideration needs to be 
given to the question of what options a consumer has after receiving 
notice of a breach. Consumers can require a fraud alert on their credit 
reports, but under current law that has to be renewed every 90 days 
unless the individual is actually the victim of identity theft, in 
which case he is entitled to a 7 year notice. Another approach is to 
give consumers the ability to ``freeze'' their credit reports, blocking 
their release and thus preventing the issuance of credit. Texas and 
California currently allow credit report freezes, and Vermont and 
Louisiana freeze legislation is supposed to take effect this summer. At 
least 15 other states are considering similar legislation. \6\ Another 
way to allocate risk may be to create a ``Do Not Issue Credit without 
Verification List,'' allowing consumers to post a warning to creditors 
to obtain additional identity verification before issuing credit. This 
would not be a freeze, but would put creditors on alert that they need 
to be careful.
---------------------------------------------------------------------------
    \6\ Andrew Shain, ``Nation, N.C. address ID security breaches,'' 
Charlotte Observer, Mar. 24, 2005, http://www.charlotte.com/mld/
charlotte/11215774.htm.
---------------------------------------------------------------------------
Security of Personally Identifiable Information
    While notice legislation would be helpful in mitigating the damage 
from a security breach and might prod companies to improve security 
proactively, Congress should enact legislation requiring commercial 
entities that hold personal information to implement information 
security programs. Already there is a patchwork of requirements. 
Financial institutions are already subject to information security 
requirements under Gramm-Leach-Bliley, \7\ and the Health Insurance 
Portability and Accountability Act imposes similar requirements on 
health care providers and insurers, \8\ the Sarbanes-Oxley legislation 
also has a provision that is interpreted as imposing some kind of data 
security obligation. The Federal Trade Commission has exercised its 
Section 5 authority and obtained consent agreements with a number of 
companies that are looked to as models. And the California law known as 
AB 1950 has imposed a general data security obligation on companies 
doing business there.
---------------------------------------------------------------------------
    \7\ 15 U.S.C. Sec. 6801(b).
    \8\ Pub. L. 104-191, Sec. 264.
---------------------------------------------------------------------------
    It is probably time to bring some uniformity to these requirements. 
The Federal Trade Commission regulations implementing Gramm-Leach-
Bliley provide a good framework and probably have about the right level 
of detail for security programs for data brokers and other commercial 
entities.\9\ They require an entity to develop, implement and maintain 
a comprehensive information security program that contains 
administrative, technical and physical safeguards that are tailored to 
the size and nature of the entity. Among other elements of a security 
program, they require entities that hold personal information to 
conduct a risk assessment to identify and develop systems to protect 
against anticipated threats and unauthorized access to information, to 
train employees, to audit their systems to identify unauthorized 
access, and to periodically reassess the program's effectiveness. 
Otherwise, the FTC approach gives entities that collect and store 
personal information the flexibility to develop security programs that 
fit their business models.
---------------------------------------------------------------------------
    \9\ See Standards For Safeguarding Customer Information, 16 C.F.R. 
Sec. Sec. 314.1-.5 (2005).
---------------------------------------------------------------------------
Social Security Number Protection
    Personal privacy is not just threatened by ineffective or 
nonexistent information security systems, however. Another threat to 
personal privacy is the proliferation and misuse of Social Security 
numbers. When the Federal Government first issued Social Security 
numbers in 1936, it limited their use to identifying accounts for 
workers with earnings from jobs covered by the Social Security Act of 
1935. Social Security numbers were not supposed to serve as the 
universal identifiers that they have become. In fact, they were 
initially called Social Security Account Numbers and for many years the 
words ``Not For Identification''appeared on Social Security cards.\10\ 
Over time, however, Social Security numbers have become de facto 
national identifiers, serving as the key that unlocks many databases 
containing medical records, university records, employee files and bank 
records, just to name a few.
---------------------------------------------------------------------------
    \10\ www.epic.org/privacy/hew1973report/c7.htm
---------------------------------------------------------------------------
    Worse, the SSN is used as an authenticator. That is, it is used 
like a PIN number--even though SSNs are widely available, entities 
treat them as if they were a secret and that therefore someone is you 
if he knows your SSN. This is very poor security practice. As a result, 
Social Security numbers are a major factor in identity theft.
    CDT supports legislation that would tighten controls on the sale, 
purchase and display of Social Security numbers. Given the ubiquity of 
Social Security numbers in the public domain, it might not be possible 
to prevent criminals from acquiring them, but that does not mean we 
should give up trying to curtail the SSN's overuse and misuse. We 
believe that this can be done without prohibiting the use of the SSN as 
an identifier or disambiguator in large databases. Certainly, the SSN 
should be phased out as a student or employee ID number reflected on ID 
cards, transcripts and other records disclosed outside an institution. 
Congress should also, where feasible, limit the use of Social Security 
numbers by government entities. In particular, states should be 
prohibited from using Social Security numbers on drivers' licenses.
    These changes will have limited effect, however, unless it is also 
recognized that it is poor security practice to use the SSN as an 
authenticator--treating it like a password or an obscure bit of 
information likely to be known only to the one person to whom it was 
issued. The habit of relying on the SSN for verification of identity 
needs to be broken.\11\
---------------------------------------------------------------------------
    \11\ The habit of relying blindly on the SSN as an identifier also 
needs to be broken. See Lesley Mitchell, ``New wrinkle in ID theft; 
Thieves pair your SS number with their name, buy with credit, never get 
caught; Social Security numbers a new tool for thieves,'' The Salt Lake 
Tribune, June 6, 2004, at E1.
---------------------------------------------------------------------------
Government Use of Commercial Databases
    An often overlooked but very important issue is the Federal 
Government's use of commercial databases. As discussed earlier, the 
government uses commercial data for law enforcement and national 
security purposes. The Privacy Act of 1974 was supposed to subject 
government agencies that collect personally identifiable information to 
the Fair Information Practices, but the Act's protections only apply to 
Federal ``systems of records.'' \12\ That means that the government can 
bypass the Privacy Act by accessing existing private sector databases, 
rather than collecting the information itself. Thus, although the 
Privacy Act requires notice to and consent from individuals when the 
government collects and shares information about them, gives citizens 
the right to see whatever information the government has about them, 
and holds government databases to certain accuracy standards, none of 
those rules applies when the government accesses commercial information 
without pulling that data into a government database. Currently, the 
government need not ensure (or even evaluate) the accuracy of the data; 
it need not allow individuals to review and correct the data; and the 
government is not limited in how it interprets or characterizes the 
data.
---------------------------------------------------------------------------
    \12\ The term ``system of records'' is defined as ``a group of any 
records under the control of any agency from which information is 
retrieved by the name of the individual or by some identifying number, 
symbol, or other identifying particular assigned to the individual.'' 5 
U.S.C. Sec. 552a(a).
---------------------------------------------------------------------------
    Commercial information can and should play a key role in law 
enforcement and national security investigations. But agencies relying 
on that data should have clear guidelines for its use--guidelines that 
both protect individual rights and ensure the information is useful for 
investigative purposes.
    One option would be to make it clear that the Privacy Act applies 
whether the government is creating its own database or acquiring access 
to a database from a commercial entity. Also, Congress could apply the 
concept of Privacy Impact Assessments to the acquisition of commercial 
databases. Section 208 of the E-Government Act of 2002 already requires 
a PIA if the government initiates a new ``collection'' of 
information.\13\ The same process should apply when the government 
acquires access to a commercial database containing the same type of 
information that would be covered if the government itself were 
collecting it.
---------------------------------------------------------------------------
    \13\ E-Government Act of 1002, Pub. L. 107-347, Sec. 208(b)(1). 
Under the E-Government Act, an agency is required to perform a privacy 
impact assessment before it ``develop[s] or procure[s] information 
technology that collects, maintains, or disseminates information that 
is in an identifiable form'' or ``initiat[es] a new collection of 
information. . . .'' Sec. 208(b)(1)(A). A privacy impact assessment is 
required to address, ``(I) what information is collected; (II) why the 
information is being collected; (III) the intended use of the agency of 
the information; (IV) with whom the information will be shared; (V) 
what notice or opportunities for consent would be provided to 
individuals regarding what information is collected and how that 
information is shared; (VI) how the information will be secured; and 
(VII) whether a system of records is being created under'' the Privacy 
Act. Sec. 208(b)(2)(B).
---------------------------------------------------------------------------
    Another approach, based on a bill that Senator Wyden introduced in 
the last Congress,\14\ would be to require the government to perform an 
accounting of private sector databases before using them. Under the 
Wyden proposal, a government agency that acquired access to databases 
containing personally identifiable information concerning U.S. citizens 
would be required to publish in the Federal Register a description of 
the database, the name of the entity from which the agency obtained the 
database and the amount of the contract for use of the database. In 
addition, the agency would be required to adopt regulations that 
establish
---------------------------------------------------------------------------
    \14\ S. 1484, 108th Cong. (1st Sess. 2003).

   the personnel permitted to access, analyze or otherwise use 
---------------------------------------------------------------------------
        the database;

   standards that govern the access to and analysis and use of 
        such information;

   standards to ensure that personal information accessed, 
        analyzed and used is the minimum necessary to accomplish the 
        government's goals;

   standards to limit the retention and re-disclosure of 
        information obtained from the database;

   procedures to ensure that such data is accurate, relevant, 
        complete and timely;

   auditing and security measures to protect against 
        unauthorized access to or analysis, use or modification of data 
        in the database;

   applicable mechanisms that individuals may use to secure 
        timely redress for any adverse consequences wrongly experienced 
        due to the access, analysis or use of such database;

   mechanisms, if any, for the enforcement and independent 
        oversight of existing or planned procedures, policies or 
        guidelines; and

   an outline of enforcement mechanisms for accountability to 
        protect individuals and the public against unlawful or 
        unauthorized access to or use of the database.

    Agencies might also incorporate into their contract with commercial 
entities provisions that provide for penalties when the commercial 
entity sells information to the agency that the commercial entity 
knows, or should know, is inaccurate or when the commercial entity 
fails to inform the agency of corrections or changes to data in the 
database.
    The Intelligence Reform Act that Congress passed last December 
established guidelines for the government's evaluation of Secure Flight 
plans that suggest a broader framework for use of data.\15\ Congress 
could adopt similar guidelines for government agencies to follow before 
implementing any screening program that uses commercially available 
data. As an initial matter, all government screening programs should be 
Congressionally authorized. This would ensure some degree of public 
accountability and Congressional oversight. In addition, all screening 
programs should be subject to regulations that include, at a minimum, 
the following elements:
---------------------------------------------------------------------------
    \15\ Intelligence Reform and Terrorism Prevention Act of 2004, Pub. 
L. 108-458, Sec. 4012(a).

   procedures to enable individuals, who suffer an adverse 
        consequence because the system determined that they might pose 
        a security threat, to appeal the determination and correct any 
---------------------------------------------------------------------------
        inaccurate data;

   procedures to ensure that the databases the government uses 
        to establish the identity of individuals or otherwise make 
        assessments about individuals will not produce a large number 
        of false positives or unjustified adverse consequences;

   procedures to ensure that the search tools that the 
        department or agency will use are accurate and effective and 
        will allow the department or agency to make an accurate 
        prediction of who may pose a security threat; \16\
---------------------------------------------------------------------------
    \16\ This provision is drawn from the Department of Homeland 
Security Appropriations Act, 2005, Pub. L. 108-334, Sec. 552.

   sufficient operational safeguards to reduce the chance for 
---------------------------------------------------------------------------
        abuse of the system;

   substantial security measures to protect the system against 
        unauthorized access;

   policies that establish effective oversight of the use and 
        operation of the system; and

   procedures to ensure that the technological architecture of 
        the system does not pose any privacy concerns.

    These approaches, all of which Congress has previously approved in 
similar contexts, strike a balance between the government's need for 
information and the privacy interests of individuals. Adapting the 
Privacy Act and Fair Information Principles to government uses of 
commercial databases would go a long way toward closing the unintended 
gap in privacy protection that exists under the current law.
Regulation of Data Brokers
    Finally, Congress should consider whether there are gaps in the 
current sectoral laws that protect privacy and focus on the harms that 
can flow from use of inaccurate or misleading information. This is not 
about use of marketing data to send catalogues or sales offers. Rather, 
in the context where adverse consequences can result, Congress should 
apply to data brokers the Fair Information Practices that are the 
framework of the Fair Credit Reporting Act and other privacy laws.
    As the law stands now, these Fair Information Practices apply only 
when data brokers collect and use information in a way that is governed 
by the Fair Credit Reporting Act. For instance, if a data broker sells 
personal information to a third party that uses the information to 
determine eligibility for insurance, the Fair Credit Reporting Act 
would apply and certain rights would attach to the individual to whom 
the information pertains. The individual would be able to obtain a copy 
of the report, challenge the accuracy of the data and correct any 
inaccurate information. The ability to do this is particularly 
important when a person can suffer adverse consequences--such as the 
denial of insurance--from the use of the personal information. But if 
the data broker sold that same information to an insurance company for 
use in claims processing--in which case the individual might be denied 
reimbursement under her insurance policy--the individual would not have 
any of those same rights.\17\
---------------------------------------------------------------------------
    \17\ Michael Hiltzik, Data Show Information Collector Can't Be 
Trusted, Los Angeles Times, Mar. 3, 2005, at C1.
---------------------------------------------------------------------------
    We note that Derek Smith, the Chairman and CEO of ChoicePoint, last 
year called for a national dialogue on privacy, to develop a policy 
framework for his companies and others. Specifically, Smith called for 
expanding the principles reflected in the FCRA:

        ``We should agree that the consensual model is best to the 
        maximum degree possible, understanding that law enforcement and 
        national security uses may outweigh getting prior consent for 
        certain information. By this I mean that individuals should 
        give permission (or not) at the time information is gathered 
        and should agree to its use. Data should not be used for a 
        different purpose unless new permission is obtained. However, 
        we must recognize that public record data is, fundamentally, 
        just that--public--and does not fit within the consensual model 
        because of the current local, State, and Federal freedom of 
        information acts.

        Everyone should have a right of access to data that is used to 
        make decisions about them--subject to the same caveats about 
        law enforcement and national security uses. In other words, 
        expand the principles of the Fair Credit Reporting Act to all 
        types of information: right to access, right to question the 
        accuracy and prompt a review, and right to comment if a 
        negative record is found to be accurate.'' \18\
---------------------------------------------------------------------------
    \18\ Derek V. Smith, ``Risk Revolution: The Threats Facing America 
and Technology's Promise for a Safer Tomorrow'' (Longstreet Press, 
2004) 185.

Conclusion
    Resolving these issues will require a broad-based and inclusive 
dialogue. We must strike a balance, but the current absence of a 
comprehensive legal framework for the collection, sale and use of 
sensitive, personal information is yielding harms that are made clear 
every day. The Center for Democracy and Technology looks forward to 
working with the Committee, with all of today's witnesses, and with all 
stakeholders. We are not helpless in the face of the ongoing revolution 
in information technology. Through the policy process, we can decide 
whether there is ``No Place to Hide.''
                                 ______
                                 
 Statement of Oliver I. Ireland, Attorney, Morrison & Foerster LLP; on 
Behalf of Visa U.S.A. Inc., Before the Subcommittee on Commerce, Trade, 
and Consumer Protection of the Committee on Energy and Commerce, United 
             States House of Representatives, May 11, 2005
     Securing Consumers' Data: Options Following Security Breaches
    Good morning Chairman Stearns, Ranking Member Schakowsky, and 
Members of the Subcommittee. I am a partner in the law firm of Morrison 
& Foerster LLP, and practice in the firm's Washington, D.C. office. I 
am pleased to appear before the Subcommittee on behalf of the Visa, 
U.S.A. Inc., to discuss the important issue of consumer information 
security.
    The Visa Payment System, of which Visa U.S.A. is a part, is the 
largest consumer payment system, and the leading consumer e-commerce 
payment system, in the world, with more volume than all other major 
payment cards combined. Visa plays a pivotal role in advancing new 
payment products and technologies, including technology initiatives for 
protecting personal information and preventing identity theft and other 
fraud.
    Visa commends the Subcommittee for focusing on the important issue 
of information security. As the leading consumer electronic commerce 
payment system in the world, Visa considers it a top priority to remain 
a leader in developing and implementing technology, products, and 
services that protect consumers from the effects of information 
security breaches. As a result, Visa has long recognized the importance 
of strict internal procedures to protect Visa's members' cardholder 
information, thereby to protect the integrity of the Visa system.
    Visa has substantial incentives to maintain strong security 
measures to protect cardholder information. The Visa system provides 
for zero liability to cardholders for unauthorized transactions. 
Cardholders are not responsible for unauthorized use of their cards. 
The Visa Zero Liability policy guarantees maximum protection for Visa 
cardholders against fraud due to information security breaches. Because 
the financial institutions that are Visa members do not impose the 
losses for fraudulent transactions on their cardholder customers, these 
institutions incur costs from fraudulent transactions. These costs are 
in the form of direct dollar losses from credit that will not be 
repaid, and also can be in the form of indirect costs attributable to 
the harm and inconvenience that might be felt by cardholders or 
merchants. Accordingly, Visa aggressively protects the cardholder 
information of its members.
Existing Federal Laws and Rules for Information Security
    Existing Federal laws and regulations also obligate financial 
institutions to protect the personal information of their customers. 
Rules adopted under section 501(b) of the Gramm-Leach-Bliley Act of 
1999 by the Federal banking agencies and the Federal Trade Commission 
(FTC) (GLBA 501(b) Rules) establish information security standards for 
the financial institutions subject to the jurisdiction of these 
agencies. Under the GLBA 501(b) Rules, financial institutions must 
establish and maintain comprehensive information security programs to 
identify and assess the risks to customer information and then control 
these potential risks by adopting appropriate security measures.
    Each financial institution's program for information security must 
be risk-based. Every institution must tailor its program to the 
specific characteristics of its business, customer information and 
information systems, and must continuously assess the threats to its 
customer information and systems. As those threats change, the 
institution must appropriately adjust and upgrade its security measures 
to respond to those threats.
    However, the scope of the GLBA 501(b) Rules is limited. Many 
holders of sensitive, personal information are not financial 
institutions covered by the GLBA 501(b) Rules. For example, employers 
and most retail merchants are not covered by the GLBA 501(b) Rules, 
even though they may possess sensitive information about consumers.
Visa's Cardholder Information Security Plan
    Because of its concerns about the adequacy of the security of 
information about Visa cardholders, Visa has developed and is 
implementing a comprehensive and aggressive customer information 
security program known as the Cardholder Information Security Plan 
(CISP). CISP applies to all entities, including merchants, that store, 
process, transmit, or hold Visa cardholder data, and covers enterprises 
operating through brick-and-mortar stores, mail and telephone order 
centers, or the Internet. CISP was developed to ensure that the 
cardholder information of Visa's members is kept protected and 
confidential. CISP includes not only data security standards but also 
provisions for monitoring compliance with CISP and sanctions for 
failure to comply.
    As a part of CISP, Visa requires all participating entities to 
comply with the ``Visa Digital Dozen''--twelve basic requirements for 
safeguarding accounts. These include: (1) install and maintain a 
working network firewall to protect data; (2) do not use vendor-
supplied defaults for system passwords and security parameters; (3) 
protect stored data; (4) encrypt data sent across public networks; (5) 
use and regularly update anti-virus software; (6) develop and maintain 
secure systems and applications; (7) restrict access to data on a 
``need-to-know'' basis; (8) assign a unique ID to each person with 
computer access; (9) restrict physical access to data; (10) track all 
access to network resources and data; (11) regularly test security 
systems and processes; and (12) implement and maintain an overall 
information security policy.
Payment Card Industry Data Security Standard
    Visa is not the only credit card organization that has developed 
security standards. In order to avoid the potential for imposing 
conflicting requirements on merchants and others, in December of 2004, 
Visa, MasterCard, American Express, Discover, and Diners Club 
collaborated to align their respective data security requirements for 
merchants and third parties. Visa found that the differences between 
these security programs were more procedural than substantive. 
Therefore, Visa has been able to integrate CISP into a common set of 
data security requirements without diluting the substantive measures 
for information security already developed in CISP. Visa supports this 
new, common set of data security requirements, which is known as the 
Payment Card Industry Data Security Standard (PCI Standard).
Neural Networks To Detect Fraud and Block Potentially Unauthorized 
        Transactions
    In addition to the CISP program, which helps to prevent the use of 
cardholder information for fraudulent purposes, Visa uses sophisticated 
neural networks that flag unusual spending patterns for fraud and block 
the authorization of transactions where fraud is suspected. When 
cardholder information is compromised, Visa notifies the issuing 
financial institution and puts the affected card numbers on a special 
monitoring status. If Visa detects any unusual activity in that group 
of cards, Visa again notifies the issuing institutions, which begin a 
process of investigation and card re-issuance. These networks, coupled 
with CISP and Visa's Zero Liability, provide a high degree of 
protection from fraudulent credit card transactions to cardholders.
Expansion of Existing Requirements
    Current protections notwithstanding, Visa believes that an 
obligation to protect sensitive, personal information, similar to the 
GLBA 501(b) Rules, should apply broadly so that all businesses that 
maintain sensitive, personal information will establish information 
security programs. Because consumer information knows no boundaries, it 
is critical that this obligation be uniform across all institutions in 
all jurisdictions.
Security Breach Notification
    Closely related to the issue of information security is the 
question of what to do if a breach of that security occurs. Visa 
believes that where the breach creates a substantial risk of harm to 
consumers that the consumers can take action to prevent, the consumers 
should be notified about the breach so that they can take appropriate 
action to protect themselves. Both Federal and California law already 
address this issue. California law currently requires notice to 
individuals of a breach of security involving their computerized 
personal information. The California law focuses on discrete types of 
information that are deemed to be sensitive, personal information. The 
statute defines sensitive, personal information as an individual's name 
plus any of the following: Social Security Number, driver's license 
number, California identification card number, or a financial account 
number, credit or debit card account number, in combination with any 
code that would permit access to the account. The California law 
includes an exception to the notification requirement when this 
personal information has been encrypted. The California law only 
requires notice to be provided when personal information is ``acquired 
by an unauthorized person.'' Other states recently have enacted or are 
considering security breach notification laws; however, the details of 
some of the laws differ.
    In March, the Federal banking agencies issued final interagency 
guidance on response programs for unauthorized access to customer 
information and customer notice (Guidance). The Guidance applies to all 
financial institutions that are subject to banking agency GLBA 501(b) 
Rules and requires every covered institution that experiences a breach 
of security involving sensitive customer information to: (1) notify the 
institution's primary Federal regulator; (2) notify appropriate law 
enforcement authorities consistent with existing suspicious activity 
report rules; and (3) notify its affected customers where misuse of the 
information has occurred or is reasonably possible.
    The keen interest that states have shown to legislate on the issue 
of security breach notification emphasizes the need for a single 
national standard for security breach notification in order to avoid 
confusion among consumers as to the significance of notices that they 
receive and among holders of information about consumers as to their 
notification responsibilities. In addition, any legislation on security 
breach notification should recognize compliance with the Guidance as 
compliance with any notification requirements.
    Visa believes that a workable notification law that would require 
entities that maintain computerized, sensitive personal information to 
notify individuals upon discovering a significant breach of security of 
that data should be risk-based to avoid inundating consumers with 
notices where no action by consumers is required. As FTC Chairwoman 
Majoras recently testified to Congress, notices should be sent only if 
there is a ``significant risk of harm,'' because notices sent when 
there is not a significant risk of harm actually can cause individuals 
to overlook those notices that really are important.
    Thank you, again, for the opportunity to present this testimony 
today. I would be happy to answer any questions.
                                 ______
                                 
  Response to Written Questions Submitted by Hon. Daniel K. Inouye to 
                             Paul B. Kurtz
    Question. Companies often protest against regulation by maintaining 
that the market will address the problem and correct it. However, in 
the case of ChoicePoint and other information brokers, those with the 
buying power are not adversely affected by poor security and thus do 
not demand it from the information suppliers. Can either of you comment 
on the economics of security and how they apply, or not apply as the 
case may be, to the information-broker industry? When should government 
intervene?
    Answer. In determining the Government's role with regard to cyber 
security regulation, the President's National Strategy to Secure Cyber 
Space is an appropriate place to start. The National Strategy provides 
clear policy guidance for the Federal Government's role: ``In general, 
the private sector is best equipped and structured to respond to an 
evolving cyber threat. There are specific instances, however, where 
Federal Government response is most appropriate and justified.'' The 
Strategy goes on to describe the Government's role in the private 
sector: ``Externally, a government role in cybersecurity is warranted 
in cases where high transaction costs or legal barriers lead to 
significant coordination problems; cases in which governments operate 
in the absence of private sector forces; resolution of incentive 
problems that lead to under-provisioning of critical shared resources; 
and raising awareness.''
    According to this description, it seems that information brokers 
may fall into the narrow category where there is an absence of private 
sector forces prompting cyber security. As such, it appears appropriate 
for the Federal Government to intervene.
    What makes regulation of this issue complex is the threat to 
unsecured, sensitive personal information does not stop with 
information brokers. Recent security breaches have occurred in a 
variety of organizations in regulated and non-regulated industries, 
ranging from banks and hospitals, to educational institutions and large 
employers.
    We believe there are five key principles that should be included in 
legislation to address this issue.

        1. Federal Pre-emption. Any new law should establish a national 
        data breach notification ``floor'' for unauthorized access to 
        unencrypted personal information while enabling State attorneys 
        general to prosecute the Federal law so long as the U.S. 
        Attorney General is notified.
        Nine states have already passed legislation requiring 
        notification of unauthorized access to unencrypted personal 
        information. Without Federal pre-emption, we will face a web of 
        potentially conflicting breach notification requirements.

        2. Scope. The scope of the breach notification bill should 
        apply to any agency or person, as defined in title 5 of the 
        U.S. Code, who owns or licenses computerized data containing 
        sensitive, personal information and should not be limited to 
        data brokers. In developing this legislation, it is important 
        not to duplicate requirements set forth under existing Federal 
        law such as the Gramm-Leach-Bliley Act (GLBA), the Fair Credit 
        Reporting Act (FCRA), or other relevant Federal legislation.
        Legislation should address ``gaps'' in existing legislation 
        related to the security of personal information. Recent 
        security breaches have occurred in a variety of organizations, 
        ranging from data brokers, banks and hospitals, to educational 
        institutions and large employers.

        3. Reasonable Security Practices. Reasonable security practices 
        encompass a combination of technology, policy, and expertise. 
        Consistent with existing State law, organizations that own or 
        license computerized data containing personal information 
        should implement and maintain reasonable security measures 
        based on widely accepted voluntary industry standards or 
        existing Federal law.
        Security Practices. The term ``security practices'' shall mean 
        reasonable security and notification procedures and practices 
        appropriate to the nature of the information to protect 
        sensitive, personal information from unauthorized access, 
        destruction, use, modification or disclosure.
        Certification. Congress should consider self-certification to 
        help safeguard sensitive, personal information. In the case of 
        self-certification, covered entities would be required to self-
        certify that they have met a widely adopted standard in order 
        to safeguard sensitive, personal information. If a breach 
        occurs and it is clear that reasonable measures were not taken 
        to safeguard sensitive, personal information, then the covered 
        entity involved would be subject to criminal prosecution by the 
        Department of Justice. Congress should also consider an option 
        for certification by a third-party, coupled with liability 
        protection to foster protection.
        Encryption. Congress should encourage the use of encryption 
        technologies without requiring it, similar to California's SB 
        1386. Encryption is defined as ``the protection of data in 
        storage or in transit using a NIST approved encryption 
        algorithm implemented within a FIPS 140 validated cryptographic 
        module combined with the appropriate key management mechanism 
        to protect the confidentiality and integrity of associated 
        cryptographic keys in storage or in transit.''

        Existing voluntary standards include:

          International Standards Organization (ISO) 17799

          Control Objectives for Information and Related Technology 
        (COBiT)

          British Standard (BS) 7799

           Information security governance framework issued by the 
        National Cyber Security Summit Task Force in April 2004

        Existing regulatory standards include:

           Fair Credit Reporting Act (http://www.ftc.gov/os/statutes/
        fcra.htm#607)

           Gramm Leach Bliley, Safeguards Rule

          FDA, Title 21, Subchapter A, Protection of Privacy

          Basel II, Revised International Capital Framework

           Health Insurance Portability and Accounting Act (HIPAA) 
        Security Rule

        4. Definition of ``breach.'' A breach of unencrypted personal 
        information should be defined so that it encourages the 
        implementation of reasonable security measures and minimizes 
        false positives.

        5. Regulatory Authority. The Federal Trade Commission is the 
        most appropriate authority to oversee breach notification on a 
        civil level and refer criminal cases to the Department of 
        Justice. Wherever possible, the FTC should be directed to adopt 
        existing standards, rather than to create new standards.

    Regarding the economics of security, a recent CRS report states 
that investments in cyber security cannot be easily analyzed in terms 
of return on investment, since they do not contribute to income in a 
measurable way. While such investments may not contribute directly to 
income, their impact on the way an organization does business is 
immeasurable. Information is the lifeblood of today's economy and 
protecting that information--maintaining its confidentiality while 
assuring its accessibility and reliability--are of the utmost 
importance. Cyber security is more than just protecting names and 
Social Security numbers held by data brokers. The economy depends on 
the free flow of information and we need to be able to trust that 
information to be what it purports to be. The issues we hear, seemingly 
on a day to day basis--spyware, identity theft, phishing, breach 
notification--are all symptoms in the larger problem of unsecured 
information systems. We encourage the Congress to take a more holistic 
approach to the issue of cyber security, rather than reacting to each 
problem. In this context, CSIA believes that there are a number of 
incentives that have not yet been investigated such as legislative safe 
harbors, tax incentives, the use of cyber insurance, or other 
motivating factors that would promote the use and development of 
stronger security measures by information brokers.
    Finally, there is very little economic data available to determine 
the costs of cyber security attacks and vulnerabilities. Developing 
cost estimates requires reporting of incidents as well as a common 
methodology of breaking down lost productivity, system down time, 
identifying vulnerabilities, testing patches, and personnel hours. 
Federally funded research in this area would be of great value.
                                 ______
                                 
    Response to Written Questions Submitted by Hon. Bill Nelson to 
                          Jennifer T. Barrett
    Question 1. Does Acxiom merely compile, store, and sell sensitive 
consumer information? Or does your company perform analysis of such 
information. Can you describe what this analysis involves? And what 
sorts of analysis is your company performing generally for law 
enforcement, such as the FBI?
    Answer. Acxiom does compile consumer information, including SSNs 
and Driver's License Numbers (DL#s), in order to develop our fraud 
management products. The ``analysis'' performed in building such 
products is limited to determining how to accurately integrate or 
combine the multiple sources of information.
    Our verification services only validate that the information our 
client has obtained from the consumer is correct. There is no 
``analysis'' performed in providing those services. Rather, the record 
being verified is compared to the information Acxiom already possesses 
and a ``match'' or ``no-match'' indicator is returned.
    Only law enforcement and the internal fraud departments of large 
financial institutions and insurance companies have access to 
additional information in connection with these verification services. 
The additional information made available to this select group of users 
includes such information as previous addresses, additional SSNs or 
DL#s associated with the particular consumer. Again, no ``analysis'' is 
performed by Acxiom.
    Acxiom's background screening products utilize field researchers 
who do in-person, real-time research against public records and make 
calls to past employers to verify the information provided by the 
consumer. Acxiom does not pre-aggregate information for these products. 
As a result, the compilation of this product is only done in 
preparation of the actual report and the file is stored only for 
purposes of compliance with the FCRA.

    Question 2. What is the procedure for becoming an Acxiom client? 
When someone becomes a client, does that client have access to all of 
your company's databases for any purpose? For example, if an attorney 
becomes an Acxiom client to help locate a witness, can that attorney 
also use Acxiom's databases for personal or other reasons? How does 
your company monitor this?
    Answer. Acxiom sells its fraud management products exclusively to 
very large financial services and insurance clients and law enforcement 
agencies. These products are not sold to individuals, such as 
attorneys.
    The sales cycle for these types of clients is typically several 
months long and involves many in-person visits and customized 
interfaces between systems. The problem the client is trying to address 
with the data, and the data to be provided by Acxiom, are fully vetted 
by Acxiom's product, legal and compliance teams. Once the appropriate 
Acxiom products for a particular solution are determined, the client 
enters into a signed written agreement with terms and conditions of use 
of the data.
    Once a formal relationship is established, a client is permitted to 
utilize only the data products for which it has been approved and 
granted a license.
    A log is kept of every transaction made by Acxiom's clients to our 
fraud management products which provide access to sensitive 
information. These are used for billing purposes and periodically 
audited/reviewed by the product team.
    Our background screening products, which are regulated by the Fair 
Credit Reporting Act, are available only to employers and landlords. 
All clients using these products are credentialed with such agencies as 
the Better Business Bureau and, for those who receive any sensitive 
information, onsite inspections of potential clients also are conducted 
by Acxiom. Only pre-employment credit reports provide sensitive 
information that employers or landlords do not already possess.

    Question 3. Can you explain how Acxiom organizes and maintains its 
sensitive consumer information? Is all information--regulated or 
unregulated--contained in one database? If information is maintained 
separately, can information from one database make its way into another 
database? If not, how does Acxiom prevent information from migrating 
from one database into others?
    Answer. Acxiom builds distinct databases to support each of its 
different data product lines. The only products Acxiom offers that 
contain sensitive consumer information are its fraud management 
products and background screening services.
    Although the fraud management products are built from both 
regulated and unregulated data, the entire database is maintained and 
utilized as if it was all regulated.
    Different Acxiom teams are responsible for the creation and 
maintenance of each distinct product line and the databases from which 
they are built. Only the appropriate team has access to the data within 
each database. This strategy prevents the unintentional migration of 
information from one database to another.
    Acxiom voluntarily submits itself to external annual audits of its 
information practices for the purpose of reviewing the data and data 
sources utilized in each product line and to assure compliance with our 
own principles, source contacts and applicable laws and regulations.
    The background screening reports are provided by a separately run 
subsidiary of Acxiom and are fully regulated under the Fair Credit 
Reporting Act. The reports are compiled on an ``as needed'' basis by 
associates and field agents who are employed by that subsidiary and who 
are focused only on that business. The information in those reports is 
not stored in a database and is not utilized in any other area of the 
company.

    Question 4. Some information brokers have cited the difficulty in 
correcting consumer files, claiming that the inaccurate information is 
generated from public records. But this addresses only part of the 
issue. One problem is that information brokers may place information 
regarding one person into another person's file. This is particularly 
common with persons who have the same name. What steps does Acxiom take 
to try to avoid this problem?
    Answer. Acxiom utilizes all available identifying information in 
consolidating the information from various sources to build the 
company's data products. In the case of individuals with the same or 
similar names, the use of address, telephone, date of birth and SSN, if 
available, will assist in accurately differentiating between the two 
persons. No one element is used to consolidate information. Rather a 
combination of elements are utilized, reducing the chance that an error 
or a similarity in one element will result in an error. We also conduct 
quality audits of consolidation procedures to help identify problems 
and to refine our consolidation algorithms.
    Access to increased information reduces chances for errors. Should 
some of these elements of differentiating data become unavailable to 
the information services industry, the accuracy of the consolidation 
may suffer.

    Question 5. To what extent does Acxiom sell sensitive consumer 
information to Federal, State, and local law enforcement agencies. Does 
Acxiom have any limitations on the sale of information to law 
enforcement entities?
    Answer. Acxiom has only one contract with the Federal Government 
which involves the sale of sensitive information. We impose similar 
restrictions on the sale of sensitive information to government 
agencies as we do for the fraud departments of large financial 
institutions and insurance companies. Examples of such restrictions 
include:

   Sensitive data provided to the government may only be used 
        to verify the accuracy of personal information for the purposes 
        of preventing fraud or to locate individuals.

   Driver's License data must be used by the government in 
        compliance with the Drivers Privacy Protection Act for the 
        verification of accuracy of personal information. If the 
        personal information is incorrect, the driver's license data 
        may be used to obtain the correct information, but only for the 
        purpose of preventing fraud.

   The data provided cannot be stored in any other form or used 
        for any other purpose unless express written permission is 
        received from Acxiom.

    Question 6. Please describe the procedures governing who can 
purchase sensitive consumer information from Acxiom. Please tell us 
about the types of holes Acxiom had in its old process and how the 
company is now plugging those holes.
    Answer. Acxiom sells our fraud management product exclusively to 
large companies and has only several dozen clients for these products. 
As described earlier, only the fraud departments of large financial 
institutions and insurance companies and government agencies have 
access to this investigative tool which provides sensitive information.
    We do not believe we have any holes in our current process for 
screening clients, as that process has never been compromised. However, 
after the incidents involving ChoicePoint and Lexis-Nexis, Acxiom 
undertook a review of all our client credentialing procedures, 
including those procedures that apply to clients with access to only 
non-sensitive data. As a result of that review, which will conclude 
next month, Acxiom may implement additional credentialing procedures if 
such procedures are determined to be appropriate.
    While the security breach Acxiom suffered in 2003 did not involve 
any of Acxiom's information products and did not result in access to 
any of Acxiom's sensitive data, we did make substantial technical 
changes in how files are transferred to and from Acxiom by our clients, 
to prevent such an incident from reoccurring.

    Question 7. Does Acxiom favor giving consumers wider access to 
information that the company stores about them? This is a central 
principle of the legislation I have introduced. What information should 
companies like Acxiom make available to consumers?
    Answer. Acxiom's fraud products and the background screening 
products are the only products which contain sensitive information. 
Since 1997, Acxiom has voluntarily provided consumers access to the 
information Acxiom has about them in the company's fraud management and 
directory products. We also provide consumer access to the company's 
background screening product, pursuant to the requirements of the Fair 
Credit Reporting Act.

    Question 8. Does Acxiom perform any audits of its systems to ensure 
accuracy of the sensitive consumer information that it compiles?
    Answer. Acxiom is constantly auditing its data compilation 
processes, and the quality of the files it obtains, in order to assure 
maximum possible accuracy. These audits include manual reviews of the 
data, comparisons to other sources, and verification of the company's 
consolidation procedures. Acxiom obtains sensitive data from only a few 
select sources with which Acxiom has worked for years.

    Question 9. What auditing does Acxiom perform on its business and 
government clients? Are clients required to type in a specific 
justification for each search of personal information, or do they just 
see a ``click through'' agreement? How long are audit logs maintained? 
Has auditing ever revealed wrongdoing that led to a client being 
prosecuted for misusing personal information?
    Answer. Acxiom does not allow access to data products containing 
sensitive information via a ``click through'' agreement. As described 
above, the problem the client is trying to address with the data, and 
the data to be provided by Acxiom, are fully vetted by Acxiom's 
product, legal and compliance teams. Once the appropriate Acxiom 
products for a particular solution are determined, the client enters 
into a signed written agreement with terms and conditions of use of the 
data.
    Acxiom's practice is to maintain audit logs as described above for 
our fraud management products for at least 7 years.
    We have never had an audit reveal wrongdoing that led to a client 
being prosecuted for misusing personal information.

    Question 10. To which Federal Government agencies does Acxiom sell 
sensitive consumer information?
    Answer. Acxiom currently provides sensitive data to only one 
Federal law enforcement agency engaged in homeland security efforts.

    Question 11. Does your company compile information garnered from 
warranty cards filled out by consumers? If so, what companies generally 
supply you with this information and how is this information stored and 
used?
    Answer. Acxiom does not compile information garnered from warranty 
cards, but we do license general lifestyle data from sources that do. 
That information is only used for marketing purposes.

    Question 12. Please give a complete listing of the types of 
personal information that your company maintains in all of its product 
lines, including information based on DNA and biometrics.
    Answer. Acxiom possesses absolutely no information based on, 
derived from, or in any way related to DNA or biometrics.
    Marketing Products--Acxiom develops and maintains databases 
containing information on households in the U.S. for companies to use 
in their marketing and customer service programs. These databases are 
developed from many different sources, including:

        Public Record and Publicly Available Information--Telephone 
        directories, website directories and listings, real property 
        recorder and assessor information, historical drivers license 
        information and historical motor vehicle information.

        Data from Other Information Providers--Demographic information, 
        survey information and summary buyer information.

    These databases do not include credit information, medical 
information, Social Security Number (or other related information) or 
personally identifiable information about children.
    Reference Products--Acxiom develops and maintains databases 
containing information about many individuals and households in the 
U.S. for directory reference and fraud management purposes and provides 
online links to other information provider services for use by 
qualified businesses and government agencies for lawful and ethical 
purposes. These databases are developed from many different sources, 
including:

        Public Record and Publicly Available Information--Telephone 
        directories; real property recorder and assessor information; 
        historical drivers license information; current drivers license 
        information, where allowed by law; historical motor vehicle 
        information; current motor vehicle information, where allowed 
        by law; deceased information; and other suppression 
        information.

        Data from Other Information Providers--Identifying information 
        only (header data) from consumer reporting agencies, where 
        allowed by law, and information about household characteristics 
        collected and permissioned by the consumer.

    These databases and access to other information provider services 
include financial information, Social Security Number and other related 
information where permitted by law. This information is provided only 
to qualified businesses primarily in the finance, insurance, mortgage, 
real estate and retail industries for the purpose of risk management 
including verifying information about customers, issuing mortgages, 
speeding transactions, employment screening and reducing the chance of 
fraud. This information is also provided to government agencies for the 
purposes of risk management including verifying information, employment 
screening, national security and assisting law enforcement.
    In order to protect the use of this information, Acxiom does not 
provide any information, whether public or non-public, to individuals. 
Acxiom also does not allow our clients to make any non-public 
information available to an individual. Acxiom does allow our clients 
to make only public record and publicly available information available 
to individuals in the form of commonly used and accepted real estate 
research tools and public listing searches via the Internet.
                                 ______
                                 
    Response to Written Questions Submitted by Hon. Bill Nelson to 
                            Kurt P. Sanford
    Question 1. Can you explain how LexisNexis organizes and maintains 
its sensitive consumer information?
    Answer. LexisNexis stores all data in electronic files. Individual 
records comprise databases which are distinguished by source. The 
LexisNexis system has the capability to search individual sources or 
search multiple data sources simultaneously in group files, which is a 
grouping of discrete data files from multiple sources.
    At Seisint, data from multiple sources is generally combined into a 
group file. Even though data is combined into a group file, Seisint 
retains the ability to distinguish the source from which each record in 
the group file originated.

    Question 1a. Is all information--regulated or unregulated--
contained in one database?
    Answer. No. In a few limited instances LexisNexis has successfully 
combined data from multiple sources into a group file or report, 
allowing a single search to be run on the resulting group file or 
report. However, regulated data either separately or combined with non-
regulated data still requires a declaration of permissible use before 
access is permitted.
    Similarly, at Seisint, regulated data either separately or combined 
with non-regulated data still requires a declaration of permissible use 
before access is permitted.

    Question 1b. If information is maintained separately, can 
information from one database make its way into another database?
    Answer. Information from one database (source file) cannot migrate 
into another database due to system constraints, permissions, data file 
and record structure. However, in a few limited instances we have 
purposefully combined data into group files and reports for ease of use 
by our customers, as described above.

    Question 1c. If not, how does LexisNexis prevent information from 
migrating from one database into others?
    Answer. N/A.

    Question 2. Some information brokers have cited the difficulty in 
correcting consumer files, claiming that the inaccurate information is 
generated from public records. But this addresses only part of the 
issue. One problem is that information brokers may place information 
regarding one person into another person's file. This is particularly 
common with persons who have the same name. What steps does LexisNexis 
take to try to avoid this problem?
    Answer. To be linked, data must match on multiple data elements 
such as name and Social Security number, or name, address and telephone 
number, or some similar combination of multiple data elements. We 
investigate reported mismatches. If we confirm an error, we take steps 
to correct the error. If it is our error we correct it, otherwise we 
direct the consumer to the originating source so that consumer can 
pursue correction directly with the source.

    Question 3. To what extent does LexisNexis sell sensitive consumer 
information to Federal, State, and local law enforcement agencies?
    Answer. The vast majority of information available through 
LexisNexis comes from public records, court decisions, statutes, and 
other open source publications like newspapers, periodicals, and 
directories. ``Sensitive information'' on LexisNexis is limited to full 
Social Security numbers obtained from nonpublic sources such as credit 
headers, in accordance with both the Fair Credit Reporting Act (FCRA) 
and the privacy provisions of the Gramm-Leach-Bliley Financial Services 
Modernization Act (GLBA), and drivers license numbers obtained from 
State departments of motor vehicles in compliance with Federal and 
state implementations of the Drivers Privacy Protection Act (DPPA).
    Sensitive information, as defined above, is made available to 
Federal, State, and local law enforcement agencies where such agencies 
certify that their access is in compliance with and expressly permitted 
under the provisions of the applicable laws.

    Question 3a. Does LexisNexis have any limitations on the sale of 
information to law enforcement entities?
    Yes. Law enforcement use of regulated data is limited to only those 
uses specifically permitted under the GLBA and DPPA.

    Question 4. Please describe the procedures governing who can 
purchase sensitive consumer information from LexisNexis.
    Answer. Access to sensitive information is limited to those 
customers with a permissible purpose under DPPA or GLBA. Prior to 
entering into a contract with LexisNexis, a customer must disclose its 
intended purpose for the data, which must correspond to one or more of 
the permissible purposes under the GLBA and/or the DPPA. In addition, 
the customer must qualify as an authorized user and must certify that 
it has one of a limited number of authorized uses. LexisNexis has the 
right to review and audit the customer's use to ensure compliance with 
terms of the agreement.

    Question 4a. Please tell us about the types of holes LexisNexis had 
in its old process and how the company is now plugging those holes.
    Answer. The security incidents we uncovered primarily involved 
unauthorized persons misusing IDs and passwords of legitimate Seisint 
customers. As a result, we have enhanced our business practices and 
policies involving the issuance and administration of customer IDs and 
passwords. These include:

   Changing customer password security processes to require 
        that passwords for both system administrators and users be 
        changed at least every 90 days;

   Suspending customer passwords of system administrators and 
        users that have been inactive for 90 days;

   Suspending customer passwords after five unsuccessful log in 
        attempts and requiring them to contact Customer Support to 
        ensure security and appropriate reactivation; and

   Requiring that system administrators review the list of 
        employees issued IDs and passwords to ensure that access is 
        terminated when an employee leaves the company.

    Question 5. Does LexisNexis perform any audits of its systems to 
ensure accuracy of the sensitive consumer information that it compiles?
    Answer. LexisNexis employs a number of procedures to test the 
accuracy of sensitive information received and to test the accuracy of 
this data prior to making the data available to customers. Accuracy is 
measured by determining whether the data received matches the data in 
the source document or record.
    LexisNexis only obtains data from known, reputable sources. Credit 
header data is obtained directly from the originating credit bureau, 
not through brokers or other third parties.

   We receive the most current data that the supplier can 
        provide;

   Any questions arising regarding the accuracy of the content 
        delivered to LexisNexis are resolved quickly and effectively;

   Data is delivered in the same, mutually agreed upon format, 
        thereby maintaining the integrity of the data conversion 
        process and minimizing the risk of conversion errors;

   We respond to any questions regarding data accuracy brought 
        to our attention by consumers or others; and

   Any updates, additions, or changes will be received from the 
        supplier.

    The data conversion process is itself subject to a series of system 
checks. The data is run through the conversion process where computer 
systems and software check for conformance with formatting 
specifications. Deviations, anomalous data, and data omissions are 
noted and brought to the attention of the appropriate LexisNexis 
personnel for verification, review, or remediation with the data 
supplier.

    Question 6. What auditing does LexisNexis perform on its business 
and government clients?
    Answer. LexisNexis has established systems that allow us to monitor 
usage and identify abnormal usage patterns. When abnormal usage is 
discovered, access is shut off and the use investigated.

    Question 6a. Are clients required to type in a specific 
justification for each search of personal information, or do they just 
see a ``click through'' agreement?
    Answer. LexisNexis does provide electronic access to applicable 
terms and conditions on use for all users. These terms and conditions 
keep users informed of their obligations under the written agreement.
    In addition, LexisNexis employs a series of electronic notices and 
responses to determine whether users have a legally permissible purpose 
for accessing legally restricted, personal information such as credit 
headers subject to restrictions on use under the privacy provisions of 
the GLBA or driver's license records restricted under the DPPA. These 
notices provide users with the permissible purposes authorized under 
the applicable statutes. Unless the user indicates a specific, 
enumerated permissible purpose, access is denied.
    Users are given notice that records of their use of these materials 
is subject to recordkeeping requirements of applicable Federal and 
State laws and of data suppliers. Records are maintained of the user 
ID, permissible purpose, date, and time of the search.

    Question 6b. How long are audit logs maintained?
    Answer. In accordance with the requirements of the DPPA records of 
the identity of the user and of the applicable permitted use must be 
maintained for at least 5 years for searches involving information 
covered by that statute.

    Question 6c. Has auditing ever revealed wrongdoing that led to a 
client being prosecuted for misusing personal information?
    Answer. We have identified instances where it appeared from 
searching patterns that customers could have been misusing personal 
information. In those instances system access was either suspended or 
modified to avoid the possibility of improper use.

    Question 7. To which Federal Government agencies does your company 
sell sensitive consumer information?
    Answer. LexisNexis works with virtually every agency in the Federal 
Government. Some of our customers include:

   Homeland Security agencies
   Law enforcement agencies
   Intelligence agencies
   Entitlements agencies
   Regulatory agencies
   Revenue agencies

    Question 8. Does your company compile information garnered from 
warranty cards filled out by consumers?
    Answer. No.

    Question 8a. If so, what companies generally supply you with this 
information and how is this information stored and used?
    Answer. N/A.

    Question 9. Please give a complete listing of the types of personal 
information that your company maintains in all of its product lines, 
including information based on DNA and biometrics.
    Answer. The information maintained by LexisNexis falls into the 
following three general classifications: public record information, 
publicly available information, and non-public information.
    Public record information. Public record information is information 
originally obtained from government records that are available to the 
public. Real estate records, court records, and professional licensing 
records are examples of public record information collected and 
maintained by the government for public purposes, including 
dissemination to the public.
    Publicly available information. Publicly available information is 
information that is available to the general public from non-
governmental sources. Telephone directories are an example of publicly 
available information.
    Non-public information. Non-public information is information about 
an individual that is not obtained directly from public record 
information or publicly available information. This information comes 
from proprietary or non-public sources. Non-public data maintained by 
LexisNexis consists primarily of information obtained from driver's 
license records, motor vehicle records or credit header data. Credit 
header data is the non-financial identifying information located at the 
top of a credit report, such as name, current and prior address, listed 
telephone number, Social Security number, and month and year of birth.
    LexisNexis does not collect or distribute personal financial 
information such as credit card account information or personal medical 
records. LexisNexis does not collect or maintain either DNA or 
biometric data.

                                  

```