In the first few months of 2005, two leading data brokers, LexisNexis and ChoicePoint, announced that unauthorized individuals had breached their security measures and obtained personal information (e.g., Social Security numbers, addresses) about hundreds of thousands of individuals. These companies and others like them—so-called "data brokers"—operate largely free from federal and state regulation. The recent scandals have led to calls for tighter regulation of the data brokerage industry, creating the need for more complete information on the types of businesses that make up this industry, and the types of services they provide. This report provides an overview of the industry and specific case studies of ChoicePoint and LexisNexis. Personal information for background checks is of course essential for employers and criminal investigators. Businesses that have been able to use the Internet to quickly provide such information have grown tremendously over the past several years, as the events of September 11, 2001, and the subsequent war on terror have put a premium on accurate identification of individuals in both the public and private sectors. "Data brokers"—companies like ChoicePoint, LexisNexis, Axciom, Experian, US Search, and Information Search—have prospered by fulfilling this need. Law enforcement, in particular, has found data brokers useful, as these private companies maintain and organize personal information on individuals in a manner that may not be legally available to government actors. The Privacy Act, for example, requires federal agencies to limit the amount of information on American citizens that these agencies maintain and disseminate. The Act establishes the principle that the government should "collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs." Most data brokers sell data that they collect from public records (e.g., driver's license records, vehicle registration records, criminal records, voter registration records, property records, occupational licensing records) or from warranty cards, credit applications, etc. In addition, data brokers purchase so-called "credit headers" from credit reporting agencies. Information on a credit header generally includes a person's name, Social Security number, address, phone numbers, and birth date. While the release of certain information, such as data associated with a credit report, is subject to federal law, data brokers are largely free from state and federal regulation. Generally, companies or government agencies purchase from data brokers information about an individual—including his or her Social Security number. The vast majority of these transactions are conducted via the Internet, rather than person-to-person. Of course, the anonymity of most data brokerage transactions has opened the door for criminals to pose as legitimate businesses and obtain vital information about an individual—usually a Social Security number—and steal his or her identity. It has been reported in the past, for example, that identity thieves—using stolen credit card numbers—have obtained information about victims and transferred funds from the victims' accounts, written phony checks against those accounts, etc. As the following case studies show, the danger of identity theft remains, despite the implementation of tighter safeguards by data brokers. While the growth of companies that gather and sell information has tracked the rise of personal computers since the early 1980's, two events led to the exponential growth of data brokerage firms since 2000: (1) The explosion of the Internet throughout the 1990's; and (2) the development by Florida-based programmer John Asher of parallel programming software allowing a researcher to use bits of information about an individual (e.g., name, Social Security number) to search several databases simultaneously and find more information about that person within seconds. Asher built two companies on this technology, and later sold the companies to ChoicePoint and LexisNexis, who have used the technology to become two of the most successful data brokers in the world. One of the largest and most profitable data brokers in the United States is Georgia-based ChoicePoint. ChoicePoint sells data to a wide variety of entities, from insurers to law enforcement. Originally formed as a spin-off of credit reporting agency Equifax in 1997, ChoicePoint has grown to dominate the data brokerage market by purchasing a number of smaller, more specialized data brokers and operating several subsidiaries in various states. ChoicePoint's total annual revenue has grown in this time period from $585 million in 2000 to over $1 billion in 2006. The products ChoicePoint offers reflect the sophistication in the data brokerage industry that demand and competition have created. ChoicePoint not only groups personal information together according to what type of background check is being conducted (e.g., pre-employment screenings) but also "Soundex" searches that allow customers to search for personal information based on how names sound, rather than how they are spelled. In addition, ChoicePoint allows law enforcement to link suspects to former addresses, neighbors, etc. As mentioned above, the data brokerage industry has grown increasingly close to law enforcement and counterterrorism agencies in the last few years, and ChoicePoint's relationship with law enforcement and counterterrorism agencies is indicative of this fact. ChoicePoint has multi-million dollar contracts with the Departments of Homeland Security and Justice, and the company maintains federal agency-specific websites to facilitate searches by officers from those agencies. Up until recently, ChoicePoint guarded access to its information by requiring customers to provide business records on file with government agencies, copies of drivers' licenses, and other information identifying customers as legitimate businesses. Unfortunately, at least one criminal ring began creating sham businesses and identities in order to get around these requirements, and a Los Angeles-based sting operation in 2004 uncovered evidence leading authorities to conclude that the ring had accessed ChoicePoint's information on roughly 145,000 people. As the scandal unfolded, ChoicePoint drew heated criticism for refusing to notify many of those whose personal information had been accessed. At first, ChoicePoint only notified victims residing in California, as that is the only state with a law requiring such notification when personal information is compromised. Only after a public outcry did ChoicePoint agree to notify victims outside of California. The Federal Trade Commission (FTC) brought a compliant for civil penalties, permanent injunction, and other equitable relief alleging that ChoicePoint did not have reasonable procedures to screen prospective subscribers, and turned over consumers' sensitive personal information to subscribers whose applications raised "red flags." The FTC also alleged that ChoicePoint approved as customers individuals who lied about their credentials and used commercial mail drops as business addresses. In addition, according to the FTC, ChoicePoint applicants reportedly used fax machines at public commercial locations to send multiple applications for separate companies. The FTC charged that ChoicePoint violated the Fair Credit Reporting Act (FCRA) by furnishing consumer reports to subscribers who did not have a permissible purpose to obtain them, and by failing to maintain reasonable procedures to verify both their identities and how they intended to use the information. The agency also charged that ChoicePoint violated the Federal Trade Commission Act by making false and misleading statements about its privacy policies. In 2006, ChoicePoint agreed to pay $10 million in civil penalties and $5 million in consumer redress to settle Federal Trade Commission charges that its security and record-handling procedures violated consumers' privacy rights and federal laws. The settlement requires ChoicePoint to implement new procedures to ensure that it provides consumer reports only to legitimate businesses for lawful purposes, to establish and maintain a comprehensive information security program, and to obtain audits by an independent third-party security professional until 2026. LexisNexis has been one of the leading information research engines for over two decades. In August, 2004, LexisNexis' parent company, London-based Reed Elsevier, purchased data broker Seisint (an Asher creation) for $775 million and made it a unit of LexisNexis. Among other things, Seisint provides data for Matrix, a crime and terrorism database that, until recently, was funded by the federal government. Very soon after the ChoicePoint scandal, LexisNexis reported that unauthorized individuals had accessed the personal information of about 32,000 customers of the company's data brokerage unit by entering in the passwords of legitimate customers. A few weeks later, that estimate had risen to over 300,000. These individuals somehow acquired passwords of paying customers of Seisint's "Acurint" service, which generally charges $4.50 for packaged information about an individual. Using the legitimate passwords, the hackers were able to access personal information ranging from social security numbers to home addresses to drivers' licenses numbers. As the market for personal information has grown—particularly in light of the war on terror—so too has grown the data brokerage industry. The ChoicePoint and LexisNexis scandals, however, have spurred debate over the security of personal information collected and sold by data brokers.