Privacy vs. openness: A data dilemma in U.S.By Tom Zeller Jr. The New York Times
WEDNESDAY, MAY 18, 2005
SourceBALTIMORE Ted Stevens wanted to know just how much the Internet has turned private lives into open books. So the U.S. senator, a Republican from Alaska and the chairman of the Senate Commerce Committee, instructed his staff to steal his identity.
"I regret to say they were successful," the senator reported at a hearing he held last week on data theft.
His staff, Stevens reported, came back not just with digital breadcrumbs on the senator, but also with insights on his daughter's rental property and some of the comings and goings of his son, a student in California. "My staff provided me with information they got from a series of places," he said. "For $65, they were told, they could get my Social Security number."
That would not surprise 41 graduate students in a computer security course at Johns Hopkins University in Maryland, who, with $15 less than that, became mini data brokers themselves over the last semester.
Working with a budget of $50 and a strict requirement to use only legal, public sources of information, groups of three to four students set out to vacuum up not just tidbits on individuals, but whole databases - death records, property tax information, campaign donations, occupational license registries - on citizens of Baltimore. They then cleaned and linked the databases they had collected, making it possible to enter a single name and generate multiple layers of information on individuals.
The Johns Hopkins students demonstrated - as has a growing chorus of privacy advocates around the United States - that there is plenty of information to be had on individuals without ever buying it (or stealing it) from big database companies like ChoicePoint and LexisNexis. And as concerns over data security mount, the inherent conflicts between a desire for convenience, openness and access to public records on the one hand, and for personal privacy on the other, are beginning to show.
The Johns Hopkins project was conceived by Avi Rubin, a professor of computer science and the technical director of Johns Hopkins's Information Security Institute. Rubin has used his graduate courses in the past to expose weaknesses in electronic voting technology, digital car keys and other byproducts of a society that is increasingly dependent on computers, networks and software.
"My expectations were that they would be able to find a lot of information, and in fact they did," Rubin said.
In some instances, students visited local government offices and filed official requests for the data - or simply "asked nicely" - sometimes receiving whole databases burned onto a CD.
In other cases, they wrote special computer scripts, which they used to slurp up whole databases from online sources like Maryland's registry of occupational licenses (barbers, architects, plumbers), or from free commercial address databases.
"I think what this professor and students have done is a powerful object lesson in just how much information there is to be found about most of us online," said Beth Givens, the director of the Privacy Rights Clearinghouse in San Diego, "and how difficult it is, how impossible it is, to control what's done with our information."
David Bloys, a private investigator in Texas, has helped craft a bill now pending in the state legislature there that would prohibit the bulk transfer and display over the Internet of documents filed with local governments.
There are real dangers involved, Bloys said, when such information "migrates from practical obscurity inside the four walls of the courthouse to widespread dissemination, aggregation and export across the world via the Internet." However convenient online access made things for legitimate users, the information is equally convenient for "stalkers, terrorists and identity thieves," Bloys said.
The bill, which was introduced in Austin by Representative Carl Isett, a Republican, unanimously passed out of the State Affairs Committee on May 3 and is awaiting a vote in the full House.
Meanwhile, in Alaska, the American Civil Liberties Union - a vanguard for openness and access to public documents - has taken up the cause of Maryjane Hinman, a nurse who had lobbied unsuccessfully to have her home address removed from the state's online registry of occupational licenses.
"We feel that open access to public records is key to a free society," said Jason Brandeis, the ACLU attorney handling the Alaska suit, which seeks to bar the state from disseminating contact information for all licensed nurses. "But a balance needs to be struck between the public interest in open access to government information, and the need to protect individual privacy."
Whether such a balance can ever be struck when so much information is already out of the bag remains an open question.
"I have no problem with an individual who faces unusual threats from publication of her identity or identifying details being able under the law to seek special exception from openness," said Rebecca Daugherty, the director of the Freedom of Information Service Center for the Reporters Committee for Freedom of the Press in Virginia. "But the secrecy should be the exception," she said, "not the rule."
Several of the students at Johns Hopkins came to a similar conclusion. Despite their surprise at the number of records they were able to amass, many still felt that the benefits of openness outweigh the risks of secrecy.
"If some citizen is concerned about dead people remaining registered to vote, he can simply obtain the database of deaths and the voter registration database and cross-correlate," said Joshua Mason, whose group discovered 1,500 dead people who were also listed as active registered voters. Fifty of those dead people somehow voted in the last election. "The problem is, we don't know what we want," Rubin said, referring to the competing social interests in openness and privacy.
IHT Copyright © 2005 The International Herald Tribune