Privacy is easy to breachBy David Lazarus
Friday, July 15, 2005
SourceThe fracas over whether Karl Rove, one of President Bush's most trusted advisers, publicly outed an undercover CIA operative highlights the ease with which personal information on virtually anyone can be obtained.
It also points to the need for privacy laws -- and, in this case, national-security laws -- recognizing the harm that can be done with only a few computer keystrokes.
That harm, as a slew of recent security breaches makes clear, can include identity theft, credit card fraud and other invasions of one's personal-data space.
It can also represent a graver danger if the work you do is of interest to terrorists and other enemies of this country.
I found out how significant this threat can be when I attempted to identify the CIA agent in question for myself, based solely on what Rove is known to have told a journalist.
The results were troubling, to say the least.
First, a little background:
The key issue this week has been whether Rove broke the law when he reportedly told a journalist, Matthew Cooper of Time magazine, that the wife of a prominent administration critic works for the CIA in the sensitive field of weapons of mass destruction.
Rove's role was confirmed by an e-mail sent by Cooper to his bureau chief. The e-mail, obtained by Newsweek, concerned former Ambassador Joseph Wilson, who had written a 2003 opinion piece challenging one of the White House's main justifications for an invasion of Iraq.
Wilson had been dispatched to Africa by the CIA in late 2002 to investigate claims that Iraq had tried to buy uranium from Niger. He found no evidence to support this allegation. Nevertheless, the claim was included in Bush's 2003 State of the Union speech.
Cooper wrote in his e-mail that he'd been told by Rove that Wilson wasn't sent on the trip by either the CIA director or by Vice President Dick Cheney.
Cooper wrote: "It was, KR said, Wilson's wife, who apparently works at the agency on WMD issues who authorized the trip."
Novak jumps in
Cooper didn't write a story about this right away. But shortly after Cooper's exchange with Rove took place, syndicated columnist Robert Novak did publish a piece about Wilson.
"Wilson never worked for the CIA, but his wife, Valerie Plame, is an Agency operative on weapons of mass destruction," Novak wrote. He cited two "senior administration officials" as saying that Plame was responsible for sending her husband to Niger.
According to the Intelligence Identities Protection Act of 1982, it's a federal crime if anyone "as a result of having authorized access to classified information, learns the identity of a covert agent and intentionally discloses any information identifying such covert agent to any individual not authorized to receive classified information."
It's not my place to say whether Rove crossed that line in his discussion with Cooper. But I can say what I was able to do with the information Rove reportedly supplied.
First of all, I knew from published reports that the full name of the author of the critical op-ed piece was Joseph C. Wilson IV. A Google search quickly told me that he was born in 1949.
So I went to ZabaSearch.com, which readers of this space know is a powerful online people-search tool that rapidly combs through public records - - for free.
My first nationwide search for a Joseph C. Wilson born in 1949 turned up too many matches, so I narrowed the search by guessing that he likely lives in Washington, D.C.
Bingo. Now I had his home address. But I didn't know his wife's name.
So I went to the Web site of LexisNexis, a prominent data broker, and did a public-records search for Joseph Wilson in Washington, D.C., subsequently narrowing the search with Wilson's street address. Bingo again.
"Spouse name: Wilson, Valerie E."
For non-subscribers, LexisNexis is available online on a pay-per-search basis. It's also accessible via acquaintances at universities, law schools and a wide variety of private companies.
I did another LexisNexis search for Valerie E. Wilson in Washington, D.C. This confirmed she lives at the same address as Joseph C. Wilson. It also took me the next step.
"Former name: Plame, Valerie E."
I now had the identity of a covert CIA agent (who was using her maiden name as part of her cover as an energy-industry analyst working for a firm called Brewster Jennings & Associates, now known to be a CIA front company).
It took me less than a half-hour to identify her.
I then went back to Google and got a map of Plame's neighborhood and directions to her home. Google also allowed me to study a high-resolution satellite photo of Plame's house.
I could see that the property appears to be in a quiet residential community and looks approachable from all sides. It also offers ready access by car to major thoroughfares.
And I now possess all this information simply because I know (from Karl Rove, via Matt Cooper) that Joseph Wilson's wife "apparently works at the agency on WMD issues."
Little effort required
Rove's questionable judgment aside, this episode underlines how little effort is required in this info-rich age to identify and locate virtually anyone. You don't even need that person's name.
This should alarm anyone who relies on a measure of secrecy for his or her well being, as well as all others who value their privacy.
It also should serve as a wake-up call for legislators that existing privacy and national-security laws haven't kept pace with dazzling improvements in information technology.
The intent of current laws might be to keep certain info under wraps. The reality is that nearly all data are exposed and accessible, there for the taking by anyone with a computer and a small measure of resourcefulness.
With little effort, I pinpointed a working CIA agent. I did so only to make a point.
Can we be sure that the intentions of the next person to commence such a search will be as benign?
David Lazarus' column appears Wednesdays, Fridays and Sundays. He also can be seen regularly on KTVU's "Mornings on 2." Send tips or feedback to dlazarus@sfchronicle.com.