SCHUMER: EGREGIOUS LOOPHOLE MAKES MILLIONS OF SOC. SEC. NUMBERS ACCESSIBLE

[paineinthearse]

Previously started at http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=104x3170255

Re-started to lead with Schumer press release.

Source: http://schumer.senate.gov/SchumerWebsite/pressroom/press_releases/2005/PR41493.Westlaw.022405.html

FOR IMMEDIATE RELEASE: February 24, 2005

SCHUMER: EGREGIOUS LOOPHOLE MAKES MILLIONS OF SOC. SEC. NUMBERS ACCESSIBLE AT TOUCH OF COMPUTER BUTTON; POTENTIAL FOR IDENTITY THEFT ENORMOUS

Anyone Who Pays “Westlaw” Gets Access to Millions of Soc. Sec. Numbers, from Paris Hilton’s to Dick Cheney’s Without Their Knowledge or Permission

With So Much Personal Information Available in Addition to Soc. Sec. Numbers, Making Chances of Identity Theft Much Higher

Schumer Asks Company to Disable SS Number Searches, Implement Stricter Checks on Access by Clients’ Employees, Interns

Identity theft costs consumers and businesses an estimated five billion dollars per year. Many recent news reports have focused on large scale identity theft by individuals stealing personal information from data mining companies like Choice Point in Georgia. U.S. Senator Charles E. Schumer, a member of the Senate Finance Committee and the Banking Committee, wrote a letter today to the head of Westlaw, a data search company based in Minnesota, asking that an egregious loophole in their Internet-based ‘People-Find’ be disabled for use by its clients. This letter is a follow up to Schumer’s phone conversation with the President of Westlaw, Peter Warwick, earlier this month in which the Senator asked exactly who may have access to their “People-Find” database and strongly recommended Westlaw disable it until better protections were in place to prevent misuse by clients.

Schumer said, “This egregious loophole makes millions of Social Security numbers available at the touch of a computer button. Average Americans are just as vulnerable to identity theft as Vice President Dick Cheney and supermodel Paris Hilton. The employees and interns of corporations, the Federal court system, and the United States Senate do not need unfettered access to millions of Social Security numbers and other private information.”

“Westlaw’s ‘People-Find’ service might as well be the first chapter of ‘Identity Theft for Dummies.’ Criminals no longer need forage through dumpsters for discarded bills - they just need to send Westlaw a check and they're in the identity theft business,” Schumer said in his letter to Warwick. “Any Westlaw user who pays for your ‘People-Find’ database can obtain the social security number of virtually any person in the United States.”

This loophole was brought to the Senator’s attention by a constituent who works for the federal courts who then contacted a Schumer staffer who confirmed that the Senate office also has access to this feature. We have also learned that private companies (and their employees/interns) subscribe to this service and have unfettered access to social security numbers.

“When I called Westlaw, I learned that this service is available to anyone who is willing to pay for it, regardless of their need for it and without cursory background checks. Westlaw relies on an on-your-honor affirmation by users that they will not use the information they find illegally.”

“I plan to introduce legislation in the very near future to plug these egregious loopholes allowing millions of Social Security numbers to be on the Internet.”

Schumer concluded, “Rather than receiving assurances that the problem would be remedied, my office received a letter from Westlaw’s legal representation that failed to address the central issue - that there are no real standards for keeping sensitive personal data out of the wrong hands.”

Attached is the letter to Westlaw President, Peter Warwick.

Attached is the letter to Senator Arlen Specter.

=========================================================

From the original post:

Live on CSPAN - Senator Schumer is describing a law firm that with a subscription, anyone's identity can be determined. Qualification is to be a member of the government agency or a private company.

No background check, no need to know.

Claims his office found social security numbers, home addresses, etc for 95% of all they tried, including himself, Pataki, Ashcroft, Cheney.

Spoke to company owner, asked to cease and decist. No action in two weeks.

Westlaw's lawfirm is Holland & Knight. Blew Schumer off.

Has asked AG to investigate.

More about Schumer press conference to follow......

[paineinthearse]

1. Schumer letter to Westlaw President, Peter Warwick.

http://schumer.senate.gov/SchumerWebsite/pressroom/Letters/2005/Warwick%20ltr%2002.24.05.pdf

Can someone with Adobe Professional please transcribe to text and post?

thanks

[RobertSeattle]

2. Url to press release

http://schumer.senate.gov/SchumerWebsite/pressroom/press_releases/2005/PR41493.Westlaw.022405.html

[paineinthearse]

3. Schumer letter to Senator Arlen Specter.

http://schumer.senate.gov/SchumerWebsite/pressroom/Letters/2005/Specter%20ltr%2002.24.05.pdf

Can someone with Adobe Professional please transcribe to text and post?

thanks

[shraby]

4. Originally when ss numbers were

given out, our cards said right on them, "not for identification purposes". Then the rules were changed, now look what's happened.

[paineinthearse]

6. Details?

I'n not so sure the rules were changed. Can anyone cite the operative federal law.

[sunnystarr]

18. The rules must have been changed

because my original SS card was issued in around 1953 (I was a kid then), I had it for years and right on the bottom front of the card it stated "Not to be used for identification." Subsequently my newer cards didn't have that statement either on the front or the back.

Originally there was a law against it due to the privacy concerns of Americans who were concerned about a National identity number, similar to present concerns about a Federal identity card. Once the majority of people didn't seem to care about privacy anymore it was quietly removed.

[ryan_cats]

19. I remember

I remember that. In fact, I think you have the right to refuse any request for you SS#. The only thing is, try to get a bank account or even direct tv without supplying one.

[aden_nak]

5. I'm an IT guy in a law office. Westlaw is a kids' toy compared to Accurint

No, seriously.

http://www.accurint.com /

What I've seen one of our contractors do with this site is just plain scary.

[kk897]

11. @#@#%*(&&#! That's LexisNexis! See my sig line!

It frightens me how easily such huge corporate database services could be used to gain political power. It's nice to be able to find information when you need it, but when ideologues get their hands on the data...it would seem to be nothing at all to expunge an inconvenient record here, a court case document there, a police report implicating something... This administration's secrecy is becoming so stereotypically Orwellian it would almost be laughable if the repercussions weren't so serious.


What We Do
Accurint® is a LexisNexis® service that brings data to life. Accurint provides information products that allow organizations to quickly and easily extract valuable knowledge from huge amounts of data. These innovative products are made possible by integrating powerful technology, tens of billions of data records on individuals and businesses, and patent-pending data-linking methods.

LexisNexis
Backed by more than 30 years of expertise in data management, LexisNexis is a leading innovator in validating and verifying identity. LexisNexis products and services help make intelligent hiring decisions, uncover fraudulent transactions, prevent identity theft, find missing children, track down terrorists, and prosecute white collar criminals.

For Additional Information:
For a product demonstration and a free trial call 1-888-332-8244. Accurint is a non-FCRA verification source.

http://www.accurint.com/aboutus.html

[EVDebs]

7. Combine this with Choicepoint and the SAIC (SanDiego) hacks

and potentially every US citizen's financial/healthcare record is accessible.

[paineinthearse]

8. self-delete

[paineinthearse]

9. ChoicePoint ID Thefts Prompt Hearings

http://abcnews.go.com/Politics/wireStory?id=528444

ChoicePoint ID Thefts Prompt Hearings
Congress Holding Hearings on Identity Protection Following ChoicePoint Scandal

By JESSE J. HOLLAND Associated Press Writer

The Associated Press

Feb. 24, 2005 - A Senate committee will hold hearings on identity theft and information brokers following the revelation that a databank with information on millions of people was accessed by criminals, the committee chairman said Thursday. Democrats, including Sens. Patrick Leahy of Vermont, Dianne Feinstein of California and Charles Schumer of New York, have been calling for a Judiciary Committee inquiry into whether more regulation of companies such as ChoicePoint Inc. that buy and sell personal data is needed.

"I got a letter from Senator Leahy yesterday on identity theft issue and I immediately said we can hold a hearing," said Senate Judiciary Chairman Arlen Specter, R-Pa. Specter did not give a schedule for the hearings.

Formed in 1997 as a spinoff of credit reporting agency Equifax Inc., ChoicePoint has 19 billion public records in its database at its suburban Atlanta headquarters, including motor vehicle registrations, license and deed transfers, military records, names, addresses and Social Security numbers.

<snip>

Schumer, too, plans legislation that would create federal rules setting conditions under which companies can provide or sell access to private information.


Senator Charles Schumer, D-N.Y., points to posters displaying personal information on Brad Pitt and Jennifer Aniston obtained from Westlaw's Internet-based "People-Find" data base during a news conference on Capitol Hill Thursday, Feb. 24, 2005. A Senate committee will hold hearings on identity theft and information brokers following the revelation that a databank with information on millions of people was accessed by criminals, the committee chairman said Thursday. (AP Photo/Dennis Cook)

[shraby]

10. My question is this:

Where did these companies obtain all the social security numbers??? Is the social security office selling them to the companies? Where else would they get the numbers except from the social security department?

[SmokingJacket]

13. I doubt the SS would sell it, but credit companies and banks might.

Should definitely be illegal to sell this kind of info.

[K-W]

20. They are in the records of lots of corporations.

And we all know how good corporations are about protecting our liberty.

[EVDebs]

12. The SAIC hack of our intelligence personnel is by far a bigger

and immediate danger to national security:

"And last month, burglars stole computers from Science Applications International in San Diego that stored personal data on tens of thousands of people, including former secretaries of defense, CIA directors and White House counterterrorism advisers"

http://www.mercurynews.com/mld/mercurynews/email/business/10921632.htm?1c

If they can't protect the spooks, they sure as heck can't protect Joe Sixpack. And already they've outsourced mortgage loan files (the holy grail of personal info) overseas with only the FTC's word that it's safe.

[paineinthearse]

15. See WP article for 2/14

http://www.democraticunderground.com/discuss/duboard.php?az=show_topic&forum=104&topic_id=3109256

[EVDebs]

16. I've recommended this for 'greatest page' ! PITA, also look into

Total Information Awareness via the CAPPS II project being offshored to the Bahamas with Ben Bell's company

http://www.zmetro.com/archives/000901.php

If you think our homegrown hackers can screw things up, just wait'll the Russians, Bulgarians, etc., etc., get ahold of our data.

We can thank those wonderful bankers who recinded GlassSteagallAct and opened up banking 'affiliates' into all kinds of cross-marketing b.s., which the customer pays for of course.

FTC isn't up to containing this kind of fiasco either.

[paineinthearse]

17. We need to clone Rep Ed Markey!!!!!!! nt

[IndianaGreen]

14. Thousands of students and paralegals also use Westlaw

for legal research. This is just peachy!

x(

[paineinthearse]

21. NYT - Senator Says Data Service Has Lax Rules for Security

http://www.nytimes.com/2005/02/25/business/25data.html

February 25, 2005
Senator Says Data Service Has Lax Rules for Security
By TOM ZELLER

As the fallout continued to spread from the news of a security breach at ChoicePoint, a company that inadvertently sold sensitive consumer data to thieves last year, Senator Charles E. Schumer, Democrat of New York, took aim at another data search service, Westlaw. He promised to introduce broad new legislation aimed at curbing identity theft. At a news conference in Washington yesterday, Mr. Schumer complained that any employee - from high-level managers to interns - of a company subscribing to Westlaw's databases could access sensitive records on millions of people, including Social Security numbers, previous addresses, dates of birth and other data that is valuable to identity thieves.

Mr. Schumer presented a parade of posters of well-known individuals whose information was available on Westlaw, including the former attorney general John Ashcroft, Vice President Dick Cheney, Gov. Arnold Schwarzenegger, the actor Brad Pitt and the heiress Paris Hilton. The posters obscured their personal data. The senator called on Westlaw to "immediately close an egregious security gap that risks making millions of Americans the unwitting victims of identity theft." "We saw what happened with ChoicePoint," he said, "but what Westlaw does makes what ChoicePoint did look like child's play."

Representatives of Westlaw, an online legal research service operated by Thomson West, a joint venture of West Group, based in Minnesota, and the Thomson Corporation of Canada, disagreed, saying in a prepared statement that "our terms of use restricting access go beyond federal law and current industry standards." Westlaw's 20,000 databases, which are used primarily by corporate, legal and government subscribers, house archives of statutes and other case law materials, but its People-Find databases, like those of other data warehousers including LexisNexis and ChoicePoint, also store some public and personal data on millions of American consumers.

These databases are stocked with information that is publicly available via court filings and phonebook entries, as well as with more sensitive information, such as Social Security numbers, that are purchased from third-party vendors like credit agencies. But Westlaw representatives say the company has only nine corporate subscribers - mostly large insurance companies - that may have access to the kind of data Mr. Schumer talked about. The only other subscribers with similar levels of access, the company said, are federal or regulatory agencies - including the United States Senate - and ideally only select personnel are given clearance.

more....


At a news conference on Capitol Hill on Thursday, Senator Charles Schumer displayed posters of celebrities and government officials whose personal data he said could be obtained by using Westlaw's data search service.

[noamnety]

22. I've bought data on a person before

I paid about $60 and supplied a guy's name and city.

I got back pretty much everything - the history of where he lived, his vehicles, wife's name, where she lived, his children, their birthdates, the SS numbers. For some extra money, I could have gotten his bank account numbers.

The verification was that I had to fax a form I signed saying I had a legal reason to have the info. I had a good reason to get the info (he failed to show for a discovery hearing after embezzling child support money). The reason I had to do it was that the court wouldn't handle collection unless they had his social, and legally they were prohibited from searching for it - which left me having to provide it for them.

I was completely shocked at how easy it was.