Telltale number. Almost anyone who owns a
computer can access data on millions of fellow citizens. |
At the beginning of September, a computer consultant in Oregon put up a World Wide Web page where visitors could find out the name and address of any car owner in the state simply by typing in a license plate number. Aaron Nabil of Bend had legally purchased the information--all of which is in public records--from the Oregon Department of Motor Vehicles for $222. Faced with complaints from thousands of people, including the governor, John Kitzhaber, Nabil has suspended the site's operation for the time being.
But Nabil is only a small-time operator when it comes to presenting prominently information that many would prefer to keep from public view. For the past few weeks, the Internet has hummed with belated concern about the 300 million names and addresses filed in P-TRAK, an electronic locator service run by database behemoth Lexis-Nexis. P-TRAK, which has been available to subscribers since the beginning of June, is generated by culling information from credit reports but does not contain any financial information. Rather the records contain people's names and addresses (both current and previous), birthdates, telephone numbers and Social Security numbers. Although P-TRAK no longer displays Social Security numbers, one can work backward and retrieve records by Social Security number; it is therefore possible to assemble a complete set of information on a particular person.
On supporting science journalism
If you're enjoying this article, consider supporting our award-winning journalism by subscribing. By purchasing a subscription you are helping to ensure the future of impactful stories about the discoveries and ideas shaping our world today.
There is nothing illegal about P-TRAK, which is precisely why it has aroused such concern. The rise of the Internet and of various searchable, dial-in databases is permitting unprecedented access to public but sensitive details. Many observers have suggested that the information contained in P-TRAK would be sufficient, among other things, for an unscrupulous user to impersonate someone in dealings with financial or other institutions.
Lexis-Nexis anticipated that some people might object to being listed in P-TRAK and set up a toll-free number for those who wanted their names removed from the database. So many people called, however, that the company quickly switched to accepting requests only by mail, fax or Web. Lesley Sprigg, Lexis-Nexis spokesperson, declined to say how many people had opted out so far. She also stated that the service had been started largely as a competitive reaction to products offered by other firms, including Web sites and CD-ROMs containing searchable, national telephone directories, such as WhoWhere?, Switchboard and Four11.
Sprigg claims that Lexis-Nexis conducts checks on all its clients before signing them up for P-TRAK; the company's terms and conditions include strict limitations on the use of information in its databases. A typical user of P-TRAK might be an estate attorney tracking down missing heirs or a Fortune 1000 company searching for pension beneficiaries. (The company's promotional material paints a somewhat different picture, however, highlighting the ease of finding people who use multiple aliases, own no property and do not have listed telephone numbers; nor is there any kind of company policy statement about how P-TRAK data should or should not be used.)
Regardless of what eventually becomes of P-TRAK, the controversy over the database--which sits in the hands of one of the largest information retailers in the world--has focused attention on the question of who should have access to even the most rudimentary personal information. Organizations such as the Electronic Privacy Information Center (EPIC) are raising the alarm about the dark side of rapid increases in central-processor speed, hard-disk storage capacity and modem bandwidth. These days, almost anyone who owns a computer can keep files on millions of fellow citizens if their data are available in electronic form. As a result, Internet libertarians are feeling an acute tension between the twin goals of unfettered exchange of information and personal privacy.
Unlike virtually every other industrial country, the U.S. has no comprehensive regulations restricting the collection and sale of personal data. But there are signs that the situation may be changing. Representative Gerald D. Kleczka, a Democrat from Wisconsin, has introduced legislation that would prohibit use of Social Security numbers (currently the most widely used identifying key) in commercial databases without a subject's consent. If enacted, such a law would give consumers significant leverage in determining how their names, buying habits, financial track records and medical profiles are traded on the increasingly open market.