Schneier on Security

Davi Ottenheimer • March 29, 2005 11:24 AM

Excellent find. I thought this paragraph sums things up nicely:

“Mr. Chairman, hindsight may be 20-20, but it is remarkable to us that ChoicePoint had the audacity to write such a letter [regarding their compliance with the FCRA] when it already knew that state investigators had uncovered the fact that the company had sold information on American consumer to an identity theft ring. They were accusing us of inaccuracy at the same time that state and federal prosecutors knew that Choicepoint, a company that offered services for business credentialing, had exposed more than a hundred thousand Americans to a heightened risk of identity theft because it sold data to crooks.”

Hindsight, indeed. Senator Boxer and Feinstein were not only correct to fight for their amendments in 2003 to the 1996 Fair Credit Reporting Act (FCRA) but they also were clearly facing an uphill battle against entrenched big-business lobbyists from ChoicePoint.

If you remember the US conservatives and financial industry said they opposed the amendment because it “would devastate the sharing of information that has helped make consumer credit more available and less expensive”.

Senator Shelby even claimed, in one of his more famous statements, “from a consumer perspective, there is no difference between a company sharing information internally between departments and sharing between affiliates.”

Oh really, my fine Republican friend? What if one of those affiliates is a criminal organization? What if there is no penalty or accountability for selling customer data to organized crime? Your “significant improvement over existing law” was a start, but you sold America a paper tiger that continued to give big business the green light to unjustly ruin US citizens’ lives for profit.

In review, Choicepoint’s business model was about making money hand over fist with a shrewd manipulation of trust. This was backed by a Republican-led anti-regulation agenda that big identity warehouses used to say fraud and theft were not their problem.

Consider this:

ChoicePoint billed itself as privacy and security champion in such a way that people bought their information because they believed they could trust it. They lied to manipulate the market and abuse trust for profit. The result is that ChoicePoint did the exact opposite of its promises and actually contributed to identity theft.

Enron billed itself as an energy efficiency champion and marketed itself in such a way that it was trusted to manage state utilities. They lied to manipulate the market and abuse trust for profit.

But Rotenberg captures something that I believe is a key difference in these heinous crimes against the public: ChoicePoint actually believed that they were an arm of the government, helping Ashcroft wage an information war against the people who live in other countries:

“Choicepoint’s activities have fueled opposition to the United States overseas and raised the alarming prospect that our country condones the violation of privacy laws of other government.”

Davi Ottenheimer • March 29, 2005 10:41 PM

@waynesworld
Yes, ChoicePoint openly stated that they were serving as a front to the US government (I believed their CEO called their database one of “the best ways to use technology to combat terrorists and criminals”), and yes the countries in Central and South America actually sued ChoicePoint. It’s widely documented. I posted a bit about it here:
http://www.schneier.com/blog/archives/2005/03/choicepoint_say.html
And here:
http://www.schneier.com/blog/archives/2005/02/choicepoint.html

“Ashcroft is said to have paid USD$67 million to ChoicePoint for private information on every citizen of half a dozen nations.”
http://www.africaspeaks.com/articles/2004/11082.html