ChoicePoint CEO grilled by Congress

'If it's my information I ought to have access'
The most spirited exchange occurred between Markey and Smith, when the Massachusetts congressman challenged ChoicePoint to offer additional protections to the 145,000 consumers whose information was leaked by the firm.

ChoicePoint is offering credit monitoring services to all affected consumers, at a cost of about $2 million, Smith said. But Markey noted that identity thieves armed with that data can simply wait one year and then use it to commit crimes.

"Will you give my constituents five years? Two years?" he asked Smith.

The ChoicePoint CEO said he would consider any proposals, but did not directly answer the question. Markey then added, "This is absolutely preposterous. ... We not going to get the answers we need in this panel."

Markey has sponsored a bill that would give the FTC greater oversight of the commercial data brokerage industry. His law would make commercial data brokers like ChoicePoint subject to the Fair Credit Reporting Act, which would give consumers the right to dispute information contained in their files.

ChoicePoint itself cannot correct errors, Smith said. Consumers must go to the original source of information and get them to fix the mistakes.

Rep. Gene Green, D-Texas, referred several times to an MSNBC.com story about consumers who had received their ChoicePoint reports and found multiple errors in them. All consumers, Green said, should be able to see the information the firm has on them.

"If it's my information, I ought to have access to it," he said.

Smith said consumers are entitled to see most ChoicePoint reports for free once each year, because some of the company's data is regulated by the Fair Credit Reporting Act. He also said he supported the right of consumers to add comments to their files if they believe data is in error, similar to comment areas on consumer credit reports.

However, ChoicePoint itself cannot correct errors, he said. Consumers must go to the original source of information -- a public record, for example -- and get them to fix the original mistakes, Smith said.

'Dirty work for Big Brother'
Rep. Jan Schakowsky, D-Ill., questioned Smith about why the firm disclosed in a recent SEC filings that it was only looking for victims from the data leak incident whose information had been stolen after July 1, 2003, the effective date of the California notification law.

"I would assume the numbers are higher than 145,000," she said, suggesting the firm was using a technicality to avoid notifying additional consumers.

Interactive Identity theft What to do when it happens

Smith said ChoicePoint was continuing to research the number of victims. Company representatives have previously said they did not expect a "significant increase" in the original estimate of victims after its investigation is complete.

Schakowsky also chastised Smith for being unaware of prior security incidents at the firm that have recently come to light, including a 2002 theft by criminals using similar methods. Two suspects were convicted in connection with the 2002 incident.

"I am surprised you would have been unaware ... of the criminal convictions," she said.  "How could that happen?"

Smith said ChoicePoint was regularly involved in many incidents involving law enforcement research, and in the past, he had not been routinely notified.

Schakowsky said she was also concerned that federal law enforcement agencies had signed contracts with ChoicePoint, and that taxpayer funds were paying for the data.

"The Privacy Act made it illegal for government to amass the kind of information that data brokers do," she said.

"While it's not a breach of the law, it's a breach of the spirit of the law. We can't do that kind of data collection, but we can purchase it. ... We did not realize that big business would do the dirty work for Big Brother."

More congressional hearings on the ChoicePoint incident and proposed federal privacy reforms are expected. Sen. Arlen Specter, R-Penn., chairman of the Senate Judiciary Committee, has said he will hold hearings, but they have not yet been scheduled.

Wednesday, the California state Senate will hold a hearing in connection with the incident. Several ChoicePoint executives and consumer group officials are expected to testify.

Bob Sullivan is author of Your Evil Twin: Behind the Identity Theft Epidemic.

MORE FROM SECURITY

Security Section Front

Internet activists push for greater democracy EU assembly adopts Internet, phone user rights 'Mr. Right' grifts widow's $50K in Web scam U.K. cops arrest people ‘just for the DNA’ Virus attacks ‘jail broken’ iPhones China attacks ‘biased’ U.S. cyber-spying report Chinese military Web site target of cyberattacks FBI: Hackers targeting law and PR firms House pushes ban on peer-to-peer software Facebook hit by ‘Control Your Info’ intruder Security Section Front   Add Security headlines to your news reader: