About this blog

Bob Sullivan

Corporate sneakiness. Government waste. Technology run amok. Outright scams. The Red Tape Chronicles is MSNBC.com's effort to unmask these 21st Century headaches and offer real solutions that save you time and money.

Bob Sullivan covers Internet scams and consumer fraud for MSNBC.com. He is the winner of multiple journalism awards for his coverage of online crime and author of Gotcha Capitalism: How Hidden Fees Rip You Off Every Day and What You Can Do About It. and Your Evil Twin: Behind the Identity Theft Epidemic.

Got some red tape you want Bob to untangle? Write BobSullivan@
feedback.msnbc.com.

Can we stop the sale of cell phone records?

Posted: Tuesday, January 17 at 08:00 am CT by Bob Sullivan

There is finally some buzz around the crime of impersonation to steal customer information, such as cell phone records. Data criminals have advertised such unsavory services openly, with impunity, for years. Now, people are noticing.

Let's review quickly: Criminals pretend to be you, get a copy of last month's cell phone bill and then sell it for about $100. The practice should scare anyone, even if you think your call history is fairly tame. What if your boss got it and used it to claim you were goofing off during work hours? What if your soon-to-be ex wife’s lawyer had a peek? Of course, the practice is even more scary to law enforcement types and their ilk.

Lately, the issue has gotten attention, spawning a new literary genre: the writer who buys a prominent person's cell records, then pens a dramatic narrative.  The most recent is a blogger who bought former presidential candidate Wesley Clark’s records.

But the issue of customer service record privacy cuts much deeper than cell phone records, and requires much more than dramatic headlines or political grandstanding.  Every time a piece of data is collected about you -- from the milk you buy at the grocery store to the toll you pay on the turnpike -- it can be stolen.  It's time to talk about that.

The recent spate of news stories does have politicians jumping on the bandwagon.  Gov. Rod Blagojevich of Illinois this month proposed legislation to ban sale of cell phone records. New York Sen. Charles Schumer is expected to propose similar legislation at the federal level soon.  And both the Federal Trade Commission and the Federal Communications Commission are investigating, according to Rep. Edward Markey (D-Mass.).

Companies have reacted, too. Verizon and Cingular have filed lawsuits in an attempt to shut down some Web sites that advertise the practice.  On Friday, a Federal Judge granted a temporary restraining order at Cingular’s request, calling on a Web site named LocateCell.com to stop advertising the unsavory practice.

LocateCell has gotten a lot of media attention of late. A Chicago Sun-Times reporter this month hired the company to look up his own cell phone records.  It was also featured in a recent NBC News story by Kevin Tibbles.

Tip of the iceberg
All this activity is good, and long overdue.  But shutting down LocateCell will do very little to stop the overall problem of stolen consumer records.  Hundreds of other Web sites -- almost all of them run by digital-age private investigators -- will continue to obtain and sell cell phone records. And even if wireless providers start piling up the lawsuits, ravaging the stolen mobile bill industry, it’s important to know this problem goes far, far beyond cell records. A quick internet search reveals that these same companies offer to sell everything from bank account information to OnStar automobile tracking records.   

This is why privacy wonks get so excited about our culture of rabid data collection. Perhaps it's not so bad to let your grocery store track your milk purchases if everyone involved in the data chain is honorable. But sometimes, they’re not. If there's a record, it can be stolen, cajoled from a confused customer service professional or bribed from a corrupt one. What $8-an-hour phone rep wouldn't consider an offer of a quick $50 to divulge someone's milk-buying habits? Particularly if that phone rep isn't even in the U.S., isn't even subject to U.S. criminal law?

Passing more laws that make theft of personal records illegal isn't a bad idea.  Putting LocateCell out of business isn't a bad idea. But to security expert Avivah Litan, a Gartner consultant, that's simply sticking your finger in a leaky dam. Ultimately, companies that possess our data need to be held responsible, she said.

"Who gave the criminals the data? They did," she said. "They should be suing themselves."

Time to pay the piper
Litan consults with companies that are concerned about leaking data; often they call her after an embarrassing incident.  She says there are effective technologies that can be used to deter the theft of data, and firms that keep track of us need to start ponying up the cash to protect us. She generally has two recommendations.

The first is simple, but effective: It's called "out-of-band authentication.”  Call your wireless firm asking for records; you receive a text message with a PIN number that must be supplied to the customer service rep before the conversation proceeds.  Visit your online broker and try to change your automatic deduction settings? You get an old-fashioned letter in the mail. Out-of-band notification isn't fool-proof, but it sharply increases the odds that the person calling the company is really the person who's entitled to the information. By sending a simple text message to your cell phone, the wireless company can be pretty sure they are talking to the person who is holding their phone.  That would stop many thefts such as those allegedly committed by LocateCell.  And it has the added benefit of notifying consumers every time their records are accessed.

But out-of-band notice doesn't go far enough, Litan says.  Much of this data theft is the result of a corrupt insider, who can evade such practices.  So an even better solution, she said, is "out-of-character" testing.

Consumers know this technology well. Every time you take a trip to Europe, your credit card company calls to ask if that's really you buying the Irish sweater in Dublin.  In the business, it's called "transaction anomaly detection."

Similar software can be used to watch the actions of customer service representatives.  Someone who suddenly accesses several dozen records at the end of a shift probably isn't being suddenly productive; they're probably stealing.  Likewise for an agent who normally helps consumers in the northeast who suddenly looks up a Utah caller's records.

"I would say 95 to 99 percent of the (fraudulent) transactions are out of context with the normal flow of work," Litan said.  Companies can implement such solutions for around a half-million dollars; a small price to pay for such essential consumer protection.

There ought to be a law
That's not to say criminals shouldn't also have to pay. Security Consultant Rob Douglas, who runs PrivacyToday.com, helped the Federal Trade Commission run a sting against data theives in 2000. At the time, he found 1,000 Web sites claiming to sell such information; a similar number still advertise stolen data, he said.  Part of the reason, Douglas says, is a lack of clarity about the illegality of the practice of calling up a company and pretending to be someone else for the purpose of obtaining information -- called pretexting, or calling under a false pretext.

Federal law does explicitly make pretext calling to obtain financial records illegal. But the legal question is a bit more murky for data such as cell phone records. It might be identity theft; it might be an unfair and deceptive trade practice, and thereby run afoul of the Federal Trade Commission Act. But to end the discussion, and to cut off the legal running room the data thieves claim, Douglas is in favor of a federal law which makes pretexting explicitly illegal.

“Until Congress makes it absolutely clear that pretending to be someone you are not in order to deceive any business into turning over customer information is illegal, the practice will continue,” he said.  “Outlaw the practice for just phone records and the data thieves will turn to cable and satellite television records."

Few options for consumers
For now, consumers are left with some scary headlines and very few realistic options.  Adding an additional password to your customer service records is a good idea -- Cingular now recommends it. But that's a hassle, and few consumers will do it. Watching your accounts for signs of suspicious activity couldn't hurt. Asking customer service reps to tell you when the last time your records were accessed might tip you off that someone else has looked up your account.

Still, those practices won’t stop a determined criminal.  If there are records, they can be stolen, Litan said.  And there’s little consumers can do to drop out of the big database in the sky that tracks what we buy, where we travel, and whom we talk to. Such databases are a gold mine for anyone who might want to spy on us.

“There really is nothing we can do to stop the flow of information," Litan said.  “We have to rely on the companies that have it.”

MAIN PAGE NEXT POST Beware magazine renewal junk mail

Email this EMAIL THIS

39 COMMENTS

i want to trace my wifes disconnected phone number to see who she was fucking

Bob --
I could say much to add to the chorus of complaints about such scams, but I'm writing merely to congratulate you on your valuable work. In my late fifties, I've simply grown too weary of the many ways . . . we prey on one another to do anything about it, and I admire anyone who does. I've noted many of your other columns and believe wholeheartedly that your lonely voice, and a few similar, are desperately needed to just clean up such arrogant treatment. All these "deals" are just part of the noise that steals something essential from life, and getting burned by their lies only makes it all sting more. Blah, blah, blah ... too idealistic perhaps, but . . . thanks. G. Abdian, Seattle

Interesting so many people are upset over this - but if the offending companies presenting this activity as part of the "War of Terrorism" would so many oppose it?? Yet there is no difference in what is being done - just how it is packaged.

How about this- start a campaign to collect as much PERSONAL and SENSITIVE information about as many Congressmen and Senators as we can- then POST IT ALL ON A WEBPAGE. Perhaps if they see their stuff exploited, sold, and used for illegal purposes it will then cause them to remove their heads from the 4th Point of Contact!

Undoubtedly, you're doing a very useful job by investigating aberrant -an not necessarily illegal behavior, whatever that means, both by individuals and businesses. And this world was. is and will continue to live in such an environment. But what goes unmentioned, unpublished and un-investigated is the cause that force all these folks to try to screw each other. It's simply a sense of survival and desperation. But why? It' simple deduction my dear: As long as we have "legal" political regimes stuffed with millions of corrupt politicians and rapacious bureaucrats. armed with trillions of laws, rules and regulations to deprive the populace of its dignity and possessions (read confiscatory taxation), we're gonna have this aberrant behavior {crime in bureaucratise parlance). So, you'll be well advised to be less pious and try to focus your attention towards what our Masters (of disaster)inflicting on us and less on what we are forced to inflict on ourselves. But I forgot: Under the "freedom of information" laws, this elitist class of people is untouchable.

This article only touches on the fact that companies export our data for foreign countries on a regular basis. There are not enough jobs here, yet companies are offshoring our data (and jobs) for profit, where we cannot enact any kind of legistlation/rules for protection. I personally feel like this: I live in the US, earn and spend my money here, and I don't want ANY of my data, for ANY reason, send outside the borders of this country. Please write your congressmen/women if you have similar concerns.

Locatecell.com is still up and running (Wednesday 1/18/06).

When Soc. Sec. was introduced, FDR said the number would not be used as a national ID. Now you can't claim a kid as a dependent unless the kid has a SS#. You can't get a job without it. You can't get most kinds of health care wthout it. How many uses has the govt. tagged onto the SS#? They require you to have this number, and once you have it, it has you. You can never escape from it. Anytime I'm asked for my SS# in an application for whatever, I leave it blank. If they want it, they've got to give me a darn good explanation why.

How about the Credit Bureau? It keeps records of you, not only by your social security but by any name that any company or any source that considers you to be the person they are seeking or did wrong to them, then it is up to YOU to prove them wrong, only if you have the means to fix it, they have a BIG power in this country, they can ruin your life. Just try to fix their wrongful information, and frustration takes over. It is about time to address these invasion of privacy and wronful informations issues, problems that are plaguing the system and making our life very complicated to live.

Since we are or should be the legal owners of all our personal data, we should be paid royalties everytime that data is sold, complete with quarterly statements showing who accessed which of our records and when.

Privacy already exists as a constitutional guarantee under the clause of unenumerated rights in the Bill of Rights. Although not explicitly enumerated, privacy is respected as a right from the amendment as demonstrated in Griswold vs. Conn. and other cases. However, if the executive branch does not respect a right to privacy (Hello, NSA?), why should companies that collect personal information and outfits that bootleg your ss# care about YOUR privacy? The problem is systemic and, sadly, completely typical. Invest in a shredder, and keep your personal info in your mattress.

Glen Schlueter is exactly right! We need to make a personal and major break with a marketplace rigged against us. And yes, it IS possible, and actually makes life better. I don't shop on the net, I don't have cable, I don't use a cell phone, and I don't have the internet on my home comupter. Quality of life? Excellent! It is only when you give in to the greed merchants that they can control you!

Why not just make all records public? Make everyone's SSN public, make everyone's credit report, annual salary--everything--pulic? It's simple supply and demand and when you make data scarce because only certain people have it or can get it (supposedly) it makes that data valuable. Take the value away. If everyone was "public", there would be no demand. My 2 cents.

Getting to the root cause of this is the place to start. Recklessness is part of the cause and false trust is part of the cause. I am always greatful to a store clerk that asks to see my ID when paying with plastic. There are so many places where I shop that don't even look at the signature. Think about how easy it is to pay with someone elses card when it is never looked at.
My local pharmacy offers a discount card and I filled out the application with false information so I couldn't have my purchases traced back to me or my personal information sold but can still get the sale prices.
With everything being computerized why do we have paper files in the doctors and dentist offices anymore. With scanners and hard drives with so much space couldn't they save this information electronically and then in the future take your information in a laptop or tablet PC? We all pay enough for medical and prescription coverage that this is not an outrageous request. But if they aren't held liable what is the motivation?
The tanning business that I used to visit uses a fingerprint scanner to prove it is you when you visit. Why couldn't they do this at a doctors office to have authorization to view all your records and have limited viewing when it is a telephone consult?
So much technology is used to collect our information but none of it is used to protect it. This shows how much greed takes a role in things, protection costs money and the alternative doesn't cost a dime.

This behavior usually leaves a credit card trail a mile long.

Wake-Up. Everybody is watching. From camera cops to satellite tracking, from email monitoring to wire taps, from library and DVD rentals to internet blogs. Even your friendly neighborhood groccer is on it. Who cares about privacy? And for those who do a word of advice: "It's almost impossible to enforce anything." Just don't break the law. Remember the song: "I fought the law and the law won." This also applies to the richest and most powerful folks around too. So what is the problem here? I just don't get it? Keep one credit card with a low credit limit (<$1500.00), stay out of debt and work hard. So someone stole your identity and so you do not get a loan? Who cares? It's your own fault in 99.999% of cases. You were just too damn careless with your own personal information. Use common sense and live simply. And all good things are yours. DUH!

I believe it's time to reexamine the necessity of the various "conveniences" that are marketed to the public as "indispensable".

Do we really need cell phones? Marketeers say we do, but I think for myself.

Snap out of it!

Cell phones...fad or necessity?

No cell phone = no cell phone bill.

I see that these "conveniences" are making life more diffcut all the time.

Can ya hear me now?

Why don't we just keep passing bad laws that no legitimate business could ever comply with and even if they did we and all hire ourselves a nice tassel loafer wearing liberal lawyer and sue them anyway in class action suits till we have no more businesses here in the United States.
After we wipe out all the small businessses and force the large corporations to move overseas we can all sit around and whine 24/7 since we no one will have a job anyway.
This will take a while because our courts move very slowly but until then get used to paying double or triple to get your teeth cleaned and $1000 per month for cable, internet access or a cell phone since business will just pass on the cost of doing business to the consumer.
There is no free lunch any obstacle you place in the way of others will come back to you too.
And one last thing, if you think Eurpoe or wherever is so great go there for awhile and if you like it feel free to stay, but mostly likely you will come back and kiss the ground.
This country, it's governmant and it's laws are not perfect just better than anywhere else.

Here Here! on Chris Newton's Comment. They are using the internet to conduct fraudulent operations. Their Internet Access needs to be revoked. That would do a lot toward eliminating their presence.

The downside to adding security (as we have found) is that when information is for a corporate piece of hardware (or telco service) and the person leaves or is fired, it takes an Act of Congress to get the Vendor to close the account or change the billing back to the corporate entity. Not a problem with the big carriers that we have existing relationships with, but all the little independents finally change the address after they haven't been paid for months and THEN want us to cough up all the d*mn late fees for charges we wanted to pay them months ago, but they wouldn't send to us!

If someone paid a friend to make the call as a setup to get money for unauthorized release of personal information, consider this:

Regardless of who got the info, even if it only went to the customer himself, the fact that it was obtained without proper authorization proves the company isn't properly safeguarding the data. They shouldn't be able to get away with it, because it opens the door to much more dangerous violations.

Excellent article, but only addresses a very small part of a much larger issue. Our laws, and the legal system in general, are basically unconcerned about the victims of crimes. Until we get to a point where victims are compensated and criminals, especially white collar criminals, are given more than a slap on wrist, there can be no solution to the problems of crime in the USA.

If they shut down www.locatecell.com why is it they are still taking orders on their web site? Someone needs to take the domain away from them!

Whose to say that someone wouldn't pay a friend to call, giving them their information to obtain personal records, and then pocketing the $1,000 for themselves, in essence, by stealing their own information. There needs to be more thought given on this subject, but I agree something should be done.

I would like to see laws that require a minimum standard of security for all businesses that collect data on others. Businesses should be subjected to unannounced inspections.

Restaurants are required to maintain standards for cleanliness and food storage. Public health inspectors arrive unannounced and provide a report that restaurants must publicly display. Some local television news programs have regular segments that expose the worst offenders and praise restaurants that receive a 100% score.

Health inspections are an accepted part of business in the restaurant industry. The same analogy applies to businesses collecting our data. Low security standards subject us to unnecessary dangers.

Dental and medical records are a great example of low security. They contain the data required to get credit in your name and they’re readily available to employees and probably the cleaning crew too. My dentist can’t lock the rows and rows of multicolored dental records. I expressed my concern to him. He says he trusts his employees and the cleaning crew members are bonded. Give me a break! I’ll be changing dentists when I find one that takes my data security concerns seriously.

Consumers must demand that our data is protected. Tell the non-responsive business you’ll be taking your business elsewhere. Let your lawmakers know that you object to anyone selling your cell phone data or any other information without your permission.

http://www.IdTheftAwareness.com

I also recommend a statue that would be for at least a three-year period. This allows a person who was wronged by the theft of their identity and could recover significant damages that happened much longer after the theft, like: false imprisonment of an innocent party due ID THEFT RECORDS FALSELY PRESENTED to law enforcement (drivers license), lost wages, damage to employment and reputation. The more severe ID Theft requires robust elements to punish severe ID thefts. This statute must deal with criminal activities that may occur much later after the ID Theft and with more severe damages as noted above. (This has already happened over a year later.)
Richard Eastburn, Akron Ohio

I’m not sure there is a way around this. Our ‘contract’ society is based on getting around the law, or for a better way to say it: getting around the agreement. (After all law is the agreed upon standards between the citizens and the government.) Politicians are extremely astute at it, large corporations have the resources to bury any individual such as myself.

So not that this would be an end all solution but….
I would feel more comfortable if there was an amendment to the constitution guaranteeing my right to privacy.

hi i am in favor of such alaw, that would hold companies liable for the information they hold

This is all part and partial of the identity and privacy theft epidemic we are experiencing. What is most outrageous about this is that it IS the large companies - your bank, the phone company, your broker (assuming you have a job), insurance companies, etc. - that are responsible for this to begin with. Now, I notice my bank and VISA trying to sell me "identity theft protection". This is more than a little like the old protection racket.

Fact: Everyones data is always misused.

Ever go on a date with someone whos best friend is a pharmacist or works in the medical, financial or other sensitve industry. He/she can easily have you checked out.

I'm a database architect and work with large financial systems daily. (millions of records) It always suprises me at how eager companies are to collect data on their clients and are rarely concerned about who in the company is accessing it and for what reasons.

Safe guards are needed to prevent unauthorized access but what happens when that access has been breached. How would you or anyone know?

Every access of a client record should be time stamped and logged right down to the user level, authorization and reason. 99% of the time this is never a concern or addressed.

You should be able to call a company and ask who (employee or anyone)last accessed your personal or account information and for what reason. Doesn't matter if its a quick address check.. general data mineing.. reporting ... anything at all... If they can't tell you then they don't respect you and don't deserve your business.

Todays systems can handle it and its very simple to do. If you've heard otherwise your not talking to the right people.

There is yet another tactic you can use:

USE CASH. Whenever possible.

Purchases made with cash don't leave a traceable record, assuming you don't use a customer card or account.

Similarly, use and careful disposal of a calling card will leave no easily traceable record in your name.

To a large extent, privacy IS still maintainable, though it requires some effort in a time when businesses seem hell-bent on collecting all the identifiable information possible.

The theft of my property as in the previous blog is worth far more than 1,000 dollars it is and should be worth one million dollars because that is about what it would take over time to restore my name.

Right on Mr Denninger but it will never happen. Why? Because every congressman and senator uses stolen data in his or hers campaign to gather money.

We all provide to much information wasy to easily.
just your socil security number alone. every one wants it but how many are actually entitiled to gettintg it. I think DR's and hospitials arer among the worst when it comes to asking for it.

I ALWAYS put a password on my accounts. Cell phone, real phone, cable, etc. It is generally available. For instance, when you're asked to provide your mother's maiden name for account setup - give SOMETHING DIFFERENT that only you would know - like Marvin or Daffy Duck or something. When you're asked when you call - if you don't give what's in their system, you don't get the data. That was the original idea (I assume) of asking for you your mother's maiden name, but that sort of information is much more easily found nowadays than it was in the past.

Mr. Denninger should consider running for public office. It seems too many times legislation is passed to protect companies from consumer error or greed but little legislation is passed to protect the consumer from corporate error or greed.

LocateCell.com is still in operation as of Tue., Jan. 17, 2005 @8:00am MST.

European personal laws and rules are significantly ahead of those in the United States; there a person's information belongs to the individual. In the US, big organizations (such as Experian, Equifax, and Transunion) collect and "own" personal information (address, phone numbers, social security numbers, purchases, patterns) which they sell. These organizations avoid or deny any responsibilty for maintaining accuracy or control of appropriate use of the data and share none of the proceeds or profits with the people whose private information they exploit. The burden of checking, verifying, and correct wrong information is placed on the individual. The organizations charge a person to get their information and then make it difficult to correct the information though they claim otherwise.

The organizations "claim" they provide a valuable service, but to whom? It is time for voters to take back control of their personal information from the organizations and special interests who have so long abused and exploited them. The growing damage from, and risk of, identity theft makes this even more imperative.

There IS something we can do.

We can treat any information that a company holds as your private property, and attach a value to it by statute.

Divulging it is then theft of your property. You then are entitled to that stautory value for each time you are violated.

Companies would take a LOT more care if they knew that every time they gave your cell phone records to someone who wasn't entitled to them it would cost them a cool $1,000 - and you'd get the money. Make it small enough that you can sue in small claims, but large enough that a wholesale breach of privacy will imperil even the largest of companies.

In addition, make the data-holding firm strictly liable for treble damages for all costs you incur due to a breach. The "punitive damages" clause would mean that if someone stole your phone records and then used them to break into your home, you could recover three times the value of what was stolen from the phone company - plus the $1,000, of course.

And let's not stop there. This same principle - but with a much larger dollar figure - should apply to your medical records. Every doctor's and dentist's office I've ever seen has all their patient's medical charts right there - in many cases right behind the reception desk - with zero security of any kind.

Its time that this nonsense stop. That's YOUR data, not theirs. Let's start treating it that way.

If we were to pass this sort of law you'd suddenly see the "impossible" problem get solved - like, for instance, the out-of-band notification your cell phone.

SEND A COMMENT

PLEASE READ: All comments must be approved before appearing in the thread; time and space constraints prevent all comments from appearing. We will only approve comments that are directly related to the blog, use appropriate language and are not attacking the comments of others. Firms mentioned in our comment area are welcome to add their own comments.

Message (please, no HTML tags. Web addresses will be hyperlinked):

TRACKBACKS

Trackbacks are links to weblogs that reference this post. Like comments, trackbacks do no appear until approved by us. The trackback URL for this post is: http://www.typepad.com/t/trackback/454638/4055788

BUY BOB SULLIVAN'S NEW BOOK

Cover_crunched_by_media Bob Sullivan's new book unmasks hundreds of hidden fees and offers step-by-step instructions on how to fight back. Order it here.

Also available as an audio book.