This essay is excerpted from Dragnet Nation: A Quest for Privacy, Security, and Freedom in a World of Relentless Surveillance, by Julia Angwin, published by Times Books.
I once ran into a friend and her husband at the playground in our neighborhood in Manhattan. As we watched our daughters—who are the same age—play on the jungle gym, the husband asked me about the articles I had been writing regarding privacy.
“I used to care more about privacy,” he said. I braced myself for the usual “I have nothing to hide” argument. But he surprised me with an entirely different approach. He said he realized that he “liked the idea of leaving artifacts” about his life more than he worried about his privacy. In short, he said, all this data was providing “immortality.”
I got a glimpse at this immortality when, as part of an “audit” I conducted to determine what information about me is out there, I peeked at the facts that data brokers have about me. This happened when I was sitting on Mike Griffin’s deck overlooking the Chesapeake Bay in the Baltimore suburbs.
Mike is a “repo” man who stumbled into the automobile surveillance business. He is tall and thin and filled with nervous energy. He seems to subsist entirely on coffee and cigarettes.
I was doing research for an article about the rise of automated license plate readers and decided to pay Mike a visit. He runs one of the largest private license plate snapping operations in the United States. His fleet of 10 camera-equipped cars log 300 to 400 miles a day, scanning plates in the Baltimore and Washington, D.C., metropolitan areas. Each month, his two shifts of drivers collect data about the location of 1 million plates.
Mike primarily uses the data to spot cars that are wanted for repossession. The technology has boosted his captures to 15 cars a night, up from about six per night without the cameras. But Mike says his ultimate goal is to sell access to his data to bail bondsmen, process servers, private investigators, and insurers. “In the next five years, I hope my primary business will be data gathering,” he told me.
He mused about one possible buyer for the data: a company called TLO. I had been hearing about TLO for years. The founder, Hank Asher, was legendary. A former drug smuggler turned law enforcement buff, Asher was the most flamboyant guy in the data brokerage business.
Asher made millions through owning a business that painted high-rise buildings in Florida and retired at 30. He moved to Great Harbor Cay in the Bahamas, drove a fast boat, flew a twin-engine Aerostar, and developed a cocaine habit. Eventually, after agreeing to fly a few loads of cocaine to Florida, he realized he’d gone too far. He quit cold turkey and decided he wanted to clean up drug smuggling on the island.
He started working with the U.S. Drug Enforcement Administration and noticed that the agency needed better databases. In 1992, he launched a product called AutoTrack that would change the data-collection industry.
AutoTrack was a better way to search public records: Asher bought data from the Florida Department of Motor Vehicles and made it easily searchable. Suddenly police could look up a person’s driving and vehicle records just by searching an address or part of a Social Security number or fragment of a name. Previously, police had to enter a person’s entire name, gender, and birth date to obtain a plate. AutoTrack changed the way police investigations were done. Journalistic investigations, too. I’ve used AutoTrack many times to find the names and addresses of people I was investigating.
Eventually, however, Asher’s flamboyance and drug history caught up with him, and his company bought him out for $147 million. Undeterred, Asher soon started another company with a very similar product called Accurint. After Sept. 11, he put together a program called MATRIX that would create a “high terrorist factor” list, but it ran aground on privacy concerns. Again, Asher resigned from his company under pressure.
In 2009, Asher made another run at the business, founding a database company called TLO, standing for The Last One, as in the last one he planned to launch. He turned out to be right about that; he died at age 61 in 2013.
Mike said TLO’s data were good and cheaper than data provided by LexisNexis, which years earlier had bought Asher’s two previous firms. TLO charged only 25 cents to conduct a simple search and $5 for an advanced search. By comparison, LexisNexis’ PeopleWise service charged $1.95 for a basic report and $24.95 for a premium report.
“Can I see my report?” I asked.
“Sure,” he said.
In less than a minute I was holding a four-page report, containing all my previous addresses—dating back to the number on my dorm room in college: 536B. There was not a single piece of inaccurate information in the report.
It took my breath away. I had forgotten the number on my dorm room, the address of the group house in Washington that I had shared with five other recent college graduates, and my brief tenure in a New York City studio before moving in with my husband. Each address brought back a wave of memories.
This was my real life, dating back decades. Talk about immortality.
But as I sought out my information from other data brokers, my love affair with immortality lost steam. I compiled a list of more than 200 commercial data brokers, and I was pretty sure I hadn’t identified all of them. This wasn’t immortality; this was prostitution.
Some of them were well-known names, like the credit-reporting agency Experian. But most were tiny outfits in the voyeuristic “lookup” business—websites that let people look up information about other people for a small fee or sometimes for free in return for selling advertising.
There are very few barriers to entry in the lookup business. Consider the story of BeenVerified.com. In 2007, Josh Levy and Ross Cohen decided to offer cheap online background checks. The two set up shop with a $200,000 investment. By 2011, the company said it had revenues of $11 million and just 16 employees. Not bad work if you can get it.
The U.S. data business is largely unregulated, which is not the case in most Western European countries. Those countries require all data collectors to provide individuals with access to their data; the ability to correct errors in the data; and, in some cases, the right to delete the data.
After reading the fine print on 212 websites, I learned that only 33 of them offered me a chance to see the data they held about me. But upon closer examination, not all of them were real offers. Some required me to set up accounts in order to see my data.
I contacted 23 data brokers and received my data from 13 of them. Some asked me to send my requests by postal mail, along with a copy of my driver’s license. Others allowed email requests. Most of the responses I got were from the biggest players in the industry.
Epsilon, one of the largest direct marketers, with more than $3 billion in annual sales, sent me a sparse two-page report identifying my name, address, age, and political affiliation. It listed recent purchase categories in extremely broad categories—apparel, media, business, health, home office, and sports. The most specific information was a description of my household interests: cycling, running, and sports. For someone who hasn’t gotten on her bike in five years, that is more aspiration than reality.
I was shocked that Acxiom, the data-gathering giant with annual sales of around $1.1 billion, asked me to send a $5 check as a processing fee to obtain my data. But I sent it in, gritting my teeth. One month later, Acxiom sent me a nine-page report with my Social Security number, birth date, voter registration, and addresses dating back to childhood. None of the information that Acxiom sells about my interests was provided. Acxiom’s reluctance to share was particularly galling, since it brags in its annual report that it has more than “3,000 propensities for nearly every U.S. consumer.” One of its main products is the PersonicX database, which lumps people into 70 “clusters” within 21“life stage groups.”
Thanks to the journalist Dan Tynan, who does great work covering privacy issues, I found a page on Acxiom’s website that lets you enter your age, marital status, income, and age of children to determine your PersonicX cluster. When I entered my real information (which was a bit scary), Acxiom reported back that I was in a cluster called “Fortunes and Families”—“one of the most educated and wealthy of all the groups.” People in this cluster are more likely to have attended graduate school (yep) and be Asian (yep, that’s my husband). Also true: “Their busy lives make Internet shopping a necessity rather than a preference.” However, the stock photo on the “Fortunes and Families” cluster was a little absurd—a picture of a man and a woman standing in front of a private jet. We’re not private-jet wealthy. We’re not even business-class wealthy. We are strictly coach class.
Other Acxiom clusters have names like “Truckin’ and Stylin’,” “Married Sophisticate,” “Urban Scrambler,” “Rural Rover,” and “Lavish Lifestyle.” However, it’s not clear which cluster Acxiom has actually assigned me to, since its demonstration website doesn’t ask for names. Acxiom later introduced an online service that would let people see their data if they entered their name, address, birth date, email address, and last four digits of their Social Security number. I was reluctant to hand over so much sensitive information, but, once again, I gritted my teeth and submitted my information. The resulting demographic data were remarkably poor: Acxiom said I was a single Asian parent, with a 17-year-old child, who drives a 2009 Toyota Corolla—all of which is incorrect. However, the shopping data was impressive: It correctly flagged that I prefer online shopping over off-line shopping and identified categories in which I had spent money, such as linens, housewares, and “women’s apparel—underwear and hosiery.”
Datalogix, which claims to have data on “almost every U.S. household and more than $1 trillion in consumer transactions,” took three months to respond to my request. But one day a FedEx envelope arrived containing two sheets of paper from Datalogix listing my “interest segments.” It was a mishmash. Yes, I am a “mom” and a “foodie” and an “online buyer” of “women’s fashion & apparel,” but calling me a “fashionista” and “young and hip” is likely a bridge too far.
Similarly, my family does buy energy-efficient light bulbs and organic milk, but I was surprised that this qualified us as “green consumers” and “health food” purchasers. And some data were outright wrong: We have no pet and no television, thus we have never purchased any “pet supplies” nor have we watched “Spanish language television.”
Other Datalogix categories were deliberately obscure. “Political views” and “political geography” were among my interest categories, but the report did not disclose what views they believe I hold. Similarly, my household income and home value were listed as categories but not disclosed.
Infogroup merely sent me an email containing my name and address—the same information that I had provided in order to access my dossier. Gee, thanks.
I got better results from LexisNexis, another giant in the field. Four days after I submitted my request, LexisNexis mailed me a free 10-page “Accurint Person Report,” containing every address I’ve lived at since 1989.
Like the TLO report, it was disturbingly accurate. It had captured the one month I spent at my parents’ house while looking for an apartment in San Francisco in 1996. It grabbed the two months that I spent living in my boss’s attic while interning at the Washington Post in 1992. Under “Possible Associates,” it listed my husband and his mother and dates that she had visited him in his New York apartment.
Thomson Reuters’ Westlaw was the most generous, kindly sending me two free reports: a 34-page “summary” that was mostly correct except for listing my brother as the head of my household and an eight-page “comprehensive” report that listed my license plate, mortgage information, and employer. The Westlaw comprehensive report was the only report I saw that listed the sources from which it obtained my historical addresses—all were from credit-reporting agencies.
Some companies’ offers of access seemed to be little more than window dressing. Intelius, one of the largest of the online people-search sites, which had $150 million in sales in 2010 (the last year that this information was publicly available), offered a website called TrueRep.com that allows users to see their data. However, the service was not advertised on any of the Intelius sites that I found. And when I visited TrueRep to find my data, it didn’t work. After I contacted the company, it fixed the “bug,” and I was able to access my data—first I had to answer a set of personal questions, such as when my house was built and what model car I drive. Strangely, once I passed those questions, the report didn’t provide any details about my house and car. Obviously, Intelius must have more information that it is not disclosing, though it did report the correct names of my parents, husband, and brother. But it had two incorrect addresses for me—one in the Bronx and one at the United Nations.
Still, on average, the data brokers were largely correct about me. They correctly located most of my addresses and relations. And in large part they correctly identified me as a harried working mom, prone to choose convenience over thrift.
Excerpted from Dragnet Nation: A Quest for Privacy, Security, and Freedom in a World of Relentless Surveillance by Julia Angwin, published Feb. 25, 2014, by Times Books, an imprint of Henry Holt and Company, LLC. Copyright © 2014 by Julia Angwin. All rights reserved.
