FBI, Pentagon pay for access to trove of public records

To help the government track suspected terrorists and spies who may be visiting or residing in this country, the FBI and the Defense Department for the past three years have been paying a Georgia-based company for access to its vast databases that contain billions of personal records about nearly every person -- citizens and noncitizens alike -- in the United States.

According to federal documents obtained by National Journal and Government Executive, among the services that ChoicePoint provides to the government is access to a previously undisclosed, and vaguely described, "exclusive" data-searching system. This system in effect gives law enforcement and intelligence agents the ability to use the private data broker to do something that they legally can't -- keep tabs on nearly every American citizen and foreigner in the United States.

ChoicePoint is famous for being the largest and most sophisticated aggregator of public records on U.S. citizens and residents. The company has built an enormous electronic cache of more than 19 billion records -- all of which are legally obtained -- that it mines to locate criminals and suspects, their family members and known associates, and their hidden financial assets.

Most of ChoicePoint's customers are other companies -- insurance providers trying to spot potential scam artists applying for policies, for instance. But the company's work for the government is significant and growing. Using its DNA analysis lab, ChoicePoint helped identify victims of the September 11 attacks. And the following year, the company helped locate the Washington-area snipers by leading investigators to the blue Chevrolet Caprice that the two killers used in their spree. (ChoicePoint compiles hundreds of millions of motor vehicle registrations.)

Although it has generally been known that the FBI and intelligence agencies use ChoicePoint's people-tracking skills, federal and company officials have refused to discuss the particulars of their arrangements. ChoicePoint declined a request for an interview about its work for the FBI and the Defense Department. But a set of contract documents, obtained under the Freedom of Information Act, and which the government sought to withhold for almost two years, reveals details not previously reported about ChoicePoint's work for the FBI's Foreign Terrorist Tracking Task Force, called FTTTF or "F tre F." This task force was set up soon after the 9/11 attacks to assist law enforcement and intelligence agencies in locating foreign terrorists and their supporters in the United States. Because the task force can't maintain records on U.S. persons without opening an official investigation, it relies on ChoicePoint to augment the intelligence that the government collects through legal channels.

The documents show that ChoicePoint has provided an arsenal of data and analysis to the task force and its partner group, the Defense Department's Assessments and Technology Directorate, which in turn is part of a counterintelligence unit that identifies covert threats -- namely spies and terrorists -- to Defense Department personnel and property. The FBI task force and the Defense directorate share an office and have helped to identify more than 200 terrorist suspects in the United States, FBI officials say. The partnership has also helped track suspected suicide bombers; the FBI component, among other things, vets all foreigners attending U.S. flight schools.

According to the contract documents, which have been heavily redacted, in 2002 the FBI task force had an "urgent need to acquire high-volume public record data" to help locate and track "foreign terrorists and related activities." At that point, the task force purchased some of the company's most popular services.

In the beginning, ChoicePoint performed search work at its own facilities, taking "input criteria" -- a name or other identifying data supplied by the government -- and returning useful information, such as a subject's address or any disparity between his name and Social Security number (a signal that the person may have purchased a stolen number to shield his true identity).

A year later, the government's appetite for data apparently became more sophisticated. In early 2003, the agencies ordered a set of Internet-based services from ChoicePoint. These services, the documents show, effectively put the power of the company's databases at government agents' fingertips on their desktop computers. The agencies also bought the company's AutoTrack product, which creates "easy-to-read reports" and gives users the "ability to locate people and assets faster ... and solve more crimes," according to marketing materials on ChoicePoint's Web site. And the agencies purchased ChoicePoint's "national comprehensive reports with associates," a service that lists the names, Social Security numbers, addresses, properties, and even pilot licenses to which someone is connected, directly or through known associates and relatives. FBI officials have said that such services are an invaluable complement to traditional criminal investigations.

But the documents indicate that ChoicePoint may have gone beyond simply offering its commercially available products to the government. In 2003, ChoicePoint agreed to provide access to an "exclusive" system used to help identify terrorism suspects. Although much of the description of the system has been redacted from the documents -- on the grounds that it would reveal law enforcement tactics and operations -- the portions that were released indicate that ChoicePoint's work involves continuously tracking a "subject of interest" and notifying the government when new information has surfaced on that person.

After a string of redacted text about this exclusive service, the document states, "When this new information is added and identified as relevant new data for a subject of interest, the FTTTF will receive electronic notification.... Additional information beyond the identity and address data can be provided to the FTTTF with a subpoena." In releasing the contract documents, the government said it could not elaborate on the system, because doing so "could certainly assist ... terrorists in circumventing detection." The government also redacted the dollar amount of the contracts, making it harder to assess costs and scope.

According to an outside expert on ChoicePoint who reviewed the documents for National Journal, the exclusive service looks like something ChoicePoint built specifically for federal agencies, and the arrangement raises questions about whether the company is effectively becoming an arm of the federal government.

"The language [of the contract], and ChoicePoint making their full system available to the government and [performing] custom-tailored searches for the government, show a high degree of cooperation," says Chris Hoofnagle, a researcher with the Electronic Privacy Information Center, who has obtained ChoicePoint contracts and corporate documents through other legal filings.

FBI officials have stated publicly that they don't use ChoicePoint for "fishing expeditions," that they tap its services only in the course of an official investigation. But the threshold for what constitutes a "subject of interest" is unclear. So are the restrictions, if any, that the government faces when it searches private databases for information on U.S. citizens. And it's unclear whether these restrictions differ from the rules for investigating foreigners.

Even though existing laws strictly limit the government's ability to conduct surveillance on U.S. citizens, those limitations don't apply to corporations. And so, the more ChoicePoint takes on exclusive work for the government that the government is prohibited from doing on its own, "the more it looks like a government actor," Hoofnagle says.

ChoicePoint collects a dizzying variety of newly filed public records from sources as varied as courthouses and motor vehicle departments, any of which could be a key data point in building a profile about a person being investigated. Standard ChoicePoint fare includes concealed-weapons permits; marriage and death certificates; registrations for boats, aircraft, and automobiles; eviction notices; credit card information; hazardous-materials-handling permits; and employment histories.

Without question, ChoicePoint provides services that the government feels it can't live without. "The enormous number of visitors to the U.S. and avenues of entry and exit makes it inordinately difficult, if not impossible, to accurately account for each entrant," the FBI task force director, Mark Tanner, told House lawmakers in 2003. He was describing how agents use private data brokers' information to help find people who've overstayed their visas, a class the government deems a security risk. FBI agents privately also sing the company's praises and say that if they couldn't get public records from ChoicePoint, they'd have to dispatch investigators to courthouses and clerks' offices across the country, greatly slowing the pace of their work.

But as ChoicePoint's databases grow, Hoofnagle asks, "at what point do [the company's] records become the equivalent of a 'system of records,' " an official collection that is subject to government regulation and oversight and that must be publicly announced? Writing in the George Washington Law Review last November, two members of the Center for Democracy and Technology wondered whether government's use of private databases renders useless the federal Privacy Act, which is supposed to protect private information. "If the government is simply accessing databases created by commercial entities for their own reasons, there may be no system of records subject to Privacy Act requirements," the members wrote.

U.S. citizens have few avenues to monitor how the government is using their personal data when it resides outside government hands. "We have the legal authority to collect certain types of information," says Ed Cogswell, an FBI spokesman. ChoicePoint is "a commercial database, and we purchase a lot of different commercial databases.... They have collated information that we legitimately have the authority to obtain."

But because the FBI is so reluctant to discuss how it uses the data, and what its own guidelines are for monitoring agents' access to it, a cloak is cast over the government's work. "From the perspective of an American citizen, this is another example where a company that's built a massive personal-information database is being used regularly by the government to track citizens," says Hoofnagle, who supports using ChoicePoint for terrorism investigations but wants more public assurances that the information isn't being misused.

Congress wants similar assurances. In the wake of several security breaches this year, at ChoicePoint and other firms, in which identity thieves accessed people's financial records, lawmakers have proposed several bills that would rein in the private data brokers and monitor more closely how the government uses them. One bill, the Personal Data Privacy and Security Act, introduced by Sens. Arlen Specter, R-Pa., and Patrick Leahy, D-Vt., would require the government to establish rules protecting privacy and security when it hires data brokers, and to conduct regular audits of those contracts.

Privacy advocates following the bills say that they're weaker than legislation being pushed through in state legislatures, and that no single congressional bill fully addresses all their concerns. But the legislation has data brokers' attention. Hoofnagle says that lobbying expenditures by private data collectors are up across the industry. And this year, ChoicePoint has hired a number of lobby shops specializing in the executive branch. One hired last month is none other than the Ashcroft Group, founded by former Attorney General John Ashcroft, who oversaw the establishment of the FBI task force in 2002.

Steven Aftergood, who directs the Project on Government Secrecy at the Federation of American Scientists, says, however, that it is always hard to monitor what private contractors do in the intelligence field.

"Using contractors to perform sensitive intelligence or counterintelligence work, whether it's prisoner interrogation in Iraq or data mining in D.C., is always problematic, because their activities are much harder to oversee," Aftergood says. "Unlike government agencies, contractors are not answerable to Congress. And the secrecy of most intelligence work makes them all but impervious to independent oversight. If they broke or bent the law, we might never find out."