PUBLIC AGENCIES AND YOU

Private Lives, Public Information

The Annoyance:

I thought I led a fairly private life. Then I got into a dispute with a business partner, who decided to tweak me by sending me a dossier he'd compiled about me the names and birthdates of my children, some quiet property investments I'd made, and the details of my very messy divorce. Is this legal?

The Fix:

It is. Not only is all of that public information, but in most states it would be illegal to conceal this information from the general public. Birth and death, marriage and divorce, home and business ownership, nearly every major rite of passage is considered part of the public record in most states. Until fairly recently, this information was hard to get at. Most of these records were kept in dusty credenzas in the bowels of county courthouses; anyone who wanted a look had to ask to see your paper file, and if they wanted to take the record home they had to make photocopies or scribble down the information by hand. Now, thanks to the wonder of the Web, many of these records are available easily and often for a modest fee online (see Table 6-1).

Public records serve a useful purpose. It's helpful to know who owns the house you're thinking of buying, or whether your ex-spouse is hiding assets, or if a convicted sex offender has moved into your neighborhood. But computers allow you to do things that the original authors of public records statutes surely never dreamed of, such as instantly looking up

Table 6-1. Public records versus private matters. What's private information and what's not? Laws vary by state and county, but many of your most vital pieces of data are available to anyone who bothers to look it up.

Public	Private
The property you own	The videos you rent
Your lousy driving record	Your lousy driver's license photo
Property taxes you owe	Personal income tax you've paid
The candidates you gave money to a	The candidates you voted for
Your messy divorce	Your messed-up back
Names and birthdates of your children	Names and birthdates of your adopted children b
Pets you've licensed	Books you've borrowed
Your criminal record	Your high school transcripts
aFor contributions totaling more than $200.
bAlaska, Oregon, Kansas, Alabama, and New Hampshire allow adoptees to obtain birth certificates, according to Bastard Nation (http://www.bastards.org).

every piece of property owned by a particular person, or finding every legal dispute involving a particular business. In the age of the Internet, everyone is a gumshoe.

Some local governments are taking steps to limit online access to this information. Last July, Douglas County in Kansas removed the ability to search across property records by an individual's name, citing citizen complaints about potential privacy violations. Officials in Nassau County, New York, did something similar in 2002. You might try approaching local county officials and see if they'd consider restricting the ability to search for records online.

Private data brokers also mine public records databases and sell the information they find there. You may be able to convince some data brokers to stop selling information about you they've culled from public databases (see Chapter 3, "Fend off Cyber Stalkers"), but this won't remove the data from the public record or prevent state or county governments from sharing it with the world. (The Privacy Rights Clearinghouse publishes a partial list of information brokers at http://www.privacyrights.org/ar/infobrokers.htm).

Dig in the Dockets

Want to find out what dirty laundry is hiding or exposed to the world in your court docket? The Court Access site (http://www.courtaccess.org/) provides links to online court documents in every state and Federal jurisdiction. You'll also find copious news reports on the continuing battle over public access to court documents.

Your best recourse is to understand what information is available about you and try to limit the potential for harm (see Chapter 4, "Be Your Own Gumshoe"). If, for example, the public record includes transcripts from a family court case or some other potentially embarrassing legal proceeding, you might be able to petition the court to seal the record. At the very least, you won't be surprised when the details show up in your inbox.

Keep the USPS From Selling Your Address

The Annoyance:

I recently moved across country. To make sure that all my magazine subscriptions and personal mail find me when I arrived, I filled out a US Postal Service Change of Address form. Now I'm getting even more junk mail than before. Am I being paranoid, or is there a connection?

The Fix:

Connect away. Fill out the Postal Service's National Change of Address (NCOA) form and you're just begging for junk mail. According to the USPS privacy policy, if you file a permanent change of address (Form 3575), anybody who has your old address is entitled to obtain your new one. The Postal Service uses about 20 private contractors to process 40 million changes of address each year. Those contractors then sell your address to thousands of direct mail companies, who proceed to fill your mailbox with dead trees.

One partial solution is to mark your change of address as temporary; you use the same form, you just indicate a date when you want mail forwarding to stop (see Figure 6-1). Mail will be forwarded for up to 12 months, but your new address won't be added to the NCOA rolls that are shared with marketers. Most of the junk mail won't be forwarded, while some types of mail (like periodicals), may only be forwarded three times. Once the temporary change expires, you'll need to directly contact those magazines and people you owe bills to and give them your new, permanent address.

Another way to reduce the junk is to use the Direct Marketing Association's Mail Preference Service (http://www.dmaconsumers.org/cgi/offmailinglist). This will eventually reduce but not entirely eliminate the crap you receive.

annoyances 6-1. Moving? You can file a change of address at USPS.gov, but be sure to use the Temporary Move option unless you want your junk mail to follow you.

PRIVACY IN PERIL: SMILE WHEN YOU BUY THAT STAMP

According to heavily redacted documents obtained by EPIC under the Freedom of Information Act, Automated Postal Center kiosks that sell postage and let you mail packages come with a little something extra inside: a camera that snaps a portrait of every customer, then stores it on an internal hard disk for 30 days. If you attempt to compromise the photo by, say, holding up a piece of paper (or an envelope) the machine won't complete your transaction. According to the documents, USPS says the cameras are required by the Federal Aviation Administration for security reasons. Go figure.

TEN WAYS UNCLE SAM INVADES YOUR PRIVACY

Nothing can crush your privacy faster than the big feet of Uncle Sam (and his state and local cousins). In some cases these violations affect only a handful of people, many of whom probably warrant closer scrutiny. But the government is also collecting and sharing data on millions of law-abiding citizens and doing a poor job of protecting it from hackers, rogue employees, and other no-goodniks.

Publish your information on the Web. As governments continue to move public records online, more and more details of your private life are available to anyone with an Internet connection. For example, the Feds publish national databases of births, deaths, and Federal inmates; depending on where you live, your city or county may provide everything from the property you own to your political affiliations and traffic tickets all available with just a few mouse clicks.

Obtain commercial data about you. Federal agencies are culling information about millions of Americans from privately held commercial databases in an effort to identify potential terrorists (and Lord only knows what else). Universities, grocery chains, and other organizations have voluntarily shared customer information without notifying their customers. Federal agencies have also purchased millions of records from data aggregators such as ChoicePoint and Seisint.

Create massive, insecure databases. Not only is Uncle Sam gathering massive amounts of information about you, he's making it easy pickings for hackers and data thieves. In 2003, the House Committee on Government Reform gave the Federal government a "D" for computer security, with eight departments (including the Department of Homeland Security) receiving an "F." See the full report card below

Abuse and misuse information. Rogue employees with access to sensitive data can be a lethal combination. Until 1997, it was legal for IRS employees to snoop on anyone's tax records. (Since then, the Government Accountability Office has documented thousands of unauthorized access attempts, though only a handful of IRS employees have been disciplined.) In 2001, a DEA agent sold information from various crime databases to private investigators, and then disappeared on the day of his trial.

Ask your employer or neighbors to snoop on you. Federal and local governments have initiated a series of "watch" programs encouraging individuals and employers to report possible terrorist behavior to the authorities (see "Privacy in Peril: A Nation of Spies?"). Your realtor, the UPS driver, the utility worker fixing the power line outside your house all of them could be watching you, at the behest of Uncle Sam.

Put you on a watch list. According to the Government Accounting Office, the Federal government maintains more than a dozen "watch-lists" of suspected terrorists from the Department of Homeland Security's 20,000-name "no-fly" list to the FBI's Most Wanted. Such lists are often full of useless information (the no-fly list includes names like "Ahmed the Tall") and rife with cases of mistaken identity like the ones that kept Massachusetts Senator Ted Kennedy and Alaska Congressman Don Young from flying last summer.

Demand your grocery bills, bank statements, and library records. Under provisions of the Patriot Act, the FBI can demand business records for anyone deemed "relevant" to an anti-terror investigation (see "Is Privacy 'Patriotic?'"). Organizations that receive such requests are forbidden to notify the people being investigated. Documents obtained by EPIC and the ACLU reveal a list of such requests six pages long. The Department of Justice blacked out all the information on these documents, so the identities and exact number of recipients are unknown.

Monitor your electronic communications. Since the late 1990s, the FBI has used an electronic data-gathering system known as Carnivore to collect data from Internet service providers. (In January 2005, the FBI announced it was no longer using Carnivore, saying that it was able to achieve the same level of surveillance using commercial software.) The NSA's long-rumored Echelon program to monitor satellite communications worldwide became public knowledge in 1998.

Install a "spy" on your computer. In June 1999, FBI agents surreptitiously entered the office of alleged mobster Nicodemo S. Scarfo and planted key-logging software on his computer, to capture the passwords Scarfo typed when encrypting documents a tactic that was later approved by a Federal court. The FBI has also admitted to a program called "Magic Lantern," which can plant such keyboard bugging devices remotely via the Internet.

Employ high-tech eavesdropping devices. The Feds have ways of spying on you that go way beyond wiretaps, cell phone scanners, and hidden microphones. They can use thermal imagers that detect body heat through the walls of your home (though a warrant is usually required) or read what's on your computer screen via the glow of your monitor against the wall.

Take Leave of Your Census

The Annoyance:

I got a U.S. census form in the mail that asked me a bunch of highly intrusive questions from my national ancestry and level of education, to how much money I make and whether I have flush toilets in my home. Do I have to answer these questions? And if I do, how safe are my answers?

The Fix:

Gotta answer? Yep. Safe? More or less. The census was originally created to gather information about the U.S. population for the purpose of creating new Congressional districts, which of course, are based on population. Over the years, however, it's expanded to serve a wide range of other uses, such as calculating how to distribute funds for government programs like Medicaid or where to build future roads and schools. The data is also used extensively by businesses for example, Starbucks uses census data to determine where to plant its next coffee franchise. Not surprisingly, the amount of information the Census Bureau gathers has grown dramatically. And instead of gathering this data once every 10 years, the Bureau now collects data from different households every month.

In 2000, U.S. citizens received either a short form survey (7 questions) or a long form (53 questions). Starting in 2005, the Bureau will distribute the long form under a new name (the American Community Survey) to 250,000 U.S. households each month (see Figure 6-2). The short form will continue to be mailed to every household every 10 years and will be used solely to determine Congressional representation.

The problem? Census data has occasionally been abused. It played a pivotal role in the identification and internment of Japanese Americans during World War II. More recently, the Department of Homeland Security (DHS) requested information from the 2000 Census regarding the makeup of Arab populations in the U.S. Bureau spokesman Stephen Buckner says the DHS's purpose was benign (the agency wanted to know what languages to use on signs at certain airports), and that this data was already publicly available on the bureau's web site. Still, it prompted the Census Bureau to change its policies; Bureau staff must now get the thumbs up from a higher-up before they release potentially sensitive information.

annoyances 6-2. Do you heat your home with kerosene? Are you a high school dropout? Do you have trouble dressing yourself? These are some of the questions on the new U.S. Census long form. Approximately one in four households will receive this form in the mail over the next 10 years.

By law, census information is supposed to remain confidential; the Census Bureau does not reveal the names of anyone who fills out a form. Yet marketers combine census data with data gathered from other sources to identify you a practice known as re-identification, which is perfectly legal. Carnegie Mellon computer scientist Latanya Sweeney has found that 87 percent of the U.S. population can be uniquely identified using just three bits of information (date of birth, gender, and ZIP code). At the very least, private firms can take small units of census data and extrapolate a great amount of detail about your income and interests, if not your actual identity. (For more information on census data and privacy, see EPIC's page at http://www.epic.org/privacy/census/.)

Unfortunately, filling out either the community survey or the standard short form is not optional. If you don't return the ACS form you'll get a follow-up phone call, and one in three non-responding households will find a Census Bureau employee on their doorstep. Even leaving some items blank can subject you to a $100 fine, though Bucker says the bureau doesn't usually press the issue. Despite the penalty, one out of three households never mailed back the 2000 census (Buckner says the new ACS has response rates above 97 percent). If the survey questions truly bug you, a hundred bucks is a cheap way to tell the Census Bureau to shove off.

PRIVACY IN PERIL: DATABASE DEFLOWERED

Think your "private" data is safely locked away in some dusty government mainframe? Not necessarily. In August 2004, hackers gained access to the identities of thousands of low-income Californians when they broke into a computer containing a state database. At the time, the database was on loan to researchers at the University of California at Berkeley. It contained the names, addresses, birthdates, and Social Security numbers of anyone who received care under the state's In-Home Supportive Services program approximately 600,000 elderly or disabled Californians from January 2001 through the date of the hack attack. The California Department of Social Services couldn't determine if any data was downloaded, but has advised IHSS clients to place fraud alerts on their credit reports, and be on the lookout for signs of identity theft.

Taking License with Your License

The Annoyance:

I've heard that my DMV records including photos can be obtained by anyone for practically nothing. Is this legal?

The Fix:

Not anymore. The Drivers Protection Privacy Act, a part of the Violent Crime Control and Law Enforcement Act of 1994, made it illegal for DMVs to provide public access to its records, though law enforcement, insurance firms, subpoena servers, and businesses doing ID checks may still access these records in most states. (Whether a business's request is truly legitimate or anyone at the DMV bothers to check is another question.) The law was inspired by the 1989 murder of Rebecca Schaeffer, an actress killed by a stalker who obtained her home address through her California DMV records. Later amendments to the law allowed states to sell driver data to marketers, provided they obtain your permission first. Some states, such as Arkansas and Wyoming, are stricter, limiting access to your DMV records to you, government entities, or anyone who has your written permission. (For a directory of state DMV web sites, see http://www.dmv-department-of-motor-vehicles.com/.)

Still, privacy advocate Robert Gellman notes such laws may be cold comfort for anyone who's been driving for more than ten years. Because so many states sold motor vehicle records prior to the law's passage, odds are good your information was purchased by marketers years ago.

The Taxman Cometh

The Annoyance:

Yikes! I'm about to be audited by the Internal Revenue Service! Is there still time for me to shave my head, change my name, and move to Bolivia?

The Fix:

A tax audit can be an incredibly invasive experience, but leaving the country or going underground probably isn't the best strategy for dealing with it. If you're unlucky enough to be audited, there are some things you can do to protect your privacy, says Frederick W. Daily, author of several books on taxpayer rights, including Stand Up to the IRS and Tax Savvy for Small Business (both from Nolo Press):

• Hold the audit at a neutral site. The IRS cannot demand to enter your home or the nonpublic areas of your place of business without a court order, says Daily. (Their aim, of course, is to see if your house or personal possessions jibe with the income you've claimed.) For example, if the IRS is auditing your restaurant, they can sit at a dinner table, but they don't have the right to rummage through your back office.

• Don't volunteer information. If you're being audited for the tax year 2002, don't start talking about your income in 2000 or 2003. Tax agents are trained to ferret out information about other years, which could lead to further audits. The exception: if something on the return being audited requires information from a previous tax year for example, if you need to calculate depreciation for older equipment or property you might have to delve into the past. Don't linger there.

• Get representation. You're entitled to have your accountant or a tax attorney present during an audit, or even have them represent you in absentia. If dealing with the Taxman makes you nervous (and it should), this approach might keep you from revealing too much.

• Speak to an Advocate. If the auditor seems especially adversarial or unfair, don't hesitate to contact the IRS's Taxpayer Advocate Service at [phone]. You may not be able to secure another auditor, but it won't count against you for trying. "The IRS is very concerned about appearing tough but fair," says Daily.

For more information, visit the IRS's Taxpayer Rights page at http://www.irs.gov/advocate/article/0,,id=98206,00.html.

It's sad, but oh so true: if you're self-employed, you're more likely to be audited. One way to lower your audit profile is to change your tax status to a partnership, Limited Liability Corporation, or Sub S Corporation, says Fred Daily. Such entities don't have to itemize their deductions on a Schedule C, which usually produces a lower score when IRS computers start trolling for audit candidates. But Daily warns that filing as a corporation can be more costly and complicated than filing as a self-employed person, so only take this step if your self-employment income and your fear of a tax audit are substantial.

PRIVACY IN PERIL: LAPTOP LOSSES

A March 2002 audit by the U.S. Treasury Department found that of the 6,600 computers the IRS loaned to private citizens working under the Volunteer Income Tax Assistance (VITA) and Tax Counseling for the Elderly (TCE) programs, about a third went missing. The computers were used by volunteers to help people fill out and file their tax forms electronically. After the audit, not only could the IRS not account for 2,332 of the machines, but the agency couldn't determine whether the personal tax information stored on those computers was ever removed.

The IRS is hardly the only Federal agency to lose its laptops. The Customs service reported losing some 2000 systems, while the Department of Justice put out an APB on about 400 wandering notebooks. Was there classified or sensitive material on any of the MIA machines? Your guess is as good as theirs.