Skip to Navigation Skip to Main Content
Courtesy photo

The Watchdog: Data for ID theft is just a leak away

Profile image for Dave Lieber
Dave Lieber, The Dallas Morning News

A mystery package arrived last week in my mailbox. The contents inside scare my family and friends who fear it's a threat to steal my identity.

The big envelope contains a 59-page dossier on my life built from public records. If a criminal got hold of these 59 pages, he or she could take over my life. Like in a movie.

The dossier shocks me in its detail. Every possible piece of information needed to steal my identity is included.

My full nine-digit Social Security number is here. I count it 20 times. You can't miss it.

My name, address, unlisted phone number, driver's license number, date of birth, previous addresses are all here in full detail. Even the color of my car.

My wife's Social Security number is listed eight times along with all her vital information. My three kids are included in generous detail, too. Even my first wife is listed (not that I'm calling).

The report's origin, at first, is a mystery.

I do not feel threatened. I feel relieved that someone in Data World has come forward — at personal risk — to leak this document to The Watchdog so I could share this with you.

The leaker is saying, I believe, "Watchdog, you are only skimming the surface in your Equifax breach reporting. Check this out."

I'm only guessing. There is no cover letter, no return address, no postmark on the envelope (as sometimes happens).

But don't for a moment believe that the same type of file doesn't exist on you, too. It does.

Who creates this? To whom do they sell it?

The Watchdog tracks it down.

Dossier's creator

Thomson Reuters, headquartered in Toronto, calls itself "The Answer Company." It is the answer to my questions.

"The intelligence, technology and human expertise you need to find trusted answers."

I'll say.

I send the Thomson Reuters PR department a copy of the first seven pages. The company confirms this is one of their reports.

The company runs a program called CLEAR that it markets to law enforcement, government agencies and corporate security. The stuff is not supposed to leak out, like it does here.

After I contact the company, spokesman Scott Augustin tells me, "What has happened here is entirely unacceptable, and we are investigating the situation."

He continues: "Thomson Reuters is taking this situation very seriously, and takes the privacy and security of our data within its control just as seriously. It is unfortunate that a vetted user would choose to send a report to you in violation of their user agreement."

I hope they don't catch the leaker. Otherwise, we might never know about CLEAR and how easy it is to lose control of its information. You see how easy it is to leak? (If you're reading this, leaker, thank you.)

Everybody is crazed about the Equifax leakage. That's nothing compared with the potential damage caused by this product.

Dangerous stuff

My wife's health savings account debit card numbers were stolen last week by someone to pay for a lab test in Pennsylvania. I got an alert on my phone the moment the fraudulent charge went through.

When I called to cancel the card, the company asked my name, address, last four digits of my Social Security, phone and email. All in my CLEAR report, of course.

Here's another aspect. To override PINs on a credit security freeze, sometimes a financial institution asks questions that only you know the answer to.

What city did you live in 20 years ago? What was the name of the street? What's the color of your car?

Again, answers are all in there.

CLEAR spokesman Augustin tells me "most" customers are police, corporations, law firms and government agencies. Buyers must be trained and vetted, he says, so they don't do what someone did here.

A basic subscription starts at $1,087 per month. I learn this from The Dallas Morning News research editor Erin Sood because the cost is not listed on the company's website.

The website promotes "online investigation software" and promises to "get a holistic picture of your subject in one search."

The website brags of obtaining "live cell phone records. Billions of cell phone, landline, TracFone, business and VoIP records delivered in real-time ensure your phone searches bring back comprehensive results."

And more: "License plate recognition. Live access to more than 6 billion license plate scans. ...

"CLEAR makes it easier to locate people, assets, businesses, affiliations and other critical facts. ...

"The product is tailored for banking/financial, insurance, retail/e-commerce and government sectors for anti-money laundering ... compliance and fraud mitigation."

The website adds, "The data provided to you by CLEAR may not be used as a factor in establishing a consumer's eligibility for credit, insurance, employment purposes or for any other purpose authorized" under federal law.

Sure, CLEAR, whatever you say. (Fingers crossed.)

No choice

You can't opt out. You can't call CLEAR and ask that you be deleted from the database.

Mike Litt, consumer advocate for the U.S. Public Interest Research Group, says there are hundreds of data brokers, barely regulated, when they should be restricted under law like credit bureaus. (We see how well that's working out.)

"They create dossiers on you with tons of personal information," he says. "These data brokers should be limited. We should be protected. We should have more control over these reports, and they should be restricted as far as who they can sell your info to."

Nobody believes that's going to happen. How come? Congress.

A life in data

My life story is on these pages. There are the nonprofits I helped launch. Details on my book publishing business (including estimated income), even a guess at my political affiliation (based on primary attendance).

The sales price for a house I sold 25 years ago is correct to the penny, as is the $25,000 my wife and I borrowed 20 years ago for a swimming pool (best loan ever!).

Fifty-nine pages. I wonder how big your file is. Yet there's nothing we can do to correct misinformation, stop its dissemination or, as we see here, stop anyone from leaking it to someone who's not supposed to have it.

Staff writer Marina Trahan Martinez contributed to this report.

ABOUT THIS COLUMN

The Watchdog Desk works for you to shine light on questionable practices in business and government. We welcome your story ideas and tips.

Contact The Watchdog

Email: watchdog@dallasnews.com

Call: 214-977-2952

Write: Dave Lieber, P.O. Box 655237, Dallas, TX 75265