Private Eye

rriving in Windward, a planned neighborhood tucked inside the Atlanta suburb of Alpharetta, the first things you notice are the trees. Strategically placed in thickets, they shield residents from unsightly views of the Georgia 400 toll road, which pumps traffic out of the bustling city to the south and into the affluent northern enclaves. The trees divide the 3,400-acre development into sections, comprising office parks, strip malls, chain restaurants and subdivisions of single family homes costing from $200,000 to $2 million.

At the center of this idyllic landscape sits the corporate headquarters for ChoicePoint Inc.-a company that is central to the federal government's efforts to give all of America the kind of safe and secure world that Windward symbolizes.

ChoicePoint's business is the gathering and selling of information about people. Huge electronic files the firm compiles contain far more data about Americans than is available at any government office. In fact, it's illegal for a government agency to collect most of the data ChoicePoint maintains on private citizens. Thus an unusual alliance has grown between government, whose appetite for information about potential security risks has risen, and a company whose acumen in assembling personal information has made it the supplier of choice for many federal agencies.

Demand for data on individuals is on the rise throughout American society, and ChoicePoint serves many markets. Insurance companies use its data to manage risk, deciding to whom they should offer policies. Many corporations now commission background checks before hiring new employees. Children's sports leagues require such checks of coaches.

Last October, Business 2.0 magazine listed ChoicePoint among the top 100 fastest-growing technology companies in America. The company's revenues in 2003 totaled nearly $800 million, a 9 percent increase over 2002. Revenues in the company's Business and Government Services division totaled $340 million.

For years, the Federal Bureau of Investigation, the Internal Revenue Service, the Defense Department, the Social Security Administration and about three dozen other federal agencies have called on ChoicePoint to identify tax evaders by uncovering hidden assets, root out medical benefits fraud and help track down criminal suspects. ChoicePoint won accolades in 2003 for leading federal and local officials to the Washington snipers, by mining name and license plate data the company owns to identify the suspects.

But it was the Sept. 11 terrorist attacks that made the company's capabilities most valuable to government. ChoicePoint performed more than 112,000 background checks on airline passenger screeners for the Transportation Security Administration. The company works with the TSA on a project to pre-screen certain airline passengers. ChoicePoint also works with the Homeland Security Department on a program to issue identity cards to haulers of dangerous chemicals. And, entering a previously untapped market, ChoicePoint now works on behalf of U.S. intelligence agencies, running data on people of interest to America's clandestine services.

ChoicePoint's intention, as its chief executive, Derek Smith, wrote in a letter to shareholders last year, is "to create a safer, more secure society." That's a lofty goal. But it's one that ChoicePoint, along with the government agencies it serves, believes it can achieve.

PICTURES OF YOU

ChoicePoint is not the only company that collects personal data. But its competitors cannot match ChoicePoint's talent for piecing together vast swaths of data into a chronological picture of someone's life.

As you move through life, you leave traces of yourself that never disappear. You register a car, apply for insurance, apply for a job, get a blood test, open a bank or credit card account, buy a home, move into an apartment, get arrested, get paroled, buy a boat, file a tax return, get married, get divorced, have a baby, get a library card. These movements leave marks in the form of records. A record might be a seemingly innocuous bit of information you wrote on a form-your phone number, date of birth, where you went to college-or a more telling nugget you surrendered to a customer survey, like why you bought that 2004 Jeep Grand Cherokee, or why you take trips to Ireland.

ChoicePoint and other collectors scoop up these pieces of information and preserve them electronically. They buy the data-sometimes from each other-or obtain it from public sources, such as court and property records. Then, when their customers ask, ChoicePoint blends the pieces into a picture of you. Where you've lived. The cars you drive. The people you know-neighbors, school friends, ex-spouses. The more records, the bigger the picture. ChoicePoint owns an astounding 19 billion records, about 65 times as many pieces of information as there are people in the United States. As a result, ChoicePoint knows more about most people than the federal government does.

But knowledge itself is useless. It must be applied. And ChoicePoint uses it to separate dangerous people from trusted ones-a job that, executives say, is at the core of homeland security. In his letter to shareholders, Smith referred to official warnings that prompted citizens to hoard duct tape and plastic sheeting in preparation for a chemical attack. "While there's no harm in buying [those] supplies . . . physical barriers and color-coded terror alerts are not the tools that are going to protect us against the threats we face today," he wrote.

"Information used appropriately," Smith continued, "can help proactively identify those individuals and organizations who pose a threat." The government agrees, and has spent billions of dollars since the Sept. 11 attacks trying to better analyze the sparse data it owns. But information, applied appropriately, does something else. Once threatening people are identified, Smith writes, that "allow[s] us to understand and manage the rights and privileges they are granted within our society."

The Constitution guarantees some privacy, but not anonymity, Smith has said repeatedly. The courts concur. People have no right to lie about who they are, or to request credentials that convey rights and privileges-such as driver's licenses or permits-without proving their identities. The people who wish to remain anonymous trouble Smith the most. "It is the anonymous person," he writes, "or small group of people, who represent the greatest risks-economic, physical or emotional-facing us today."

In an interview with business magazine Georgia Trend in 2002, Smith said ChoicePoint conducted a survey showing that 25 percent of pizza delivery drivers recently had spent time in jail. "What pizza do you like?" Smith asked his interviewer. "At what price? Are you willing to take the risk associated with dealing with a company that doesn't screen their drivers?" Smith declined Government Executive's request for an interview.

IN THE DARK

ChoicePoint has startling anecdotes that reveal how little the government knows about people crossing its path. Last year, a U.S. intelligence agency gave the company a list of "people of interest," says Jim Zimbardi, ChoicePoint's vice president of strategic sales, and its point man on government work. The agency, which he won't reveal, wanted to know everything Choice-Point knew about the people. ChoicePoint's report told the agency something it didn't yet realize: Some of them had already entered the United States.

ChoicePoint doesn't need such chilling tales to make it indispensable to the government. An FBI official, who asked not to be identified to avoid the appearance of publicly endorsing ChoicePoint, says, "The success of an investigation is often directly proportional to the information [from ChoicePoint] we can gather on suspects." The company's National Criminal File contains more than 63 million conviction records and other data, making it more complete than the FBI's own files.

How powerful is this data? Another FBI official, who also requested anonymity to avoid an endorsement, paints this scenario. Say the FBI is pursuing a suspect, and agents believe he fled the country. His ChoicePoint record contains a travel agency form he filled out before planning a trip to Ireland years ago. The form asked why the man wanted to make the trip. He wrote, "Visiting relative."

"Now, if it turns out you like to travel to Ireland because you have an uncle who lives there," the agent asks, "where do you think we're going to look?"

But what's less obvious to the agent is when ChoicePoint records can and cannot be searched, particularly before the commission of a crime. Can the FBI run anyone's name through ChoicePoint, at any time? Agents aren't supposed to run random searches, the official says, even though many have access to ChoicePoint data on their desktop computers. But asked if any laws expressly forbid it, the agent waffles. "Well, it might be an ethical issue," he says.

ChoicePoint's Zimbardi says the FBI keeps a 3-inch-thick binder of regulations covering ChoicePoint searches. But then he adds that he's never seen the binder; he's only heard of it.

Privacy laws are quite clear on what the FBI may collect on citizens. But ChoicePoint blurs the line. Technically, its data is only a product the FBI has purchased. But with Zimbardi's acknowledgement that Choice-Point has examined "persons of interest," clearly the lines between what can and cannot be known are getting blurrier.

It's also unclear who decides what qualifies as a legitimate search. Zimbardi considers a hypothetical scenario. Say a U.S. intelligence agency presents a list of 5,000 names. Officials say, "We can't tell you why we need to know about these people, but we need to know everything you have." Would ChoicePoint comply and take the government's word that the search was warranted? "Yes," Zimbardi says, without hesitating.

Intelligence agencies are new customers for ChoicePoint. But the practice of intelligence isn't. The point is to spot risks early. That's ChoicePoint's basic business. And that business isn't simply growing; it's evolving. In its seven-year life, ChoicePoint has acquired 42 companies; an average of one every two months. Some it buys for the data they own. Others are purchased to absorb new customers and enter new markets. And sometimes, ChoicePoint buys a company to get its analytic technology, magnifying its ability to connect its 19 billion-and-counting dots of information.

As ChoicePoint collects more data, and grows more sophisticated in its ability to make connections among pieces of the data, its pictures of people become more compelling. Yet sometimes, the portraits are flawed.

BLURRED PICTURES

Mary Boris never pictured herself as a potential serial arsonist. But ChoicePoint did.

In February 2000, Boris learned her insurance provider wouldn't renew coverage of her home, her only major asset. According to a nationwide claims report database-owned and operated by Choice-Point-Boris had filed four fire-related claims in a short period of time. Boris panicked. She'd only made claims for hail damage and flooding caused by a leaking washing machine. Without insurance, she risked financial devastation if a catastrophe occurred.

Boris asked ChoicePoint to clear her name. The database in which her information appeared, known as the Comprehensive Loss Underwriting Exchange, is the industry standard for underwriting-related data, and every insurance company uses it to judge a policyholder's risk level. Boris spent months trying to resolve the error. ChoicePoint said her insurance carrier was at fault, since it supplied the claim data in the first place. Boris wanted ChoicePoint to simply expunge her inaccurate CLUE record. At one point, the fire claims disappeared, but then, mysteriously, they showed up again.

"I felt helpless," Boris says. So, rather than wait for ChoicePoint to assist her, she sued the company. Boris accused ChoicePoint of violating the Fair Credit Reporting Act, which gives citizens specific rights for contesting information compiled about them. She asked a jury for punitive damages and a compensatory award for the "mental anguish and anxiety" she suffered trying to prove her innocence.

A jury awarded Boris $250,000 in punitive damages, as well as $197,000 for her suffering. The judge later reduced that award to $100,000, saying Boris had offered limited evidence of her distress, but he added that Choice-Point behaved with a "generally uncaring attitude," and that the jury reasonably concluded the company bore the responsibility for correcting Boris' CLUE report. Boris' attorney says the report now is clean.

Boris is one of thousands of people ChoicePoint has labeled as something they're not. In 1998, the state of Florida hired DBT Online Inc., a ChoicePoint subsidiary, to identify convicted felons who, by law, officials must purge from the rolls of eligible voters. In the heat of the 2000 presidential election vote recount, it came to light that ChoicePoint had incorrectly fingered about 8,000 people as felons.

Press investigations found numerous flaws with the data. For example, the online journal Salon reported that a voter named Christine got tagged as a felon because a "Christopher" with the same last name had a conviction. In Orange County, some of the data the company supplied was almost 20 years old. Some county officials accepted ChoicePoint data at face value, but others refused to use it. One election official, Linda Howell of Madison County, threw the felon list out when she saw her name on it. Howell isn't a convicted felon.

Many news organizations have documented voter roll errors affecting thousands of people. Given that George Bush's official margin of victory in Florida was 537 votes, and that most of those DBT identified as felons were registered Democrats, a more accurate list could have affected the election's outcome.

James Lee, ChoicePoint's marketing director, says the company refers anyone contesting the accuracy of his or her data to the party that provided it. But when it comes to federal counterterrorism initiatives, accuracy is imperative. Fear of false positives (that a system would incorrectly label someone a potential terrorist) or false negatives (that a system would overlook a real danger) has undercut every personal profiling initiative the government has instituted since the Sept. 11 attacks. But that's not holding ChoicePoint back.

TWO CLASSES

In the growing library of books dissecting how and why the Sept. 11 attacks happened, perhaps none offers a more exhaustive account of the government's problems verifying people's identities than the 723-page After (Simon & Schuster, 2003), penned by attorney and former journalist Steven Brill, the founder of media commentary magazine Brill's Content.

In the epilogue to After, in which he proposes ways to prevent another Sept. 11, Brill writes that government and the private sector should implement "some kind of credible but voluntary nationally accepted identification card," which would give its holders access to fast lanes at airline security checkpoints, public buildings and sporting and performance arenas. No more waiting in line for lengthy body searches. Pre-screened card holders would be deemed nonthreatening.

Following the release of the book, Brill founded Verified Identity Card Inc. The first people he called, Brill says now, were Derek Smith and Jim Zimbardi of ChoicePoint. They agreed to join forces. ChoicePoint wants to be able to check card applicants' names against the government's terrorist watch lists, to which ChoicePoint currently has access when working with federal agencies. TransCore, which manufactures the E-Z Pass device that motorists use when zipping through electronic tollbooths, also joined the consortium, as did the Washington-based Civitas Group, a homeland security venture capital firm whose members include Sandy Berger, President Clinton's national security adviser.

Brill sees his card-which may not be a new card but simply a chip embedded in the holder's credit card-as an invention of necessity. Checking everyone who boards a plane or enters a large office building, like Rockefeller Center in New York, where Brill keeps his offices, wastes time and money, he says. The government shouldn't try implementing its own card system, he argues, because most places people frequent are privately owned. Businesses are better-suited to this task, and can do it more effectively, he argues.

Checking everyone also creates needless redundancy. Brill recalls the day that Berger-whom he calls "a close friend of mine"-came to Brill's offices to discuss the card project, but got stuck in a security line in the lobby. By the nature of his former job, Berger received the highest security clearance, Brill says. Yet, he waited in line behind a deli employee bearing the sandwiches Berger and Brill were about to eat.

The Brill-ChoicePoint card would ensure Berger didn't have to wait like that again. But it apparently would also create two new classes of people: Trusted and untrusted. Asked if that's the case, Brill says, "I wouldn't say trusted versus untrusted. I'd say, trusted versus not-yet-trusted."

ChoicePoint will distinguish between the two. This is familiar territory. As Smith wrote, information lets its owners grant people privileges and rights within society. There's no precedent for companies-or government-assuming this authority on the massive scale that a national identity card or many of ChoicePoint's security strategies envision. Brill writes in After that the government should "push the debate" about these programs. But the debate isn't occurring on a large scale. There's barely a vocabulary for it.

Privacy and civil liberties advocates have battled the government for years over alleged violations of privacy laws and the Fourth Amendment. But those statutes never foresaw that privately run corporations would have more power to know the details of people's lives than government. Bush administration officials stress that privacy sits at the center of all of their homeland security initiatives. But they repeatedly warn of the imminent threat of terrorism, and depict likely attackers as shadowy and difficult to understand.

ChoicePoint has found its niche discerning what is hard to grasp. And for that reason, the company and its data will grow more and more valuable to the government.