ChoicePoint theft prompts Senate investigation

ChoicePoint issued a statement Thursday supporting legislation designed to protect consumers. The firm said it would back independent oversight of its industry, stiffer criminal penalties, and disclosure laws.

"ChoicePoint is also renewing its call for a national discussion -- involving legislators, regulators, privacy advocates and the information industry -- on how to ensure that information is used responsibly, that the positive benefits of information use are preserved and that the illegal uses of data are severely punished," the firm said.

Only a first step
But legislation proposed so far is only a tepid first step towards a solution, warned George Washington University professor Daniel Solove, author of a new book on the data brokerage industry, The Digital Person.

"(The proposed legislation) is better than nothing, but it still needs to go further. There are a lot of unaddressed questions," he said.

Interactive Identity theft What to do when it happens

Giving consumers access to their records at each company is meaningless if people don't know which companies to ask, Solove said.

"(The legislation) doesn't really address issues such as, how are people to know who these companies are? Many people hadn't heard of ChoicePoint," he said. "And it's not just ChoicePoint. There are hundreds of data brokers. If you don't know who the companies, are what good is a right of access?

Number of victims still unclear
Meanwhile, investigators in Los Angeles have reduced earlier estimates of the number of victims who might have been exposed by the crime.  Published reports last week suggested Los Angeles law enforcement officials believed 400,000 or more people may have been victimized by the data leak -- and there were hints at a far larger number of victims.  But on Thursday law enforcement officials said it's too early to tell just how many victims will ultimately turn up.

"Without going through the investigative process, there's no way of knowing how far-reaching it will be," said Lt. Robert Costa of the Southern California High-Tech Task Force.

A report in the Atlanta-Journal Constitution on Thursday said that Detective Duane Decker of the Los Angeles County Sheriff's Department testified in a December court hearing that ChoicePoint representatives told him "something like 4 million people have been exposed" in the data leak incident. But officials from the sheriff's department told NBC News on Thursday that many of those records were duplicates, and the company's assertion that there were only 145,000 people exposed nationwide is the best current estimate of the number of victims.

Bob Sullivan is the author of Your Evil Twin: Behind the Identity Theft Epidemic

MORE FROM SECURITY

Security Section Front

Check your junk mail: Might have a contract in it FTC warns of increase in Internet scams Man indicted in hacking of Palin's e-mail Tiny flash drives improve their security Fake YouTube pages used to spread viruses EU proposes more rights for Internet shoppers Gmail 'Mail Goggles' stymie drunk e-mailing Fraud plagues prepaid calling card market GPS 'spoofing' could threaten national security Chinese snoop on Skype, but are they alone? Security Section Front   Add Security headlines to your news reader: