Crap In, Crap OutBy John McCormick | Posted 2005-06-14 Email Print
Modernizing Authentication — What It Takes to Transform Secure Access
Steven Calderon was into his second week working as a security guard for Fry's Electronics when Anaheim, Calif., police walked in and arrested him. Fry's had requested a background check on Calderon, which was done by The Screening Network, a service of C
Crap In, Crap Out
Another issue with CLUE is the way the service pulls information from its data stores.
According to ChoicePoint's Curling, a typical request from an insurance company might be to find out about a driver, the driving records and claims histories of any other people living at the driver's address, and to verify that the vehicles in the driver's household realistically match the number listed by the driver on his or her policy application.
A query from an insurance company might start with a name and state—say, Sam Smith and California.
ChoicePoint will pull data from the state's motor vehicles department, which will provide information on all drivers at an address. It will also pull car registrations. It will then dig into CLUE to get the claims histories.
But you have to be careful when you cull any database, say English, Navesink Consulting president Tom Redman and other data experts. There may be a lot of Sam Smiths. Many might be living in the same area and be about the same age. And the query might return files under "Sam Smith" and "Samuel Smith."
"So when you marry this data up, you have to interpret who this person is," the 20-year data expert explains.
Not only that, but if one of the Sam Smiths' driver's license numbers or Social Security numbers was put incorrectly into the system and wound up matching someone else's number—even if that person's name isn't Sam Smith—that information could be melded into the report, too.
This may be what happened to Robert Burkhead, a retired GE assembly line worker.
In 1998, Burkhead was buying a car in Kentucky and tried to get car insurance. But, he says, his insurance history, which was supplied by ChoicePoint, showed that another person's Social Security number, that of a "K. Caye," had been added to his file, along with Caye's auto accidents. Not surprisingly, this put Burkhead into a higher risk category, with premiums that were $500 to $600 higher than the standard annual rate, according to his attorney, Bernard Leachman.
After Burkhead got a look at his report and figured out what was going on, he tracked down Caye's agent at Nationwide Insurance, which apparently had been using Burkhead's Social Security number with Caye's account. Burkhead said he sent a letter to ChoicePoint and also placed a couple of calls to customer service reps at ChoicePoint, who said they would take care of the mistakes. But nothing happened. This went on for five years.
Burkhead's headache got worse. In 2003, Burkhead claims ChoicePoint substituted his driver's license for Caye's and added multiple claims by Caye to Burkhead's report.
In April 2004, six years after the mixup began, Caye and his accidents were finally deleted from Burkhead's report. But even that didn't end Burkhead's problems.
Burkhead says his son, Robert Burkhead III, somehow was added last year to his report and listed as living with his parents—even though the son lives on his own and was filing for both bankruptcy and divorce.
Burkhead had enough and last year sued ChoicePoint. The complaint filed in the case cites ChoicePoint's "gross, wanton, willful and malicious faulty management of data and reports." Leachman says ChoicePoint does not scan claim reports for accuracy when they enter or leave its system. "There is a cross-check of birth date and Social Security number and driver's license number and similar names that the computer automatically does, but there is no reason I know of why Mr. Caye kept showing up on these reports," he says.
ChoicePoint refused to comment on an ongoing case. However, in its answer to the complaint, ChoicePoint admitted that it had received a letter and phone calls from Burkhead, and that Nationwide had submitted information to CLUE that tied Burkhead's driver's license with Caye's claims.
However, ChoicePoint said "it lacked sufficient knowledge and information" to know whether the other complaints lodged against the company were accurate. And the company denied any wrongdoing on its part. "Plaintiff's damages, if any were incurred, are as a result of the actions or omissions of other parties or individuals for whom ChoicePoint has no responsibility," reads the answer to the complaint.
Indeed, ChoicePoint's service agreement with insurance carriers stipulates that, "Neither CPS [ChoicePoint] nor third parties shall be liable ... for any loss or injury arising out of or caused in whole or in part by CPS's or third parties' negligent acts or omissions in procuring, compiling, collecting, interpreting, reporting, communicating or delivering services or in otherwise performing this agreement."
That gets right to the crux of the problem. A broker such as ChoicePoint does not vouch for the accuracy of the data it collects and then resends to insurance companies, law enforcement agencies and employers.
As the 20-year data expert puts it: "Crap in, crap out."
Despite the disclaimers, data experts, including English and Redman, say data brokers should be responsible for the accuracy of the information they distribute. "They don't verify. They just capture," English points out. "That's got to change."
Not Just Security — Accuracy. "Serious" Errors are Common Data Customers Pay the Costs Collecting Data Without Garbage Filters Records "Full of Inccuracies" Crap In, Crap Out Fix It Yourself No Way To Check ChoicePoint Data at a Glance