Quotes of the Day

The National Security Agency may not be the only one looking at your phone records. As the agency’s controversial program of collecting Americans’ calling data continues to draw heat, new questions have emerged about whether federal and local law enforcement officials are possibly skirting privacy laws by obtaining phone records from companies that get the information in a questionable manner and then hawk it over the Internet.

Since February, Congress has been investigating such so-called data brokers for the ways in which they gather their information. Some of them use people inside the phone company who are willing to divulge the data. But more commonly, these businesses obtain phone records through an illegal practice known as "pretexting," in which someone calls up the phone company and impersonates a subscriber to con the service representative into releasing copies of the records.

The possible connection with law enforcement came to light when the data brokers were asked as part of the Congressional inquiry to submit letters revealing their client lists. One data broker listed as clients the FBI and unspecified "foreign governments," while another claimed to have done work for the Department of Homeland Security. Neither company will reveal the extent of the data they gave out. Both the FBI and the Department of Homeland Security deny any wrongdoing.

It remains an open question whether law enforcement obtaining the private phone records of Americans in this fashion is actually illegal. While most data brokers claim there is no specific law against the sale of phone records, as there is with banking records, and therefore it should not be illegal, the Federal Trade Commission and numerous state attorneys general disagree. Collectively, they have brought more than a dozen cases against data brokers based on state and federal statutes governing unfair and deceptive trade practices.

Information brokers insist they provide a valuable service to creditors, attorneys and private investigators "to catch bad people" — among them stalkers, fugitives from the law and deadbeat dads. Although data acquired through pretexting is not admissible in court, such information can be useful as an investigative shortcut, without having to wait for a warrant or subpoena. "Fifty years from now you’re going to need a subpoena to talk to your neighbor," says one frustrated data broker, Noah Weider, president of IEI, which runs BestPeopleSearch.com.

Investigating Data Brokers

The House Energy and Commerce Committee's probe into data brokers has been dogged by controversy. Robert Douglas, an information security consultant who runs PrivacyToday.com and was hired to do research for the committee, resigned in April because he felt allegations that the FBI and Department of Homeland Security were purchasing phone records were not being investigated thoroughly enough. And a bipartisan committee bill to protect phone records by outlawing pretexting was suddenly withdrawn just before a full House vote in early May. Some Democrats suspect there may be a connection between the pulling of the bill and the recent revelations of the NSA's collecting of citizens' phone records. Democratic committee members sent a letter to Chairman Joe Barton, asking if the bill was withdrawn so that the Intelligence Committee could add an exemption allowing phone records to be sought for intelligence-gathering purposes. In a separate letter to Barton and Speaker Dennis Hastert, Rep. Edward Markey wondered whether there was a plan to add an exemption "to clarify the legality of such a program because they are currently gathering such records today without clear authority." An Intelligence Committee spokesman told TIME that the bill was pulled because more time was needed to determine how it might impact national security issues.

Who Is Using the Information?

In its letter to the House committee, made public earlier this month, Advanced Research, Inc. (ARI), the operator of ADVSearch.com, said the company has "done work for municipalities, banks, mortgage and insurance companies, private companies, foreign governments, law enforcement, even the FBI." Michael Kortan, FBI spokesman, says it is possible the bureau has used companies like Advanced Research, but notes that these companies provide many services other than accessing phone records. "They offer a wide variety of compressing publicly available data that saves a lot of legwork and saves a lot of time," Kortan told TIME. While saying it did not sound plausible that the FBI has bought phone records from Advanced Research, Kortan said he hasn't looked into the matter closely. "We have very established ways of collecting information. The FBI can only collect and retain data available from commercial databases in strict compliance with applicable federal law."

Bruce Martin, vice president of Advanced Research, said he did not think the FBI had purchased services since 1999, when he joined the company, but he understood that information was sold to the bureau before then. “We do not sell telecommunications information any more,” he said. Martin's firm, however, is being sued by the Illinois Attorney General for obtaining and selling phone records without the consumer's consent. With regard to these charges, Martin contends that ARI is simply a middleman: "We have certification from all our researchers that everything they do is legal and they don’t tell me how they do it."

How Is the Data Used?

Most purchasers of cellphone records online tend to be those checking up on a spouse or trying to collect debts. Other users include lawyers, private investigators and the police. While the evidence is not admissible in court, knowing whom a suspect is talking to can prove useful in solving crimes and inducing confessions. "Just because evidence is not used at trial doesn’t mean it has no effect on the case or that there’s no harm," says Sherwin Siy, staff counsel at the Electronic Privacy Information Center. Texas-based PDJ Investigations, which runs several online information-gathering sites, along with another data broker who wished to remain anonymous, told TIME that they willingly give information to the police, often for free, if it is requested. Many websites in fact advertise helping law enforcement.

Patrick Baird, vice president of PDJ investigations, says that in its six years the company has supplied information for between 200 and 300 law enforcement cases. He said the FBI and the Department of Homeland Security were among the company's past clients. But Baird said most of the time these agencies (and most of PDJ's other customers) ask simply for the name and address attached to a specific phone number, not for complete call records. Yet Douglas, the former researcher for the Congressional committee, points out that even that information most likely is obtained through pretexting. The anonymous data broker confirmed for TIME that pretexting is the most common way to get name and address information for phone numbers. Jarrod Agen, a spokesman for the Department of Homeland Security, said the agency has "no records of contracts" with PDJ. Though the agency does work with "some contractors that do buy information," he added, it is "not private data. We don't go out and buy private information."

What Is Legal?

The shady business of pretexting to get personal information has been thriving for years. But online sellers are relatively new. Typically, these brokers claim they can obtain anyone’s phone records for around $100. There have been few lawsuits, mostly because the majority of victims never learn that their phone records were accessed.

"States and governments use the information all the time, so it's possible to do it legally," says Martin of ARI. “Absent a law it seems unfair to go after someone when they just decided it was illegal.” But the Federal Trade Commission and cellphone companies claim impersonation like this is fraud, violating federal and local statutes.

Civil liberties lawyers argue that regardless of the technical legality, it’s an ethically questionable practice for police to use fraudulently obtained information in their investigations. "As a policy matter there are set procedures [police] should use instead of sidestepping them for convenience sake,” says Siy from the Electronic Privacy Information Center. Under the Telecommunications Act of 1996, phone records are customers’ private property and phone companies can disclose them only with the consent of the subscriber or with a subpoena from law enforcement. The act applies only to telecom companies, however, saying nothing about third parties selling records. "I can give a pass to the average American being confused as to the legality of [buying phone records]," says Douglas. "But Law Enforcement 101 is the need to get a subpoena or warrant to obtain the private records of Americans."

What You Can Do

To protect your own phone records, the most secure way is to call your cellphone carrier and ask to have call details removed from your bill. The drawback is that if you have a discrepancy over minutes used, it will be more difficult to dispute, since there will be no record of your individual calls. Another way to protect your account is with a password that only you know and doesn’t contain biographical information. You should also avoid giving out your cellphone number, Social Security number and other personal data online, when at all possible. And don't throw phone bills in the trash without shredding them first.

—With Reporting by Brian Bennett/Washington

• Kristina Dell
• A Congressional inquiry into online data brokers has raised concerns that federal and local law enforcement may be skirting privacy laws to obtain calling records