A

IDENTITY THEFT

The assumption of a person's identity in order, for instance, to obtain credit; to obtain credit cards from banks and retailers; to steal money from existing accounts; to rent apartments or storage units; to apply for loans; or to establish accounts using another's name.

Computer Help-Desk Worker, Data Collection Company Involved in Major Identity Theft Cases

In 2004 and 2005, a computer help-desk worker and a major data-collection company were involved in major scandals relating to identity theft. The help-desk worker pleaded guilty in 2004 to helping others to steal an estimated 33,000 consumer credit reports. The data-collection company, in an unrelated case, gave scammers access to personal data of an estimated 145,000 people. The cases have demonstrated flaws in U.S. privacy laws, as well as the level of vulnerability that consumers have to electronic fraud.

Phillip A. Cummings took a job as a help-desk worker with Teledata Communications, a small company in Bayshore, New York, in 1999. Teledata manufactures "credit prompter boxes," which are credit-check terminals used by companies to perform routine credit checks. More than 25,000 companies, such as car dealerships and apartment-rental offices, use these terminals to check the credit ratings of applicants. Cummings worked for Teledata until March 2000.

During his employment with the firm, Cummings had access to user names and passwords that could be used to access credit reports. According to court documents, he took a spreadsheet containing user names and passwords with him when he left the firm. Law enforcement officials said that anyone in Cummings's position could have obtained this information. "Any help-desk representative has access to confidential passwords and subscriber codes of (Teledata) client companies that would have enabled that employee to download credit reports from all three credit bureaus," said Kevin Barrows of the FEDERAL BUREAU OF INVESTIGATION.

Cummings sold the user names and passwords to several accomplices, who used these codes to gain access to thousands of credit reports from consumers. One accomplice began to obtain credit reports in 2001, when he posed as a representative of Ford Motor Credit. By the end of 2001, the impostor had acquired about 13,000 credit reports. Accomplices impersonated representatives of dozens of other companies until authorities broke up the crime ring. Authorities said that those who received the credit reports made money through several means. Perpetrators depleted bank accounts; changed addresses on accounts; ordered new checks, new ATM cards, and new credit card accounts; and opened new lines of credit.

Some accomplices had been arrested prior to Cummings. Linus Baptiste was arrested in 2003 and pleaded guilty to fraud and conspiracy charges. Hakeem Muhammad also pleaded guilty to committing fraud, while Emanuel S. Ezediaro was arrested for paying thousands of dollars to Cummings and Baptiste to obtain credit reports. Two others, Eniete Ukpong and Ahmet Ulutas, also pleaded guilty to charges stemming from the scam.

Cummings told the U.S. District Judge George B. Daniels that he "didn't know the magnification" of his actions. Daniels, however, said that the case "emphasized how easy it is to wreck havoc on people's financial and personal lives." The total damages caused by the scheme were estimated at $50 million to $100 million, figures that the judge said were "almost unimaginable." Judge Daniels received statements from more than 300 victims, many of whom had spent months dealing with credit agencies and other authorities.

Judge Daniels sentenced Cummings to 14 years in prison and ordered him to forfeit __BODY__ million in proceeds that he had received from the scheme. Cummings sought leniency from the judge due to a heart condition that he suffers, but Daniels refused.

In an unrelated case, ChoicePoint, a commercial data broker, discovered that it had sold personal information of more than 145,000 U.S. citizens to scammers posing as legitimate small-business clients. The security breach led consumers to file a series of lawsuits, and both the SECURITIES AND EXCHANGE COMMISSION and the FEDERAL TRADE COMMISSION announced that they were investigating the case.

ChoicePoint provides consumer-data services to government agencies, as well as to insurance and other companies. Most of its clientele consists of larger corporations, although it also serves some smaller businesses. On September 27, 2004, ChoicePoint discovered that some of its small-business customers in the Los Angeles area had engaged in "suspicious activity." Under the California Security Breach Information Act, which became effective on July 1, 2003, ChoicePoint was required to notify California residents that their information had been accessed improperly. The company also notified law enforcement officials.

The discovery led to a public outcry for the company to inform customers outside of California about the breach. By February 2005, the company had notified 110,000 additional people that their records had been accessed. ChoicePoint filed a document with the SEC on March 4, 2005 indicating that the records had been purchased by 50 fraudulent companies between July 1, 2003 and September 2004. The company did not release information about possible breaches that might have occurred prior to July 1, 2003, leading to speculation that more records might have been accessed prior to that date.

The actions of ChoicePoint's top executives in the months that followed the discovery of the improper sales led many to question the company's actions. Between November 2004 and February 2005, the company's CEO sold more than 300,000 shares of company stock, while the company's president sold approximately 130,000 shares. Although the company had worked with law enforcement in California to investigate the case, officials said that the company had been free to disclose the breach as early as January 1. The company did not announce the breach until February 15.

The cases involving ChoicePoint and Phillip Cummings are among a series of incidents involving identity theft in 2004 and 2005. In one case, authorities charged a Red Cross employee and two other people with stealing personal information about 40 blood donors in Philadelphia and with using the information to obtain about $268,000 in cash and goods. In another case, thieves allegedly stole the names and social security numbers of as many as 45,000 former military and intelligence workers from the computer records of Science Application International Corp., a government contractor. Among the potential victims were John M. Deutch, former director of the CENTRAL INTELLIGENCE AGENCY, and William Perry, former Secretary of Defense.

Congress Approves Legislation Designed to Curb Identity Theft

President GEORGE W. BUSH on July 15, 2004 signed into law the Identity Theft Penalty Enhancement Act, Pub. L. No. 108-275, 118 Stat. 831, which increased penalties for those who commit identity theft. The enactment came a year after Congress approved the Fair and Accurate Credit Transactions Act ("FACT Act"), Pub. L. No. 108-159, 117 Stat. 1952 (2003), which allows individuals to obtain credit reports free of charge. The provisions of the FACT Act began to be implemented in 2004.

Identity theft has continued to be a major problem in the U.S. The FEDERAL TRADE COMMISSION reported that 161,836 cases of identity theft occurred in 2002, affecting 9.9 million victims. By 2003, the number of cases increased to 214,905. According to an FTC survey, as many as 27.3 million were victims of identity theft between 1999 and 2004. Identity theft has cost businesses and consumers several billion dollars.

Representative John R. Carter (R.-Tex.) introduced the Identity Theft Penalty Enhancement Act in 2003 as H.R. 1731. The Senate considered a similar bill, S. 153, which had been introduced by Senator Dianne Feinstein (D.Cal.). The Senate's version passed with unanimous consent on March 19, 2003. The House Judiciary Committee received both bills on May 5, 2003 and referred them to the Subcommittee on Crime, Terrorism, and Homeland Security. The subcommittee did not take action on the bills until March 2004, when it conducted hearings. After approval by the subcommittee, the Judiciary Committee approved the House bill on May 12, 2004. The bill easily passed in both the House and the Senate in June 2004.

The new law amends Title 18 of the United States Code to create a new crime termed "aggravated identity theft." Under the new law, a person commits this crime by "knowingly transferring, possessing, or using, without lawful authority, a means of identification of another person…." The bill establishes a mandatory sentence of two years in prison for one who commits such a crime and forbids a judge from placing such a person on probation. If a person commits this crime in relation to terrorist acts, the length of the penalty increases to five years.

The statute also includes a provision directed toward "insider" identity theft, which takes place when employees use their insider status to gain access to credit reports or other personal information of their employers' clients or other employees. Another provision of the statute authorizes appropriations to the JUSTICE DEPARTMENT to investigate and prosecute identity theft and related cases.

Carter referred to the bill as "one of the shots taken in a battle that we've got to win…. It's a crime that we need to address and address seriously, both for the protection of the credit of American citizens and for the protection of homeland security." Bush echoed these statements when he signed the bill. "The law I sign today will dramatically strengthen the fight against identity theft and fraud," he said. "Prosecutors across the country report that sentences for these crimes do not reflect the damage done to the victim. Too often, those convicted have been sentenced to little or no time in prison. That changes today."

In December 2003, Bush signed the FACT Act, which was designed to establish a national system of fraud detection. The FACT Act amended the FAIR CREDIT REPORTING ACT, 15 U.S.C. §§1681 et seq. The statute had an impact on all consumers in 2004 and 2005 because it allowed all consumers to check the accuracy of their credit reports in order to prevent identity theft.

Three nationwide credit bureaus, including Equifax, Experian, and Trans-Union, provide credit reports that banks and other lenders use to research credit histories of consumers. The credit report provides a detail of each consumer's line of credit, including whether the consumer has paid bills on time, whether the consumer has filed for bankruptcy, and similar types of information. The purpose behind providing free credit reports to the consumers is to allow the consumers to spot errors that could have resulted from identity theft.

Under the statute, each consumer became eligible to receive his or her report based on their location. Consumers living in 13 western states could order their reports beginning on December 1, 2004. Consumers in 12 midwestern states could receive their reports beginning on March 1, 2005, followed by consumers in 11 southern states on June 1. Residents of the remaining eastern states, along with residents of the DISTRICT OF COLUMBIA, Puerto Rico, and other U.S. territories can order their reports beginning on September 1, 2005.

The FACT Act established a new National Fraud Alert System. Under this system, when a consumer notifies one credit bureau of an incident of identity theft, the other two bureaus are also notified. The statute additionally contains other provisions, such as one that forbids businesses from disclosing social security numbers and credit card numbers on consumer receipts.

Events that occurred after the passage of these new statutes appear to amplify the need for stronger regulations, according to many commentators. In one case, ChoicePoint, Inc., a leading broker in personal data, reported in February 2005 that it had inadvertently sold personal information about 145,000 people in a series of identity-theft scams. According to one state official, "The ChoicePoint issue makes it clear we are all vulnerable to the misuse of information that is stored technologically."

Other commentators said that these statutes are just the first step, but that other problems must be addressed. For instance, one expert noted that local law enforcement agencies need to have more resources at their disposal in order to catch, prosecute, and convict identity thieves. According to this expert, local law enforcement agencies "don't have money for the equipment to investigate identity theft. The criminals have better equipment than law enforcement does."

Ohio Launches New Identity Theft Program

In December 2004, Ohio launched a pilot program to combat identity theft and to help victims of this crime. With a $400,000 start-up grant from the United States Department of Justice, the Identity Theft Verification Passport Program will help to rehabilitate a victim's credit history. It also provides proof to law enforcement personnel and creditors that a person's identity information has been stolen. If successful, the program will serve as a model for other jurisdictions.

Identity theft is committed when someone uses personal information, such as the name, address, or social security number of another person, in order to commit fraud or other crimes. According to Ohio Attorney General Jim Petro (himself a three-time victim of identity theft), approximately 100,000 Ohioans are victimized by identity theft each year. Nationwide, the number of victims in 2003 was ten million. Businesses, individuals, and law enforcement lose more than $50 billion per year because of the crime. It can take up to two years for a victim to clear up a credit record that has been marred by identity theft.

According to Petro, the effects of identity theft are not measured merely in dollars. It is not unusual for victims to lose job opportunities or to be refused loans for education, housing, or automobiles. When he announced the program, Petro told of an Ohio woman who had been arrested, had had her car impounded, had been sued in a civil lawsuit, and had had her driver's license suspended. All of these things occurred because a former acquaintance had given the victim's name instead of her own when she was involved in a traffic accident.

The first step in the program takes place when a person notifies police that his or her identity has been stolen. Victims must prove not just theft of their identity information, but also that the information has been used for an illegal purpose. In other words, someone who has simply lost a purse or wallet may not obtain assistance under the Passport program. There must be evidence that the identity information was actually used for an illegal purpose, such as to open a credit card account fraudulently.

Once authorities verify the facts, they work with the victim to fill out an application. The victim is fingerprinted, provides a digital signature for the application, and is photographed.

The collected information is sent to the Ohio Attorney General's office. Victims are then issued a card that they can show to creditors and law enforcement authorities. The card proves that a person has been the victim of identity theft.

To prevent further criminal activity, the card has various security features built in. Moreover, it can only be activated through a special verification phone number that the victim must call from another specific phone number. Petro called the card the "cornerstone" of the program.

If someone tries to use a victim's identity again, the card will help to alert law enforcement officials and creditors that a new crime is being attempted. The person claiming to be the identity-theft victim will have his or her identity verified through the digital signature, photograph, and fingerprint. Likewise, the card helps authorities and creditors to identify a person as the victim of the theft and to rule that person out as an offender.

Only the Passport holder's photo appears on the card. The signature information and fingerprint are available through a secure, restricted web site. Law enforcement authorities and creditors use the information on the web site to verify that a person is the victim, rather than the perpetrator, of identity theft. Creditors and law enforcement personnel may also use a special phone number instead of the web site to verify the information.

Under the program, all identity theft victims receive step-by-step instructions on alerting creditors to the fraudulent activity involving their identity. Victims also receive fill-in-the-blank affidavits to send to creditors and credit bureaus.

The program is retroactive. Anyone who was a victim of identity theft in Ohio during the seven years prior to December 14, 2004, may apply to the program. Those who were victimized before December 14, 2004, need to return to the police station where the criminal report was originally filed. At the station, authorities will work with the crime victim to fill out a Passport application. Only Ohio law enforcement personnel are authorized to fill out an application form.