State a data broker hub

Congressional panel looks at sale of confidential info

Jeff Smith, Rocky Mountain News

Monday, April 24, 2006

A congressional investigation into the potentially illegal practice of selling private information such as cell-phone records is focused in large part on Colorado.

Several information brokers in the state have talked to investigators, and three have described business dealings with the firm owned by state Rep. Jim Welker. His Universal Communications Co. in Loveland is one of at least 15 companies under federal investigation.

The information brokers, two of whom talked to the Rocky Mountain News, paint a picture of Welker knowing that his firm was aggressively promoting the sale of confidential information, including phone records.

Welker maintains the company did nothing illegal and didn't sell the records to the general public.

A price list obtained by the News shows that Welker's firm recently was selling a couple of dozen types of information, including an individual's cell-phone records for $70. That included details on up to 100 calls from the customer's most recent bill. The firm was selling similar records for long-distance calls for $55.

Experts say Colorado has long been a nexus for information brokers in part because it's one of only a handful of states that don't license private investigators. Private investigators haven't been regulated in Colorado since 1977.

Investigators allege information brokers often impersonate a customer or someone else to get a person's phone records. Officials are concerned about invasion of privacy issues, as well as the possibility the information will be used to hurt a person financially or physically, such as in the case of identity theft or an abusive husband monitoring every move of his estranged wife.

Over the years, authorities have successfully charged some information brokers with civil fraud or the felony crime of racketeering. But in general, prosecutions are difficult because of the lack of specific laws.

Federal lawmakers are now sponsoring bills to prevent the collection and selling of certain private information such as phone records.

Attorneys general in Texas and Illinois also recently filed deceptive trade charges against some information brokers, including Frederick- based Worldwide Investigations.

In the Texas case, John Strange, president of Worldwide, testified he bought cell-phone records from Welker's firm. Strange operated a Web site in which the records were sold over the Internet to the general public.

The Colorado attorney general's office successfully sued Welker in 2002 for trapping phone numbers from debtors and turning them over to collection agencies. But Welker continued his information-broker business, expanding it to include the detailed phone records.

Colorado Bureau of Investigation agent Bob Brown, who previously led investigations of information brokers, would say only that his office has an "ongoing interest" in the business.

Welker - a Loveland Republican who recently announced he would not run for another term - has acknowledged his firm sold private cell-phone records but said it stopped a few weeks ago after he spoke to congressional investigators. He maintains the company did nothing illegal, didn't sell the records to the general public, and says he doesn't know how his company obtained the phone records.

"We got them from somebody else," Welker said in a recent interview at his legislative office in the Capitol. "How we got them I don't know. I don't know everything our business does because I'm not up there running it."

He also said he didn't know Strange, even though his company sued Strange for $3,000 in a nonpayment case in 2005.

Rob Douglas, a nationally known security consultant who operates a site called PrivacyToday.com and lives in Colorado, called Welker's assertions unbelievable.

"Welker's claim that it's not 'illegal' to obtain and sell Americans' phone records is not credible," said Douglas, who has testified in front of Congress eight times. "In every case I've worked or studied across the country involving companies like Welker's, the records were obtained by fraud."

Douglas noted that James Rapp, who ran a business called Touch Tone Information Inc., pleaded guilty in 1999 to a racketeering charge of using deceptive means to obtain private information. Rapp was sentenced to 75 days in jail and four years' probation, although he said last week he spent only about a month in a halfway house and three years on probation.

"There is no difference between James Rapp and James Welker, other than one went to jail and the other appears to be hiding behind his elected office to claim ignorance of how his company profits from stolen information," Douglas said. "Everyone in the business that Welker is in knows the records are obtained by deceit by impersonating the actual phone customer and deceiving the phone company into wrongfully turning over the phone records."

David Gandal, a Loveland resident who runs an information broker business called Shpondow Repo Info Solutions, also disputes the notion that Welker doesn't know what's going on at his own firm.

"He does know; he knew everything."

Gandal, who has talked to congressional investigators, said he was living in Long Island, N.Y., when he began to do work for Welker. After two years or so, Welker gave him $4,500 in September 2002 to open an office in Colorado. The relationship lasted about a month.

"We were going to go in business together, but Welker found I wasn't his type," Gandal said. "I wouldn't go to prayer meetings with him every day . . . they basically blackballed me because I wouldn't accept Jesus Christ as my savior."

Gandal said he is Jewish.

Welker didn't return a phone call and e-mail last Friday for comment.

Larimer County court records show Welker's firm sued Gandal for $2,886 in May 2003. The suit indicates Gandal originally had owed $4,500 but had "worked" the debt down to $2,886. Gandal said he since has paid off the amount.

Douglas describes the information broker business as a "spider web," with those who are expert at impersonating law enforcement officials at the center. Other information brokers often do business with those at the center, and private investigators, debt collectors and the like are at the periphery of the web, buying the services.

Information brokers trade techniques, scripts and gossip in private online chat rooms. They fax their price sheets to other data brokers and private investigators, and many have Web sites in which they promote their services to a broader clientele.

Gandal is considered one of the experts in getting a person's phone records, and he acknowledged he's pulled "thousands" of such records.

"It's called social engineering," Gandal said. "It's completely legal, but there's ethical questions."

When asked if it involves impersonating someone, Gandal said: "It involves pretext, absolutely."

He said he doesn't personally fear law enforcement officials coming after him, but said those in the industry worry about the proposed legislation and realize "enforcement is just down the road."

For that reason, he said, he wants to testify in front of Congress about the business. "I want my 15 minutes" of fame, Gandal said.

Gandal has a Web site with a price list of his services. But he maintained he doesn't sell to the general public. He said 90 percent of his work is for the car repossession industry and the other 10 percent for private investigators.

He said if information brokers are shut down, it will be difficult to track down the bad guys.

"There's a lot of idiots who buy four, five cars with no intention of ever making a payment," Gandal said.

Rapp, who maintains he's now out of the business, also is cooperating with congressional investigators.

He said he knew Welker by his middle name Paul, and used Welker's trapline services, then under the company name Tel-Scan, for about five years in the 1990s to ferret out the identity of people with certain pager numbers.

Rapp said Welker eventually published his own price sheet that offered services identical to Rapp's.

"Apparently one of my employees went to work for them," Rapp said.

He said the only thing that perturbed him was that Welker often undercut him in price.

Protecting your information

• Never provide personal information - Social Security number, date of birth, mother's maiden name, passwords/PINs, etc. - in response to a request received by phone or e-mail. If someone contacts you, get their name, then contact the company directly by a phone number listed with directory assistance or a Web site located via an Internet search.

• Place alpha-numeric passwords on all consumer accounts. Don't use passwords that contain personal or biographic information such as your mother's maiden name.

• Don't use or allow password reminders on consumer accounts. If you forget your password go directly to the business and provide identification.

• If you have available, but are not using, online account access for phone, financial, or other consumer accounts, instruct the company to deactivate the online access. If you are using online access, change your password regularly.

• If you don't require a bill with details of your specific phone calls, instruct the carrier to remove call details from your bill.Source: Rob Douglas, Privacytoday.Com

How information brokers get phone records

• Investigators say data brokers use "pretext," claiming to be the customer, a phone company employee or someone else who is entitled to the private records.

• While impersonating a law- enforcement official is illegal, the law is fuzzier on the issue of impersonating a customer. Many federal lawmakers want a specific law that would ban the practice of lying to get phone records.

• Why selling phone records is bad: Congressional investigators are concerned about such issues as invasion of privacy, identity theft and stalking.

smithje@RockyMountainNews.com or 303-892-5155