Phone call records sold on the Web

Phone companies and federal lawmakers are demanding it be halted. The FCC is launching an investigation. The business of buying and selling private phone calling records is suddenly under considerable scrutiny.

The Internet, it turns out, has taken something old — a tool for monitoring cheating spouses or conniving business associates — and made it new again.

Last week, at least 40 Web sites were offering cell-phone numbers, unlisted numbers and calling records. For $110 or so, they’d sell you a month’s worth of cell-phone calling records for any number, no questions asked.

Such records have been bought and sold for decades, prized by private investigators, lawyers and people in less legitimate professions.

Case in point: In 1998, Los Angeles’ police department had a serious security problem. Suspected mobsters obtained home phone numbers and addresses of detectives. In an apparent attempt at intimidation, one mobster showed up at a police officer’s home while he was at work, gave his name to the officer’s wife and walked away.

The LAPD eventually determined that the officers’ personal data came from a Denver firm, Touch Tone Information Inc., that used a technique known as “pretexting.” Touch Tone workers would call up phone companies and records holders pretending to be regulators, customers or employees and get them to divulge account information.

The case stirred outrage. The Federal Trade Commission forced Touch Tone out of business and its owner, James Rapp, spent a few months in jail. Robert Pitofsky, chairman of the FTC at the time, said: “This case should send a strong message to information brokers that the FTC will pursue firms that use false pretenses to profit at the expense of consumers’ privacy.”

Six years later, “pretexting” is again in the spotlight. According to reports this month, Chicago’s police department has warned its officers that their cell-phone records are available online. Illinois’ attorney general subsequently subpoenaed Locatecell.com, a Web site that sells such records.

Locatecell.com, which is run by a company called 1st Source Information Specialist, was not reachable by phone to explain its methods and did not respond to an e-mail seeking comment.

But according to industry insiders, companies like it obtain their information from a relatively small group of professional “pretexters.”

The “pretexters” buttress their believability by buying such personal data as Social Security numbers from online database companies. Often a name, address and the last four digits of a person’s Social Security number are all that’s needed to obtain calling records.

Another route is to buy the information from insiders, like phone company employees.

So why didn’t the Touch Tone case put such businesses out of business?

For one, the FTC went after Touch Tone not for snooping on the private lives of police officers but for “pretexting” financial information from banks.

“Our primary focus there was on financial, because that’s really where the most direct harm is,” Joel Winston, associate director of the FTC’s division of privacy and identity protection, said in an interview. “If I’m pretexting a bank and getting your bank account records I can drain your account.”

The Web sites that sell phone records these days claim they aren’t doing anything illegal in obtaining them. They claim no specific prohibition exists against posing as someone else to obtain private information as long as the data is not financial.