ChoicePoint:
Personal Data and a Loss of Privacy
Overview
•
•
•
•
•
•
•
The Moment, The Problem
Timeline
ChoicePoint Background
The Personal Data Industry
Key Issues
Key Players
Corporate Communication Issues Now
and Going Forward
The Moment, The Problem
• September 27, 2004
– ChoicePoint discovers possible fraudulent
activity within their network of databases
– Realizes it may have allowed identity thieves
in the Los Angeles area, posing as legitimate
businesses (phony insurance companies,
check-cashing companies, and other
qualifying businesses) to access people’s
personal information
The Moment, The Problem
• Mid-October 2004
– Begin working with LASD
– Discover identity theft ring that had set up 50+
fake companies
– Criminals received everything from SSNs to
credit reports, more than enough to steal
identities
– 35,000 Californians and 110,000 other people
across the country in all 50 states became
potential victims of identity theft
The Moment, The Problem
• Mid-October
– LASD delays disclosure to prevent hindering
investigation
– Under California law, unlike the rest of the
nation, citizens must be informed when
personal information is compromised
The Moment, The Problem
• October 26, 2004
– The first and only arrest to date is made
– A Nigerian man, Olutunji Oluwatosin, 41, was
apprehended in a LASD sting operation
– Later sentenced to 16 months in CA state
prison, pleading no contest to a single count
of unlawful use of personal information
The Moment, The Problem
• November 9th, 2004
– Executives begin a 6-month program to sell
24% of their ownership in the company
– Sell 458,000 shares, $20M+ in market value,
$16M in profits, before public disclosure of
identity theft problem
The Moment, The Problem
• February 14, 2005
– ChoicePoint publicly
discloses security
breach
– Sends letters to
California residents
• At this point, 750
identity theft victims
had been identified
The Moment, The Problem
From February 14th to March 8th
Stock plummets nearly 20%
The Moment, The Problem
• Why did it take four months to disclose the
problem to the public? (Oct - Feb)
– Initially, LASD did not want to hinder
investigation, but what about after that?
– LASD reports they told ChoicePoint in a letter
to disclose in early November
– ChoicePoint says they were told to disclose in
January
– LASD Lt. Costa: “ChoicePoint must have
misinterpreted our letter”
Company Background
• Founded in 1997 when Equifax, an information
management company, spun off its insurance
services group
• Former Equifax VP, Derek Smith, and Sr. VP of
Finance, Doug Curling start ChoicePoint as it is
today from scratch
• From small insurance arm of Equifax to the
premier provider of decision-making intelligence to
businesses and governments
• Rapid growth through 60 strategic acquisitions
• From small insurance arm of Equifax to the
premier provider of decision-making
intelligence to businesses and governments
• Rapid growth through 60 strategic acquisitions
Company Background
• After 9/11/01, company surges through key
acquisitions of Templar Corporation and
IMapData Inc. (U.S. Government becomes
one of main clients)
• Wide client base:
– Insurance agencies, corporate employee
screeners, check-cashing companies, nonprofit organizations, media outlets, private
investigators, law enforcement officials,
landlords, other prospective employers
Company Background
• Now, 19 billion public and private records
• Collects and sells financial, medical, and
other personal records on billions of people
• 50,000+ customers
• 5,500+ employees
• FY2004 Revenue: $900M+
• FY04 record revenue, growing 14% per year
• FY04 Gross Margin: 50%
• Profit Margin: 15%
Stock Price Data
•
•
•
•
•
•
Symbol: CPS on NYSE
52-week range: $36.35 - $47.95
Closing price on April 25th : $39.90
Insider/Institutional: 3% / 82%
Market Capitalization: $3.59 B (mid-cap)
Market Cap before 2/15/05 : $4.4 B
Stock Price Data
The Personal Data Industry
• $5B Data-brokering Industry
• New one-stop shop phenomenon in last
10 yrs
• ChoicePoint, Lexis-Nexis, Acxiom
• Power of computers, lower costs of data
storage, speed of internet
• Able to aggregate, store, and retrieve
large amounts of information quickly
Information Available for Purchase
•
•
•
•
•
Social Security Numbers
Current and previous addresses
Credit information
Employment history
Motor vehicle records, driver’s license
information and vehicle identification
numbers
Information Available for Purchase
• Police and criminal records (includes 100
million conviction records and prison,
parole and release records)
• Assets and property
• Insurance claims
• Professional licenses
• Fingerprint checks against those of some
46 million criminals
Key Issues
• Privacy in the Information Age
– Very low due to easy access of rapidly growing technology
– Very real, very widespread, universal issue
• Pros for this transparency and easy access to personal
information
– “You can’t get much done in society without a lot of the products
they provide” –Steve Harris, Former Sr. VP Corporate
Communications, GM
– “Hiring somebody, renting apartment to somebody, hiring drivers
for your business…”
– Fundamental need in society for personal information to ensure
safety, legitimacy, accuracy, credibility
Pros for ChoicePoint
• ChoicePoint helped 100 million American
consumers obtain fairly priced home and
auto insurance
• Helped thousands of American businesses
obtain commercial property insurance
• Helped 8 million Americans get jobs
through workplace pre-employment
screening services
Pros for ChoicePoint
• Helped more than 1 million consumers
expedited copies of their vital records: birth,
death, and marriage certificates
• Helped track down criminal child abductors and
deadbeat dads
• Just today, ChoicePoint wins contract
with...guess who…the state of California’s top
prosecutor to keep track of suspected criminals;
fundamental need for this information
Arguments Against Low Privacy
• Personal information falling into the hands of
criminals
• More vulnerable not only to identity theft, but
also to incorrect data profiles
• Errors and omissions in the data; what if your
employer or prospective employer receives the
wrong information?
• Misunderstandings between the party using the
information and the party that is portrayed
– Jeffrey Rosen, The Unwanted Gaze: The Destruction
of Privacy in America
“Privacy protects us from being misdefined and
judged out of context in a world of short
attention spans, a world in which information
can easily be confused with knowledge.”
Identity Theft
• One of the fastest growing crimes in the
United States, in upwards of 900,000
people are victimized each year
• Costs consumers $5B each year
• Costs businesses $48B per year
• Threat to consumer confidence
• Puts major toll on the economy
Current Regulation
• Data brokerage industry is largely unregulated
• Fair Credit Reporting Act
• Truly only applies to credit agencies
• Federal Trade Commission principles
• Certain types of information such as social security numbers
are not to be used for marketing purposes
• State Laws
• California disclosure only one of its kind; if had not been for
this law, ChoicePoint would not have had to disclose breach
• Other state disclosure laws limited to certain industries such
as financial institutions
ChoicePoint’s Corporate
Communication Team
• Small, consists of three full time personnel
• Two of which deal only with employee
communications
• Have not had any experience with
situations such as this
Key Players
• Derek Smith, CEO of ChoicePoint
– CEO since spinoff from Equifax in 1997
– Made Chairman in 1999
– Highly respected in the industry and is seen
as being on the leading edge of information
technology
– Written several books on data privacy
Key Players
• Derek Smith:
Key Players
• Derek Smith, CEO of ChoicePoint
– Advocate of using technology to combat
terrorists and criminals
– Make our nation more secure while protecting
civil liberties
– Serves on board of Society of International
Business Fellows
– The Educational Foundation of Georgia State
University
Key Players
• Doug Curling, President, COO, and
Director at ChoicePoint
– Has held CFO position as well
– Responsible for ChoicePoint’s acquisitions
and thereby, successfully diversifying revenue
sources
– Emphasizes efficient internal organization in
the ever changing technology industry
Key Players
• James Lee, Chief Marketing Officer
– Heads up Corporate Communications at
ChoicePoint
– In charge of all internal and external
messaging
Corporate Communication Issues
• ChoicePoint knew they would have to come out
with the news of the security breach
• Required by law to personally contact possible
victims in California
• So when was it best to contact victims?
– November (LASD), January (CP), February (Actual)
– 4 months of preparation for the public disclosure
• In what form? Letters? Phone calls?
• What help to offer? Credit monitoring?
Corporate Communication Issues
• What to do to resolve the internal security
problems?
• What to do to reassure the public and
investors?
• Not only a ChoicePoint issue here, Bank
of America, Lexus-Nexus, the whole
industry must answer these questions
Corporate Communication Issues
• Working with Legislators
– Potential of being legislated out of business
• Privacy rights activists, industry experts,
and elected officials calling for closer
regulation of companies that compile large
databases of consumer information
• CEO Derek Smith agrees with need for
some level of increased regulation
Corporate Communication Issues
• ChoicePoint Corporate Communication
team
– James Lee will need additional help
– Did not have a team to begin with
– Who to hire as part of full-time Corporate
Communications team?
– Who to consult? Receive guidance/advice
from? Communicate with experts in
Corporate Communication and Crisis
Management
Corporate Communication Issues
• Consumer Fear
– Definite impact on legislation
– What power does the consumer truly have here?
• Legal Battles:
– California woman begins class-action lawsuit
– FTC / LASD investigations into exact timeline,
occurrence of events, who knew what? When?
– SEC investigations continue regarding executive
stock sales
Corporate Communication Issues
• Several issues going forward:
– Contact theft victims
– Deal with security controls
– Need for increased regulation
– Internal Corporate Communication team
– Privacy in society, consumer fear
– Legal Battles
• What steps has ChoicePoint taken?
• What steps must they take?