Corporate Databases are Enough to Make a Spy Jealous

Sep 25, 2007
Nicole A. Ozer

Page Media

ACLU of Northern CA

Signing up with one company for multiple goods or services or just visiting one store or internet site to buy everything for your home often seems like a good idea. It can mean dealing with fewer bills, saving some time on a busy day, or keeping a few more dollars in your wallet. But, as you buy more things from fewer companies, they are not just pocketing more of your money, they may also be collecting a lot more of your personal information.

Think about the new package deals offered by companies for phone, cable, and internet such as Comcast's "triple play" or AT&T's "triple pack". As the number of companies offering services dwindles through merger after merger (in most areas, only one or two real options exist for cable tv, phone, and internet services), and as the prevalence of these package deals increases, the amount of information collected by companies about their customers has expanded enormously. Rather than information scattered across several providers, this trove of data about who you call, what you watch, and what websites you visit is now at the fingertips of a single company.

What happens to this information, and who gets to see it, is far from clear. Multiple lawsuits have been filed by the ACLU and other groups to try to get out the truth about whether communications companies have made your personal calling information available to the National Security Agency without legal process.

There has been even less scrutiny about what else those companies might be doing with information. Vague privacy policies often allow information to be kept for long periods of time, used for targeted advertising purposes, or even sold. What little is known about the big communication companies' data sale practices is chilling.

Various companies report being able to purchase anonymized, but user-specific internet activity logs from big ISPs. Comcast has been accused of selling its voice over IP customers' account information as soon as the phones leave their box. When the companies are asked what they do with data, they often refuse to answer.

Of course, the problems of conglomeration and resulting rampant data collection are much bigger than what is happening with the telecommunications companies alone.

Most large companies keep detailed information on purchases and use it to target you with products and services, keep you loyal to their brand, and, at least in some cases, help law enforcement conduct pseudo-legal data mining and domestic surveillance. These practices are nearly ubiquitous in our lives.

Supermarket club card users give up detailed information about their purchases in exchange for a small discount. Credit cards offer more ease of use and better flexibility than cash, but keep detailed logs of purchases.

Wal-Mart, the largest retailer in the world and where over 200- million Americans shop each year, pioneered retail consumer data collection and has amassed an impressive treasure trove of information.

Wal-Mart knows what your town is having for lunch, that people shopping in a hurricane-affected area want beer and pop tarts, and even if your family likes smooth instead of crunchy peanut butter.

Privacy advocates have long accused Wal-Mart of having ultra secret and secure data centers. In 2004 the New York Times reported that "By its own count, Wal-Mart has 460 terabytes of data stored on Teradata mainframes, made by NCR, at its Bentonville headquarters." To put that in perspective, a 2003 study found that all the static websites on the World Wide Web housed less than half that much data.

It's hard to know how much data companies are collecting or what happens with it once it's collected. Thanks to some pre-Internet Supreme Court cases such as Smith v. Maryland, the Fourth Amendment does not apply to information held in electronic storage by third parties like these companies. Because of this, the government does not need to have a court-ordered warrant to obtain your personal information, it just needs to ask for it with a subpoena.

As convenient as using a few companies for everything may seem, the convenience could cost far more than you realized.