ChoicePoint: Personal Data and a Loss of Privacy

1. ChoicePoint: Personal Data and a Loss of Privacy

2. Overview • The Moment, The Problem • Timeline • ChoicePoint Background • The Personal Data Industry • Key Issues • Key Players • Corporate Communication Issues Now and Going Forward

3. The Moment, The Problem • September 27, 2004 • ChoicePoint discovers possible fraudulent activity within their network of databases • Realizes it may have allowed identity thieves in the Los Angeles area, posing as legitimate businesses (phony insurance companies, check-cashing companies, and other qualifying businesses) to access people’s personal information

4. The Moment, The Problem • Mid-October 2004 • Begin working with LASD • Discover identity theft ring that had set up 50+ fake companies • Criminals received everything from SSNs to credit reports, more than enough to steal identities • 35,000 Californians and 110,000 other people across the country in all 50 states became potential victims of identity theft

5. The Moment, The Problem • Mid-October • LASD delays disclosure to prevent hindering investigation • Under California law, unlike the rest of the nation, citizens must be informed when personal information is compromised

6. The Moment, The Problem • October 26, 2004 • The first and only arrest to date is made • A Nigerian man, Olutunji Oluwatosin, 41, was apprehended in a LASD sting operation • Later sentenced to 16 months in CA state prison, pleading no contest to a single count of unlawful use of personal information

7. The Moment, The Problem • November 9th, 2004 • Executives begin a 6-month program to sell 24% of their ownership in the company • Sell 458,000 shares, $20M+ in market value, $16M in profits, before public disclosure of identity theft problem

8. The Moment, The Problem • February 14, 2005 • ChoicePoint publicly discloses security breach • Sends letters to California residents • At this point, 750 identity theft victims had been identified

9. The Moment, The Problem From February 14th to March 8th Stock plummets nearly 20%

11. The Moment, The Problem • Why did it take four months to disclose the problem to the public? (Oct - Feb) • Initially, LASD did not want to hinder investigation, but what about after that? • LASD reports they told ChoicePoint in a letter to disclose in early November • ChoicePoint says they were told to disclose in January • LASD Lt. Costa: “ChoicePoint must have misinterpreted our letter”

12. Founded in 1997 when Equifax, an information management company, spun off its insurance services group Former Equifax VP, Derek Smith, and Sr. VP of Finance, Doug Curling start ChoicePoint as it is today from scratch From small insurance arm of Equifax to the premier provider of decision-making intelligence to businesses and governments Rapid growth through 60 strategic acquisitions Company Background

13. From small insurance arm of Equifax to the premier provider of decision-making intelligence to businesses and governments Rapid growth through 60 strategic acquisitions

14. After 9/11/01, company surges through key acquisitions of Templar Corporation and IMapData Inc. (U.S. Government becomes one of main clients) Wide client base: Insurance agencies, corporate employee screeners, check-cashing companies, non-profit organizations, media outlets, private investigators, law enforcement officials, landlords, other prospective employers Company Background

15. Now, 19 billion public and private records Collects and sells financial, medical, and other personal records on billions of people 50,000+ customers 5,500+ employees FY2004 Revenue: $900M+ FY04 record revenue, growing 14% per year FY04 Gross Margin: 50% Profit Margin: 15% Company Background

16. Stock Price Data • Symbol: CPS on NYSE • 52-week range: $36.35 - $47.95 • Closing price on April 25th : $39.90 • Insider/Institutional: 3% / 82% • Market Capitalization: $3.59 B (mid-cap) • Market Cap before 2/15/05 : $4.4 B

17. Stock Price Data

18. The Personal Data Industry • $5B Data-brokering Industry • New one-stop shop phenomenon in last 10 yrs • ChoicePoint, Lexis-Nexis, Acxiom • Power of computers, lower costs of data storage, speed of internet • Able to aggregate, store, and retrieve large amounts of information quickly

19. Information Available for Purchase • Social Security Numbers • Current and previous addresses • Credit information • Employment history • Motor vehicle records, driver’s license information and vehicle identification numbers

20. Information Available for Purchase • Police and criminal records (includes 100 million conviction records and prison, parole and release records) • Assets and property • Insurance claims • Professional licenses • Fingerprint checks against those of some 46 million criminals

21. Key Issues • Privacy in the Information Age • Very low due to easy access of rapidly growing technology • Very real, very widespread, universal issue • Pros for this transparency and easy access to personal information • “You can’t get much done in society without a lot of the products they provide” –Steve Harris, Former Sr. VP Corporate Communications, GM • “Hiring somebody, renting apartment to somebody, hiring drivers for your business…” • Fundamental need in society for personal information to ensure safety, legitimacy, accuracy, credibility

22. Pros for ChoicePoint • ChoicePoint helped 100 million American consumers obtain fairly priced home and auto insurance • Helped thousands of American businesses obtain commercial property insurance • Helped 8 million Americans get jobs through workplace pre-employment screening services

23. Pros for ChoicePoint • Helped more than 1 million consumers expedited copies of their vital records: birth, death, and marriage certificates • Helped track down criminal child abductors and deadbeat dads • Just today, ChoicePoint wins contract with...guess who…the state of California’s top prosecutor to keep track of suspected criminals; fundamental need for this information

24. Arguments Against Low Privacy • Personal information falling into the hands of criminals • More vulnerable not only to identity theft, but also to incorrect data profiles • Errors and omissions in the data; what if your employer or prospective employer receives the wrong information? • Misunderstandings between the party using the information and the party that is portrayed • Jeffrey Rosen, The Unwanted Gaze: The Destruction of Privacy in America

25. “Privacy protects us from being misdefined and judged out of context in a world of short attention spans, a world in which information can easily be confused with knowledge.”

26. Identity Theft • One of the fastest growing crimes in the United States, in upwards of 900,000 people are victimized each year • Costs consumers $5B each year • Costs businesses $48B per year • Threat to consumer confidence • Puts major toll on the economy

27. Current Regulation • Data brokerage industry is largely unregulated • Fair Credit Reporting Act • Truly only applies to credit agencies • Federal Trade Commission principles • Certain types of information such as social security numbers are not to be used for marketing purposes • State Laws • California disclosure only one of its kind; if had not been for this law, ChoicePoint would not have had to disclose breach • Other state disclosure laws limited to certain industries such as financial institutions

28. ChoicePoint’s Corporate Communication Team • Small, consists of three full time personnel • Two of which deal only with employee communications • Have not had any experience with situations such as this

29. Key Players • Derek Smith, CEO of ChoicePoint • CEO since spinoff from Equifax in 1997 • Made Chairman in 1999 • Highly respected in the industry and is seen as being on the leading edge of information technology • Written several books on data privacy

30. Key Players • Derek Smith:

31. Key Players • Derek Smith, CEO of ChoicePoint • Advocate of using technology to combat terrorists and criminals • Make our nation more secure while protecting civil liberties • Serves on board of Society of International Business Fellows • The Educational Foundation of Georgia State University

32. Key Players • Doug Curling, President, COO, and Director at ChoicePoint • Has held CFO position as well • Responsible for ChoicePoint’s acquisitions and thereby, successfully diversifying revenue sources • Emphasizes efficient internal organization in the ever changing technology industry

33. Key Players • James Lee, Chief Marketing Officer • Heads up Corporate Communications at ChoicePoint • In charge of all internal and external messaging

34. Corporate Communication Issues • ChoicePoint knew they would have to come out with the news of the security breach • Required by law to personally contact possible victims in California • So when was it best to contact victims? • November (LASD), January (CP), February (Actual) • 4 months of preparation for the public disclosure • In what form? Letters? Phone calls? • What help to offer? Credit monitoring?

35. Corporate Communication Issues • What to do to resolve the internal security problems? • What to do to reassure the public and investors? • Not only a ChoicePoint issue here, Bank of America, Lexus-Nexus, the whole industry must answer these questions

36. Corporate Communication Issues • Working with Legislators • Potential of being legislated out of business • Privacy rights activists, industry experts, and elected officials calling for closer regulation of companies that compile large databases of consumer information • CEO Derek Smith agrees with need for some level of increased regulation

37. Corporate Communication Issues • ChoicePoint Corporate Communication team • James Lee will need additional help • Did not have a team to begin with • Who to hire as part of full-time Corporate Communications team? • Who to consult? Receive guidance/advice from? Communicate with experts in Corporate Communication and Crisis Management

38. Corporate Communication Issues • Consumer Fear • Definite impact on legislation • What power does the consumer truly have here? • Legal Battles: • California woman begins class-action lawsuit • FTC / LASD investigations into exact timeline, occurrence of events, who knew what? When? • SEC investigations continue regarding executive stock sales

39. Corporate Communication Issues • Several issues going forward: • Contact theft victims • Deal with security controls • Need for increased regulation • Internal Corporate Communication team • Privacy in society, consumer fear • Legal Battles • What steps has ChoicePoint taken? • What steps must they take?