Privacy is easy to breach
- David Lazarus
Friday, July 15, 2005

The fracas over whether Karl Rove, one of President Bush's most
trusted advisers, publicly outed an undercover CIA operative
highlights the ease with which personal information on virtually
anyone can be obtained.

It also points to the need for privacy laws -- and, in this case,
national-security laws -- recognizing the harm that can be done with
only a few computer keystrokes.

That harm, as a slew of recent security breaches makes clear, can
include identity theft, credit card fraud and other invasions of one's
personal-data space.

It can also represent a graver danger if the work you do is of
interest to terrorists and other enemies of this country.

I found out how significant this threat can be when I attempted to
identify the CIA agent in question for myself, based solely on what
Rove is known to have told a journalist.

The results were troubling, to say the least.

First, a little background:

The key issue this week has been whether Rove broke the law when
he reportedly told a journalist, Matthew Cooper of Time magazine, that
the wife of a prominent administration critic works for the CIA in the
sensitive field of weapons of mass destruction.

Rove's role was confirmed by an e-mail sent by Cooper to his
bureau chief. The e-mail, obtained by Newsweek, concerned former
Ambassador Joseph Wilson, who had written a 2003 opinion piece
challenging one of the White House's main justifications for an
invasion of Iraq.

Wilson had been dispatched to Africa by the CIA in late 2002 to
investigate claims that Iraq had tried to buy uranium from Niger. He
found no evidence to support this allegation. Nevertheless, the claim
was included in Bush's 2003 State of the Union speech.

Cooper wrote in his e-mail that he'd been told by Rove that Wilson
wasn't sent on the trip by either the CIA director or by Vice
President ***** Cheney.

Cooper wrote: "It was, KR said, Wilson's wife, who apparently
works at the agency on WMD issues who authorized the trip."

Novak jumps in

Cooper didn't write a story about this right away. But shortly
after Cooper's exchange with Rove took place, syndicated columnist
Robert Novak did publish a piece about Wilson.

"Wilson never worked for the CIA, but his wife, Valerie Plame, is
an Agency operative on weapons of mass destruction," Novak wrote. He
cited two "senior administration officials" as saying that Plame was
responsible for sending her husband to Niger.

According to the Intelligence Identities Protection Act of 1982,
it's a federal crime if anyone "as a result of having authorized
access to classified information, learns the identity of a covert
agent and intentionally discloses any information identifying such
covert agent to any individual not authorized to receive classified
information."

It's not my place to say whether Rove crossed that line in his
discussion with Cooper. But I can say what I was able to do with the
information Rove reportedly supplied.

First of all, I knew from published reports that the full name of
the author of the critical op-ed piece was Joseph C. Wilson IV. A
Google search quickly told me that he was born in 1949.

So I went to ZabaSearch.com, which readers of this space know is a
powerful online people-search tool that rapidly combs through public
records - - for free.

My first nationwide search for a Joseph C. Wilson born in 1949
turned up too many matches, so I narrowed the search by guessing that
he likely lives in Washington, D.C.

Bingo. Now I had his home address. But I didn't know his wife's
name.

So I went to the Web site of LexisNexis, a prominent data broker,
and did a public-records search for Joseph Wilson in Washington, D.C.,
subsequently narrowing the search with Wilson's street address. Bingo
again.

"Spouse name: Wilson, Valerie E."

For non-subscribers, LexisNexis is available online on a
pay-per-search basis. It's also accessible via acquaintances at
universities, law schools and a wide variety of private companies.

I did another LexisNexis search for Valerie E. Wilson in
Washington, D.C. This confirmed she lives at the same address as
Joseph C. Wilson. It also took me the next step.

"Former name: Plame, Valerie E."

I now had the identity of a covert CIA agent (who was using her
maiden name as part of her cover as an energy-industry analyst working
for a firm called Brewster Jennings & Associates, now known to be a
CIA front company).

It took me less than a half-hour to identify her.

I then went back to Google and got a map of Plame's neighborhood
and directions to her home. Google also allowed me to study a
high-resolution satellite photo of Plame's house.

I could see that the property appears to be in a quiet residential
community and looks approachable from all sides. It also offers ready
access by car to major thoroughfares.

And I now possess all this information simply because I know (from
Karl Rove, via Matt Cooper) that Joseph Wilson's wife "apparently
works at the agency on WMD issues."

Little effort required

Rove's questionable judgment aside, this episode underlines how
little effort is required in this info-rich age to identify and locate
virtually anyone. You don't even need that person's name.

This should alarm anyone who relies on a measure of secrecy for
his or her well being, as well as all others who value their privacy.

It also should serve as a wake-up call for legislators that
existing privacy and national-security laws haven't kept pace with
dazzling improvements in information technology.

The intent of current laws might be to keep certain info under
wraps. The reality is that nearly all data are exposed and accessible,
there for the taking by anyone with a computer and a small measure of
resourcefulness.

With little effort, I pinpointed a working CIA agent. I did so
only to make a point.

Can we be sure that the intentions of the next person to commence
such a search will be as benign?

David Lazarus' column appears Wednesdays, Fridays and Sundays. He
also can be seen regularly on KTVU's "Mornings on 2." Send tips or
feedback to dlazarus@sfchronicle.com.

Page C - 1
URL:
http://sfgate.com/cgi-bin/article.cgi?file=/c/a/2005/07/15/BUG0UDO7R31.DTL
©2005 San Francisco Chronicle