If you think Web users have given up on privacy, take a look at Michael Fertik's e-mail inbox. "I have a restraining order on my brother and he is tracking me down. I keep getting death threats. I believe he is finding my information online. Can I hide my phone number and addresses?"
"I am a corrections officer and I want all my information off the Internet...especially my address. Can you help me?"
Slideshow:
Companies that profit from your data
Video:
Who's reading your mail?
These messages came from customers of MyPrivacy, a subscription service Fertik launched last fall to help people pull their details out of the hands of companies that package personal data and sell it on the Web. For $5 a month he offers his subscribers a list of sites where their identifying details are hung out for all to see, and when possible, gives them the option to have them erased.
The problem: MyPrivacy still doesn't work. Fertik's ambitious program has been stonewalled by many of the data businesses it's sought to deal with and has hardly put a dent in the piles of personal information about his customers that are available on the Web. As of now the project has only shown how hard it is to keep from strangers data as basic as a phone number or an address.
Slideshow:
Eight ways to hack the web
Hacking without technology
The Web is populated by people-focused search engines like Intelius, Peoplefinders or US Search that peddle personal data: the value of your house, criminal records, salary information and employment history.
Fertik, a 29-year-old graduate of Harvard Law, has built his career challenging the notion that online privacy is a lost cause. In October 2006 he founded ReputationDefender, a company that charges $10 a month to monitor references to its subscribers found on blogs and other sites. ReputationDefender also offers to remove or hide negative content about customers. The service sends friendly requests to offending sites, refers customers to lawyers and creates innocuous blogs and social networking pages to pad Google search results.
In its first year and a half ReputationDefender has seen modest success: The company has grown to 55 employees and took in $2 million of revenue last year. "For every business action there's an equal and opposite reaction," he says. "The business action going on now is the eviscerating exposure of all your stuff, both public and private. People want to regain control of their online identities."
The idea for MyPrivacy came to Fertik two years ago. He began poking around the online data-aggregation companies that collect personal information from public documents such as tax forms, housing documents and criminal records. He says he also traced some data to more private sources like warranty cards and magazine subscriptions.
Fertik counts 230 sites that offer personal information to Web users. Half of them, he says, take requests to opt-out. He saw an opportunity to create a one-stop opt-out shop. As proof of concept, Fertik points to the national do-not-call list, which includes 73 per cent of US households. "You can't get 73 per cent of Americans to do anything except pay taxes and drink Coke," he says. "This is not a niche."
Slideshow:
How to keep data safe on the web
Cyber attack hot spots
Taking advantage of companies' opt-out offers, however, has been complicated. In December MyPrivacy began attempting to opt its 800 initial customers out of the database of Intelius, one of the Web's largest collections of background-check data. The Bellevue, Wash. site says in its privacy policy that it will, "as a courtesy," remove any user who sends a faxed request with his or her name and address.
Fertik took the company up on its offer. He started sending hundreds of opt-out requests a month to Intelius' fax number. Intelius e-mailed asking him to stop "spamming" its fax machine. (Intelius denies this.) Fertik requested a meeting to find an easier solution. The company's representatives initially seemed responsive and later asked Fertik to send his opt-outs in a single daily e-mail. Intelius says it is unaware of this request.
Then, about a week after Intelius filed for its initial offering in early January, Fertik received an e-mail referring all further communication to William Beaver, the company's general counsel. Since then Fertik's e-mails and faxes have received no response. As far as he is able to determine, not one of his customers has been removed from Intelius' database.
Some sites have been more responsive: Fertik says Yahoo has removed his customers from its basic people search, as has Switchboard.com, which powers the people search function for sites that include Excite.com. But, Fertik says, other sites with opt-out policies, like InfoSpace, WhoWhere.com, MetaCrawler, usa People Search and Fonecart, have ignored his requests.
Edward Petersen, an Intelius founder, says that his company doesn't accept opt-out requests from a third party.
Unlist Assist, a two-person company in Cheyenne, Wyo, offers a modest workaround. It mails its customers forms they send to data aggregators that don't accept third-party opt-outs. Using that approach, Unlist Assist has successfully opted its 2,000 or so customers out of many databases, including Intelius'.
But even then, Unlist Assist founder Eric Busby admits that the business model has limits. "Data aggregators are in the business of selling information, and they have to keep that information alive," he says. "If 100,000 people started opting out, they might change their tune."
Fertik isn't giving up. His new solution is to pay the aggregators to give up his customers' data. How much? A rough calculation shows that an information-broker giant like ChoicePoint makes at most 40 cents a month from each of its dossiers connected with an American adult. A background-check search engine likely makes far less. MyPrivacy could still make money passing along some of its $5-a-month fee as an incentive to delete its customers' data. "This is the way to avoid regulation and make more money," argues Fertik. "Because the privacy clamor is not going to stop."
There's not much in the statute books to protect people who value their privacy. A lot of states have moved their motor vehicle records out of sight, but home ownership and voter registration are wide open.
So far, no one has taken Fertik up on his payout offer. Intelius' Petersen says it sounds a bit like blackmail. "So I've got your data and I'm going to hold it hostage till you pay me five bucks?" he asks.
What Fertik wants may be impossible. Many data brokers lack any opt-out policy. There are plenty of other sites, says Petersen, that lack the ethics or resources to honor them. Fertik's cloak of invisibility? "It's not a realistic goal," says Petersen.
