The state department released the results of an audit yesterday that found that large numbers of government workers (meaning both employees and contractors) have been regularly accessing the passport files of celebrities:
The 192 million passport files maintained by the State Department contain individuals’ passport applications, which include data such as Social Security numbers, physical descriptions, and names and places of birth of the applicants’ parents. Otherwise, the files provide limited information; they do not contain records of overseas travel or visa stamps from previous passports.
To test the extent of the snooping, investigators assembled a list of 150 famous Americans and checked how many times their files were accessed over a 5 1/2 -year period. Investigators found that the records of 127, or 85 percent, had been searched a total of more than 4,100 times.
The report said that “although an 85 percent hit rate appears to be excessive, the Department currently lacks criteria to determine whether this is actually an inordinately high rate.”
85%! “excessive” indeed! If you look at the criteria for celebrities (including the Fortune 50), it’s likely that the 15% of folks who didn’t meet this threshold (and note that the threshold is lots and lots of accesses to the files, rather than the more than one that should trigger an alert) are simply not of interest to the government employees.
What’s shocking about this breech is not so much the privacy of the celebrities (who have little privacy anyway), but the revelation that there seem to be no controls at all over the data other than very casual manual supervision. It’s almost certain that in addition to looking up celebrities workers have been looking up information on other folks — friends, family, lovers, colleagues, bowling league rivals — who are more relevant to their lives than celebrities. And many of the folks who have access to the data and have been guilty of the breeches are contractors. Given the shockingly lax control over the data, we have to worry about those contractors and their employers accessing the data for all sorts of unsavory business reasons (looking up data on competitors, on government supervisors, etc).
The larger lesson here is that valuable data collections like the passport database have potential value tremendously higher than their regulated power. That tension between the potential value and regulated value makes it inevitable that data will leak out from some of even the best secured of them in one way or another. When a data collection has no serious controls at all (as the passport records seems not to), such breeches will be certain and frequent.
