NO PRIVACY ON THE WEB

By JOSHUA QUITTNER

Want to see how much the world knows about you? Try this: log on to the World Wide Web, fire up a search engine (one of those Websites with names like HotBot or AltaVista that scour the Internet for key words), and type in your name. You're probably listed somewhere, especially if you've been mentioned in a newspaper or magazine article during the past few years.

Big deal. Now type in your Social Security number. If you're an official in the military, if you've filed papers with the Securities and Exchange Commission, or if you're a student or faculty member at a university that uses Social Security numbers for IDs, you may well be among the people whose numbers have made their way into the all too public record.

Want to get really creeped out? Click over to InfoSpace, "the Ultimate Directory," whose People Search Directory has the home address of everybody with a listed phone number, all 112 million of them. Type in your name, and out pops a map of your neighborhood, with a little X marking your residence. Click on the icon to get written directions to your house.

And that's just the free stuff. If you're willing to pay for dirt, dozens of info brokers are waiting on the Web to supply you with just about anyone's Social Security number, listed (and unlisted) phone numbers, voter registrations, driving records, court records, real estate holdings, liens and, well, you name it. Even such esoterica as companies registered in Switzerland, corporate profiles of Japanese businessmen and Nevada divorce petitions are all stored neatly online and available for a price.

Databases filled with gobs of juicy, personal information have been around since computers were invented, of course. But what was once the exclusive domain of skip tracers, private eyes and investigative reporters is now available to anyone with access to the Net. Today you too can be a gumshoe. Or a stalker. Or, if you're willing to work with borrowed credit cards, a thief.

Civil libertarians are understandably alarmed. "More needs to be done to protect privacy in the online world," says Marc Rotenberg, director of the Washington-based Electronic Privacy Information Center. "As technology has raced ahead, safeguards have failed to keep up."

Case in point: recently, after a public outcry, the Social Security Administration shut down a portion of its Website that showed taxpayers' earnings and benefits. All an ex-spouse or divorce attorney needed to do was punch in five items: name, Social Security number, mother's maiden name, birth date and birthplace. After USA Today publicized the site last month, it was besieged with up to 80 requests a second. Two days later it was shut down.

"Anytime you have a large database, you're going to have a few people who misuse it," says Glen Roberts, a computer consultant who has made a hobby of exploring the opportunities for database misuse. His ironically named Stalker's Home Page has become the definitive source for information about how your privacy can be violated online. His theory is that by exposing the most egregious Websites to public scrutiny, he will force them to shut down.

Recently, for instance, he learned that Indiana University had a database open to the Net that listed the names, Social Security numbers, phone numbers, research qualifications and job titles of 2,760 faculty members. Roberts grabbed it and published portions on his own site, along with a press release. University officials were not amused. They took the database off line, of course, and sicced the authorities on Roberts, who agreed to take his off line as well. Curiously, though, no one ever asked him to erase the data, which still reside on his home computer. "The only time people care about this is when they can see it. As soon as they can't see it, they think there's no issue. But the problem is still there."

Information brokers point out that databases are the lubricants that keep modern businesses running. Personal data, after all, help establish you as an upstanding citizen and a worthy credit risk--and help creditors track you down in case you're not. "It's not really useful to say that the records could be misused by a few people, so let's remove access for everyone," says Jeff Alperin of Information America, one of the world's largest providers of public records and investigative services. "How in the world could you transfer property if you didn't know who owned it?"

True enough. But where do you draw the line? Last month U.S. Senators Dianne Feinstein and Charles Grassley introduced the Personal Information Privacy act of 1997, which would make it tougher for businesses to sell Social Security numbers, unlisted phone numbers and other kinds of personal data. The legislation was prompted when Feinstein's staff members claimed to have found her Social Security number on the Net in less than three minutes. "People are losing control of their identities," Feinstein says. "Our private lives are becoming commodities with tremendous value in the marketplace."

That's the bad news. The good news is that at least someone is making money on the Web.

--Reported by Declan McCullagh/Washington and Noah Robischon/New York

With reporting by DECLAN MCCULLAGH/WASHINGTON AND NOAH ROBISCHON/NEW YORK