SUBSCRIBE NOW!

Vol. 20 No. 5 — May 2003

Two years after its founding in 1989, the Association of Independent Information Professionals (AIIP) developed a Code of Ethical Business Practice. To become a member of AIIP, an individual must agree, in writing, to accept this code. In part, it states that members must "uphold the profession's reputation for honesty, competence, and confidentiality" and "accept only those projects which are legal and are not detrimental to our profession." Failure to live up to AIIP's responsibilities is cause for expulsion.

To be honest, I haven't thought much about the term "broker" in recent years. Irarely hear the word in reference to AIIP members, which makes me believe that the organization has done a good job in eliminating the stigma that's attached to it. However, the Supreme Court of New Hampshire's recent ruling on a cyberstalking and identity-theft case has caused me to reflect on this issue once again.

Helen Remburg v. Docusearch

In late 1999, Amy Boyer was leaving work when she was shot to death by former classmate Liam Youens, who then killed himself. In their investigation, police learned that Youens maintained a Web site that detailed his obsession with Boyer. On the site, Youens mentioned that Docusearch, a Florida "information broker," was his source for locating her.

According to the court's papers, after paying small fees to Docusearch, Youens requested Boyer's birth date, Social Security number, and employment information. The work address was acquired through a Docusearch subcontractor, Michele Gambino, who allegedly lied about who she was and the purpose of her phone call.

With this revelation, Boyer's mother (Helen Remburg) and stepfather sued Docusearch. Before the case could go to a jury trial, the Supreme Court of New Hampshire was asked to rule on five questions of state law. Although Docusearch claimed it didn't know the information it provided to Youens would result in Boyer's death, the court had a different opinion about the company's liability.

On Feb. 18, the court sided with Boyer's parents on three of the five questions. First, it acknowledged that "public concern about stalking has compelled all 50 states to pass some form of legislation criminalizing stalking." Because of "the threats posed by stalking and identity theft," Docusearch and Gambino had "a duty to exercise reasonable care in disclosing" Boyer's personal information to Youens. "This is especially true when, as in this case, the investigator does not know the client or the client's purpose in seeking the information."

Second, an invasion of Boyer's privacy took place when Docusearch obtained her Social Security number without permission. According to the court, "[W]hile an SSN must be disclosed in certain circumstances, a person may reasonably expect that the number will remain private."

Third, investigators who procure information by pretexting, and then sell it, can be sued under New Hampshire's consumer-protection act. "Pretext phone calling has been described as the use of deception and trickery to obtain a person's private information for resale to others....An investigator who obtains a person's work address by means of pretextual phone calling, and then sells the information, may be liable for damages ... to the person deceived."

The complete text of the court's ruling is available at http://www.courts.state.nh.us/supreme/opinions/2003/remsb017.htm. For additional information on the Boyer case, see the Electronic Privacy Information Center's site (EPIC; http://www.epic.org/privacy/boyer) and EPIC's amicus brief (http://www.epic.org/privacy/boyer/brief.html).

Repercussions

It's not unusual to get research requests that make us uncomfortable.At least two or three times a year, a client asks me to find a birth, divorce, or death notice, or an article about a Delaware-registered corporation in the local newspaper. Although these announcements and articles are public records, I debate whether I should ask why the information is needed. If a deadbeat dad is being tracked or a company is being sued, is it my responsibility to question the investigation?

Competitive intelligence is another prickly subject. On occasion, clients ask me to obtain an educational brochure from a competing pharmaceutical company. Always, my dilemma is whether or not to use pretext calling to get it. Do I call from my home phone as a patient who has the disease in question, obtain the brochure, and pass it on to my client? Do I call from my company phone, request the brochure, and hope that no one from the competitor asks why I need the material? If I take this second approach, how do I respond when the competitor asks about my company and what is going to be done with the brochure? Regardless of the technique used, if the competitor sends me the brochure, have I legally received the material? Can I pass it on without being sued? When am I in violation of AIIP's Code of Ethical Business Practice?

I have mixed feelings about the New Hampshire ruling. On the one hand, I can cite this case to clients when I'm confronted with a research project that raises an ethical dilemma for me. The ruling may compel many of us to step back and question our liability for screening users and investigating their conduct. On the other hand (and this may not be so far-fetched), I foresee the enactment of a national law—extended to "legitimate" literature searches—in which information professionals are held accountable for their users'behavior.

In the reference interview, it's common practice to ask clients why they need the information. But we question them in order to provide targeted search results, not to challenge their motivations or make judgments about their research. We must monitor the upcoming jury trial in the Boyer case. I'm conflicted because I'd personally like to see Boyer's parents win. But if they do, the ramifications for our industry will be frightening.