When Background Checks Go Wrong...

Kraken137 asks: "A friend of mine recently got a new job, and as a routine part of the hire process, a background check was done. At 5pm on the Friday before she was to start work, she was notified that the background check had turned up a felony on her record, and as a result, she could not be hired. My friend has never done anything worse than a speeding ticket, so she was suitably confused. If the incorrect results of a background check led to someone not being hired, or being fired, etc... would the person have a legal recourse against the security company?" In this, the age of information, where the numbering, collating, indexing and cross-referencing of millions of identities happens in a single second, the fact that mixups like this still occur disturbs me. What kind protections are in place when the accidental twiddling of a bit can change your entire history?

"[In the end] she ended up having to go to the county courthouse for some sort of proof of her identity, and then had to get them to re-do the background check. The matter was resolved, and she started work (a week late however). The felony actually belonged to someone in another state with the same name as my friend (but with a different date of birth and Social Security number). My friend has a very common last name, and a common first name as well. That got me to thinking. Are security companies who do background checks responsible for incorrect results?"

Comments

Commiting a Felony is trivial

[Anonymous Coward]

Thousands of people commit felony theft in the United States all the time, but these people are only prosecuted when the government officials want a conviction on something. Anyone who owes money to a bank on their vehicle is guilty of theft if they drive that vehicle across a state line without first notifying the lending institution. And yes, people _have_ done jail time on this charge. It is one of the many ways police can get a conviction on a person through selective enforcement of the law. In my opinion, selective enforcement of the law is one of the larger threats to individual freedoms and liberties.

Checks and Balances

[B. Samedi]

Why do people trust these background checks and pre-employment tests so much? Whatever happened to a good old intesive face to face interview?

As an example I took a test to be hired by a armored car company several years ago. It was to be one in a series of tests and background checks (including a polygraph) that a person had to go through to get employement with this company. To make a long story short I was told that the test said that I was, in this order, too smart and possibly dishonest. A short time later one of their own employees, presumably having passed all these tests, stole over $7mil from one of their trucks in broad daylight at a major interstate rest stop and got away with it (caught by his own stupidity several months later).

Just because someone passes these tests and checks doesn't mean that they won't rip you off or comprise your business. It does give a basis but relying on it too heavily is a sure way to get screwed.

privacy laws make it *harder*

[theonetruekeebler]

I worked for the Georgia Division of Public Health for six years as a database developer. The state of Georgia has strong constitutional protections of individual privacy. When we started putting together our statewide immunization registry, we ran into numerous problems identifying individual clients. Among them:

• There are two thousand people named John Smith in the state.
• A name like "Loquansha" can be spelled twenty different ways, not just by the data entry clerk, but by Laquansa's mother or Leqansia herself.
• A person's race is whatever they tell you it is; if Padraic O'Limrick comes in and tells you he's Hispanic, he's Hispanic.
• Lakwantzaa may get sick of her old name and change it to Cathy.
• Kathy doesn't have to give you her Social Security Number, and she probably won't remember her Immunization Record Code.
• Cathie's SSN may be entered incorrectly, or may have been used by someone else (accidentally or not).
• If you make Kathie's SSN a required field, and she can't/refuses to give it, the clerk will put in nine nines, thereby matching everybody else who refused to give their SSN to that clerk.

In other words, human beings don't have unique identifiers, and many of the things you might expect to be a unique identifier can change, be misentered, forgotten, lost or stolen.

And if you try to force someone to have a unique identifier assigned by you, you are overstepping your bounds in a way people accustimed to at least the illusion of personal freedom and privacy (e.g. Americans) will react badly to. You are also setting up an abusable system.

So it's a mess because the real world is a mess. It's very easy to forget that people are human beings, not tuples in a database.

There are gonna be search errors. A woman in North Carolina recently got thrown in jail for three days because her driver's license number matched the SSN of a fugitive in New Jersey. The fact that she's white, female and in her fifties did nothing to deter the arresting officers from mistaking her with a 22 year old Latino male, so she's suing for wrongful imprisonment. Gonna win, too, I hope.

--

Part of the problem

[Dark Paladin]

I don't see a prolem with information storage. After working at a bank for some time, I see the good in knowing that the person you're handing a $5000 check to is actually going to pay you back based on their credit history.

The problem is, there isn't any real accountability. Oh, sure, you can "challenge" items in your credit report and the like, and the companies like TRW and Equifax have a time frame to fix things, but there's no incentive for them to verify on their own what's true or not. And even more insidious is the crime of identidy theft, where someone uses your information as their own to purchase things, defraud others, or even commit crimes in your name.

So here's my wish-list for how to prevent problems. I haven't narrowed down any ideas, but some general thoughts.

I want to see whatever information a company has on me, whenever I want to.
If some company, government organization, or otherwise has information on or about me, it should be my right to see it whenever I wish. Nobody has the right to me except me.

Mistakes are fined.
If there is a mistake in the information, the information holder has to prove that they are right (example: if it says I had a Nordstrom card in 1988 and I never did, they have to prove that I did). If they are wrong, then they are fined some reasonable amount. How long would it take for credit reporting agencies to start being more precise in their information gathering and reporting techniques when they learn it will cost them money?

There's probably more I could add, but that's the short list. The main theme here is accountability and respect; my information is mine, and if you want to hold it, then you'd damn well better get it right, or else.

As always, I could be wrong.
John "Dark Paladin" Hummel
We don't just like games, we love them!

A Really Egregious Example

[Amphigory]

My Name is John Patrick Narkinsky. My Mother's name was Johnny McNeil Narkinsky. We shared the same birthday, but (obviously) not the same birthyear.

At some time around 1994 (not long after my mother died), the credit bureaus collectively decided that I am now "Johnny P. Narkinsky", with my Social Security Number, my Birthdate, and my mother's credit record!

I have disputed items in my credit file. I have fought. I have written letters. Nothing I do can convince them that my mother is dead and I am not she. In fact, one (which will remain nameless due to outstanding litigation) now claims that I am dead.

But wait, it gets worse. A couple of years ago, I was involved in a lawsuit. I won the lawsuit (filed by an apartment complex) and won a countersuit claiming fraud and a couple of other things. Since then, all three credit bureaus are claiming that I lost this lawsuit -- and listing this information as a matter of the public record.

I have been unable to get any of them to remove this entry -- instead, they simply list it as "disputed". I have sent them copies of the written judgement, I have pointed out their error, and they are still non-responsive.

Because of the laws congress passed protecting credit bureaus (while claiming to be for a consumer's protection) from defamation suits, I am unable to find a lawyer who really wants to file suit against these jerks. They have ignored threatening letters from my lawyer -- which are about all I can do.

My solution? I have named my son John Paul Narkinsky. Not John Paul Narkinsky Jr. John Paul Narkinsky. I plan to name my twins sons to be born in Nov. James Patrick Narkinsky and Jeremy Peter Narkinsky. If I am so fortunate as to have a fourth, I will name him Jonah Petronius or something equally difficult.

Girls will all be Jane Paula, Jennifer Patricia, or something equally appropriate. If I am truly blessed, one will be born on my birthday. This one, regardless of gender, will be Johnny P. Narkinsky.

I plan to teach ALL of my kids to give only their initials, and to make up a social security number whenever they are asked.

As Heinlein pointed out in Friday, it is the duty of all citizens in this day and age to confuse computers. If you can't avoid a tax, pay too much. Transpose digits. Anything to make information mining difficult.

Are you doing YOUR part?

--

How to complain...

[Squeeze Truck]

She needs to go to Central Services and fill out a 27B/6.

What some people fail to realize...

[SgtPepper]

Is that speeding in excess of a certain number of Miles Per Hour is in some juristictions a felony. Typically it's between 15-20 over. And many also fail to realize that when you just pay the ticket you're basically "pleading guilty". So if you have a speeding ticket for doing 70mph in a 50mph zone, and you simply pay the ticket ( note that just paying the ticket is really just waiving your rights to a jury trial ) then you've for all intents and purposes been convicted of a felony crime.

Of course, if i'm wrong, i will be corrected :) Note: i may be wrong with the 15-20, in some places it could be lower or much higher. it varies.

See the Risks Digest

[kzinti]

This sort of thing has been discussed repeatedly and at length in the Risks Digest. You guys do read the Risks Digest, don't you?

The Risks Digest is more verbosely known as the Forum On Risks To The Public In Computers And Related Systems, ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator. It's a great and fascinating thing to read; it covers almost any topic even tangentially related to the risks of using computers and digital systems, including privacy issues, Y2K issues, software in critical systems, encryption policy, etc., etc. It is known on usenet as comp.risks, and is also available via e-mail. It's an old forum; in the online archives you can read discussions following such famous events as the loss of the Shuttle Challenger and the Robert Morris Internet Worm. Highly recommended reading for anyone making software.

Also recommended are the Privacy Forum and the Computer Privacy Digest.

--Jim

Re:Air Force Story

[chriscrick]

This reminds me of a story with similar ramifications...

A colleague of mine went to an interview in conjunction with obtaining a top secret security clearance. Once there, he was confronted with and asked to explain a ten-year-old photo of himself, age 12, walking into the Polish embassy. He had apparently arranged to meet someone there while gathering data for a middle school geography report.

Someone in our intelligence apparatus was lurking outside the embassy, taking pictures of random kids, identifying them, and holding on to the photos so that they could surface a decade later during an NCIS investigation.

Creepy.

Chris

From a lawyer

[ejbst25]

I called my uncle who is a lawyer in my area to ask him about this one once. My question was concerning a failed drug test tht my friend had. He failed it due to incomplete results. Basically..what he found out later is that the company lost his sample and could not finish testing. He started his job one month late because of this. (While he had to wait for the next training courses) My uncle said for me to tell my friend just to have a lawyer call them and they will settle. They paid 3/4 of one month salary + lawyer fees for him in the settlement.

I'd tell your friend just to threaten a lawsuit for loss of wages and grief caused by misinformation. They will never win it and probably will just settle.

It Happened to Me

[Anomalous Canard]

I gave my 2 weeks notice and on the day before I planned to drive from Chicago to New York, I got a phone call that there was a warrant for my arrest in Chicago for failing to appear in court to answer a drug pusession charge. I was told not to report for work on the following Monday. After making a few calls in Chicago, I was reassured that the whole thing was bogus -- no one had a warrant for my arrest. I drove to New York and the background check people sent someone to the courthouse to get a copy of the warrant which was for someone with the same name but a different birthdate. The company did the right thing: I started on Wednesday instead of Monday and got paid for the two days of work I missed while they were clearing up the problem. I just had my 5th anniversary with them last month.

The background check folks screw up sometimes. You need to get the report in writing from them -- you are entitled to a copy under Federal law. You have a recourse if they refuse to correct gross errors and their failure to correct causes you financial damage.

Anomalous: inconsistent with or deviating from what is usual, normal, or expected

Air Force Story

[Bingo Foo]

When my father was in the air force, he was on a base that maintained SR-71's. He applied to the program for SR-71 maintenance, and they had to do a background check since it was a secret program.

When the background check came back, they denied him clearance on the grounds that he lied on his air force enlistment papers. The lie? He said that his mother was born in Germany when in actual fact, she was born in Austria.

The funny thing is, he didn't know she was born in Austria, and she didn't know she was born in Austria. The background check revealed that she was adopted by a german family, another fact that she didn't know her whole life up until that point.

Bingo Foo

----