Over time, Rapp's client list swelled. Tabloids, attorneys, P.I.s, even the occasional federal or local police officer -- they all wanted information, and they weren't too choosy about where it came from. For his part, Rapp wasn't always clear on who was obtaining the data or for what purpose.
"We had, at one point, over 1,500 clients that were private investigators throughout the country," he testified, "and they would bombard us, literally, with ten to twenty cases a day...so we didn't have time to look into each and every aspect."
Rapp used the Internet very little in his work, afraid of leaving a trail that could lead back to him. His specialty was calling up customer service at a phone company, a bank -- anyone that might have the target's address, credit-card records or other data on file. He'd convince them he was the customer, and he needed his password or his latest bill right now, and this is his Social Security number...no? You have a different one? Well, which one do you have? Oh, you've got it confused with my father.... Armed with the info he'd tricked out of one customer-service rep, Rapp was ready to move on to another and another, until he had all the data he needed.
"It's just playing the game," Rapp explained. "When you've convinced them that they're wrong, they want to prove to you that they're right."
The lawmakers were aghast. They never dreamed it was so easy for a fluent liar like Rapp to get past the human firewalls that guard personal data. At one point Rapp unwittingly tracked down addresses and phone numbers of an undercover Los Angeles police squad for one of his shadowy clients; the information was used by mobsters to identify informants and threaten detectives, one of whom was later killed. "That's the kind of thing that gives my former industry a tremendously bad name," he told the committee.
Rapp told the committee that he's been out of the business since 1999; that same year, Congress passed a law making it illegal to use pretexting to obtain financial data. But Rapp's legacy lives on in Colorado. He told the Rocky Mountain News that in the 1990s he used traplines provided by one of Jim Welker's companies to identify the owners of pager numbers. Welker has been under fire for offering consumer cell-phone records for sale; this spring, he decided not to make another run for his seat as a state representative. Welker's company has also done business with companies in Frederick, Colorado, operated by John Strange, the data broker who sold Governor Mitt Romney's credit-card numbers to the Boston Globe. Strange has been sued by the Texas attorney general over the marketing of cell-phone records.
When summoned on June 22 to testify before Congress about data security, both Welker and Strange took the Fifth. Welker didn't respond to an interview request, but he has said that he no longer offers cell-phone records for sale. Strange and his attorney say he's now out of the data-broker business entirely, except for a court-document retrieval service. Worldwide Investigations, Strange's Denver private-eye agency, is also defunct.
Privately, other data brokers say that many of the services are merely retailing information obtained from other sources. Some refuse to deal with private investigators; others will sell to anyone. Few seemed convinced that the proposed legislative crackdown will make it through a Republican Congress. "There's too many large financial companies that want this information available," says one.
"Then I'm just another citizen again?"
"That's right, with no license and no gun. Nor will you ever have one again."
"Are you booking me for anything?"
"I can't very well. I wish I could."
He must have read what was coming in the lopsided grin I gave him because he got red from his collar up. "For a D.A. you're a pain in the behind," I said. "If it wasn't for me the papers would have run you in the comic section long ago."
"That will be enough, Mr. Hammer!"
-- Mickey Spillane, Vengeance Is Mine!
Public outrage over pretexting has prompted numerous efforts to expand existing laws against criminal impersonation. Most of the proposed laws would make it a crime to pretend to be someone else to obtain a wide range of personal information. The movement could have far-reaching implications, not only for private investigators, but for journalists and other sometimes-covert information-gatherers. One such bill in California is opposed by groups representing the recording and movie industries, which say they need to be able to conduct undercover operations to thwart music and video piracy.