Amanda Welsh, Ph.D., runs the research division of Antics Online, Inc., a Silicon Valley marketing agency. Two years ago, she embarked on a project to uncover every electronic file that she could find about herself. The results scared her enough to write this book. She lives in San Francisco with her family.

1. Identity, Privacy, and Protection


One day when I was a little girl in the playground several of the bigger kids began to taunt me. "I can see your epidermis! I can see your epidermis!"

I was horrified and embarrassed. With tears in my eyes, I screamed back, "No you can't!" and ran home as fast as I could. It wasn't until my mother reassured me that epidermis only meant "skin" that I could stop being afraid.

In many ways, the current furor over identity theft and privacy invasions is reminiscent of that playground experience. A few vocal crusaders are shouting to get your attention. But are they asking you to worry about something that is really wrong, or are they telling you that you're exposed in a way that's basically okay? What exactly are the dangers? And are they real?


Identity Theft

Identity theft---when a criminal knowingly uses identifying information about you to commit, aid, or abet any action that is already illegal---seems to be on everyone's mind. You can't pick up a newspaper or watch a newscast without hearing about it. The chances of having your identity stolen are about the same as having an item of personal property stolen---pretty impressive for a crime that was virtually nonexistent just twenty-five years ago.

You take precautions to protect your personal property from being stolen without even thinking about it. Today you must also take steps to protect your identity. But while it's easy to understand what it means to have a car radio or a wallet stolen, it's not so clear to many of us just exactly what identity theft is what actually is it that gets taken?

When you stop to define it, your identity is a bit bigger than news reports might suggest. It's not just your credit card number. It's more than your driver's license, or your Social Security number, or your computer passwords.

Think of everything that makes you who you are---the things that make you unique. The fact that you like the color blue. That you read the Sunday Times and watch CNN. That you graduated from Central High School with a B average and that you like brussels sprouts.

f0That's your identity.

Your identity is the sum of every bit of information about you that there is. It's every action you've ever taken, every preference you've ever expressed. It's everything that's ever happened to you, everything you've ever purchased, everything you've ever written down, and everything other people have written about you.

In short, it's anything at all that anyone can or might use to figure out who you are and how they will treat you as a result---whether they will date you or do business with you or sell you things or throw you in jail or accept your kid into a school.

The issue, you'll quickly discover, is that when it comes to keeping your identity safe, there is more to worry about than you might think.


Identity Damage
Ask yourself what's worse: having your car stolen or having it totaled in an accident? Not much difference really, is there?

While identity theft has grabbed all the headlines, there is considerably less focus placed on identity damage---even though it's a potentially bigger problem. Ten million Americans are victims of identity theft each year, but many more of us are the victims of identity damage. In fact, it's likely that we're all victims to some degree or other---every single one of us.

Identity damage occurs when a piece of information about you is mischaracterized, misinterpreted, or just plain wrong. These mistakes might be inconsequential, but they can also be costly. An incorrect entry in your credit report, for example, could mean you pay a higher mortgage rate than you should. An error in a medical record could deny you insurance coverage or cost you a job.

Identity damage also occurs when a piece of information about you that is absolutely true negatively affects your life or your ability to get something you want. It's possible that you're even doing this kind of damage to yourself without realizing it. Filing too many insurance claims, sending a personal e-mail from work, even being unfriendly to your neighbors can all cause identity damage if you're not careful.

Identity theft, you see, is just the tip of the iceberg.


What Happened to Privacy?

Why didn't identity theft and identity damage pose much risk twenty-five years ago? Because back then, we had a pretty effective antidote: privacy. The technology to keep a watchful eye on all your actions just didn't exist. It was impractical to store much information about you, to collate it, and to share it with others. Practically speaking, even the things you did in public were really pretty private.

So, while your local grocer knew of your fondness for brussels sprouts (and who knows, may have even kept a card in a file cabinet that said so), it was doubtful that your banker or the grocer across town or even the brussels sprouts distributor knew anything about it.

But now they do.

Technology has put an end to privacy. Computers allow a lot more information to be organized and stored. These days information that could fill football stadiums with file cabinets can be stored on computer disks that cost under one hundred dollars and fit in the palm of your hand. The Internet has connected every one of these computers---as well as every cash register, gas pump, and ATM---to form one big readily-accessible pool of data. Miniature devices like cameras or sensors extended what information about us can be collected.
Software can sift though this vast information in the blink of an eye, analyzing, sorting, and detecting patterns. The result: your life is an open book to just about anyone who wants to read it.

Six hundred insurance companies in the United States can access your medical history from a central database. Two thirds of large companies perform background checks on job candidates. Four-and-a-half-million tons of junk mail are delivered to you and your neighbors each year.

Did you know that computers in your car monitor if you're speeding? That software predicts if you're likely to commit a crime? That doctors, banks, hotels, casinos, and apartment owners maintain blacklists? That invisible surveillance cameras photograph you more than seventy-five times each day---sometimes for security and sometimes to catch you in an embarrassing situation for broadcast on Internet Web sites?

Did you know that thirty-five federal agencies currently buy information collected on you by large profiling companies to gauge if you're likely to be a terrorist or drug smuggler? And the only way that you're not profiled is if you've never bought anything with credit, don't have a driver's license or a checking account or any kind of insurance, and have never held a job even filed a change of address with the post office.

Some would have you believe that the key to reducing identity theft and damage is to fight for more privacy, hoping to stem the tide of all this technology. But although most of us value privacy as a concept, when push comes to shove we rarely care about what people know about us. Until a line is crossed---and for most people that line is at the doorway to the bedroom---we're quite happy living in a world where Big Brother is a television show and not an Orwellian nightmare.

The key is to forget about trying to keep your identity private. It's a bit like worrying about showing your epidermis. You need to worry about what really matters.


What Really Matters

First, the Bad News

Consider what happened to these people:

A busboy in Manhattan contacted credit reporting agencies and obtained the Social Security numbers of two hundred CEOs and celebrities such as Steven Spielberg, Ted Turner, and Oprah Winfrey. Using their identifying information, he authorized transactions with banks and stock brokers that allowed him to swindle millions of dollars from his famous victims.

A man in Massachusetts was wrongly classified as an alcoholic by a medical information bureau and was charged higher premiums than he should have been for disability insurance; another woman was turned down for disability insurance altogether because her father's record incorrectly indicated that he had a hereditary disease.

After being turned down for many potential jobs, a man who was unsuccessfully looking for work found out that his Social Security number had been mistakenly assigned to a murder suspect. Another luckless job hunter discovered that he was marked as being wanted in a database of suspected arsonists and shoplifters. Unfortunately, both men were law-abiding citizens whose records got mixed up with those of true criminals. And both men lost their houses and families before the problems were uncovered.

A kindly grandmother was disturbed to receive phone calls from a prison inmate who made detailed references to her personal situation along with vulgar sexual suggestions. It turned out the inmate had been hired by a mailing list vendor to input information about catalogue purchasers into a master database. He chose the elderly woman at random as a plaything to harass.

Another woman---this one only nineteen years old---was stalked by a psychotic classmate who used an information tracking agency to find out where she worked. The classmate shot and killed her outside her place of employment.

We've all heard these stories or ones like them before, and most of the time we're shocked and appalled by them. The funny thing is, though, we don't really change anything that we do because of them. The reason we don't is that the people who share these stories with us---reporters and consumer advocates---have generally presented them as invasions of privacy.

But here's the catch. These stories aren't really about privacy at all. These stories are about mistakes and abuse and stalking. Their message isn't to worry if someone knows how often you buy corn flakes. Their message is that, once put in...