Newspaper Exploits Loophole to ID No-Call Registrants
However, the Federal Trade Commission, which runs the no-call list, said yesterday that it was in the process of removing the mechanism the newspaper used to identify people who have registered.
The Hartford Courant reported Sept. 30 that the home telephone numbers of several Direct Marketing Association executives and the CEOs of teleservices providers Convergys and West were registered on the list. The only DMA official the Courant identified was vice president of government affairs Jerry Cerasale, who told the newspaper that, acting without his permission, someone must have registered his number to embarrass him.
Use of the list for any purpose other than scrubbing is punishable by an $11,000-per-violation fine. However, the Courant explained how it got around this. On the no-call Web site, www.donotcall.gov, consumers can enter up to three phone numbers, along with an e-mail address, to verify their registrations. The site automatically sends an e-mail of the result to the address provided.
Using public records, the Courant obtained the home numbers of Cerasale and the others, then ran them on the no-call Web site. There is no mechanism to ensure that the e-mail address provided is the same as that of the person whose number is being checked.
"The [FTC] site has a page where you can verify that a number is on the registry," Jack Dolan, lead writer on the Courant story, said in an e-mail. "It also tells you when the number was registered. Checking to see if telemarketing industry insiders' own home numbers were on the list seemed like a very obvious thing to do."
DM News used this method to check whether American Teleservices Association executive director Tim Searcy or DMA president/CEO H. Robert Wientzen were registered for the no-call list. Neither was, though Cerasale's number did come back as registered.
The FTC included a verification mechanism for both online and telephone registration to the no-call list, said FTC spokeswoman Cathy MacFarlane. The feature was meant to help consumers who registered and then forgot. But due to the Courant's use of the verification feature to identify people on the list, the feature is being dismantled, she said.
Privacy advocate Chris Hoofnagle, associate director of the Electronic Privacy Information Center, said he was not alarmed that people could use the no-call site to check whether others are registered. The verification feature was added to make registration easier for consumers, he said.
Marketers potentially could use the information to sell privacy products, said Jason Catlett, privacy advocate and founder of Junkbusters Corp. However, in Florida, the first state that enacted a no-call law, residents who registered for the no-call list always have received an asterisk next to their name in the phone book.
"In an ideal world, I wish there was some other way to do it," Catlett said. "In the bigger scheme of things, I don't see that it's an enormous problem for most people."
The site confirms only that a number is registered and does not give a name or e-mail address, and it also limits how many phone numbers can be verified at once, making it harder to verify lots of numbers at a time. However, a computer program can be written easily to get around that, said Richard M. Smith, a privacy and Internet security consultant.
A person who wanted to check a long list of numbers against the no-call list could set up dummy e-mail accounts that all forward to the same e-mail box, Smith said. A program to automatically submit the numbers to the no-call Web site then could be created.
Ticketmaster faces this problem when trying to limit the number of tickets people purchase. Ticket resellers use such programs to rapidly buy bunches of tickets, and Ticketmaster defeats this practice by requiring ticket buyers to enter a randomly generated password each time they make a purchase.
Using this strategy to check whether numbers are registered would be worthwhile only if it proved cheaper and easier than obtaining the list directly from the FTC, Smith said. For no-call list access, the FTC charges $7,375 for all the area codes in the country, or $25 per area code with the first five area codes for free.
Regulators banned use of the no-call list for any purpose other than list scrubbing because they were concerned about the use of the list for alternative marketing purposes, Hoofnagle said. For example, mailers could buy the list, match the numbers against their database of addresses and send mailings to list registrants.
Hoofnagle said he shared Cerasale's concern about people registering others for the list without their permission, though he didn't see what harm consumers would suffer.
Though the donotcall.gov Web site is still accepting registries from consumers who want to sign up for the no-call list, the FTC has stated its intent to stop accepting new registrations in accord with a court ruling that the list violates the telemarketing industry's free speech rights. The process is expected to take three to five days, MacFarlane said.