Forwarded message:

From toad.com!owner-cypherpunks Thu Dec 14 17:36:57 1995 Date: Thu, 14 Dec 1995 14:50:19 -0800 (PST) From: Sandy Sandfort <sandfort@crl.com>

So far, no one has come up with anything stronger than specula- tion about my database question. Some "anonymous" told me how easy it was to buy *phone numbers* on CD-ROMs. Great, but I didn't give the guy my phone number.

It was probably a shrewd guess on the part of the phone peon, combined with a fresh database from the telephone company. Are there many people in your zip code with the same last name as yourself? If not, that pretty much answers your question right there. When you pull a credit report from TRW's database, the only information TRW needs is the first four (?) letters of the last name, the initial of the first name, the numeric part of the address, the first character of the street name, and the zip code. I'll leave it to the experts in information theory to explain that in rigorous technical detail. Given only a last name and a zip code, I wouldn't be surprised if you found the proper individual most of the time. (If you're in Minnesota and you're looking for Swenson in 55419, you may need more info, but not much.) Another anecdote to add to the pile: I moved to a new apartment last May. For various reasons, I got an unlisted number, and had my credit card bills and magazine subscriptions sent to a mail drop (MBE). The phone, gas, electric and cable bills went to the new apartment, not to the mail drop. I didn't get any junk mail at the new apartment until a couple of weeks ago--right after I changed my subscription to Byte to come here (now I'm getting AOL disks, etc.). Before that, I got no junk mail here (except from the phone or cable company). I get almost no telemarketing calls; I used to get at least one a night with a listed phone number. My experience appears to be that credit card and magazine companies sell lists; utility and cable companies don't. Mass mailers must not get unlisted number customers on the lists they get from the phone company. Again, this is only from my experience, all disclaimers apply. And all this has no relevance whatsoever when you bring the government into the picture. Crypto relevance? Well, I did mention information theory...