Who's been reading my cell-phone records?

If Verizon Wireless employees could snoop into then-U.S. Senator Barack Obama's cell-phone records, as the carrier acknowledged last week, then mobile subscribers may worry how well protected they are. They should, according to some industry analysts and privacy lawyers.

Verizon Wireless found that some employees viewed information from an Obama cell-phone account that has been discontinued for several months, the company disclosed last week. Verizon was investigating employees who saw the information, with and without authorization, and put them on paid leave. Later reports said some had been fired.

Verizon declined to comment for this story.

Information that is saved by mobile operators -- and that might be available to unauthorized or unscrupulous employees -- includes whom you talked to, when you called them or they called you, and for how long you talked, as well as text messages and voicemail, according to Ari Schwartz, vice president and chief operating officer of the Center for Democracy and Technology (CDT).

The information can also include your locations when you started and ended the call, as determined by cell towers or other techniques, CDT Senior Counsel John Morris said. The risk is greater with current accounts than with closed ones like the Obama record that was snooped, Schwartz said, because some types of data are kept longer than others.

There have been few cases of internal snooping on mobile records, at least ones that have seen the light of day, according to attorneys and analysts in this area. But neither are there clear protections, they charge.

"It is very easy to obtain wireless phone records of another person," said Chris Hoofnagle, director of the information privacy program at UC Berkeley's Center for Law & Technology. "How can you tell when your (authorized) employee is looking at records in an inappropriate context? That's the challenge that the phone companies have to deal with."

Phone-company employees snooping for fun would be one thing, but the danger seems to go beyond that to include information being passed to outsiders, such as private investigators, he said.

"There is at least some evidence ... there is a little bit of a market in which employees are improperly selling access to private information," said Kurt Opsahl, a staff attorney at the Electronic Frontier Foundation.

According to the Electronic Privacy Information Center (EPIC), online data brokers openly advertise on the Internet that for about US$100, they can provide information on all the calls made on a particular cell phone. Such information isn't interesting solely to celebrity-chasers, observers said. It could put average people in danger from stalkers or ex-spouses, for example.

Under standard procedures, no one at a mobile operator looks at an individual's call data record -- the combination of personal identity, dialled numbers, call times and financial details -- without the customer's permission, according to Tad Neeley, chairman of mobile operator Telscape. If a customer service representative needs to see the record to solve a problem over the phone, they ask the subscriber before opening it up. But the information typically is accessible to many people along the line, including those in administrative positions, Neeley said.

The IDG News Service is a Network World affiliate.