State-Sponsored Identity Theft.
In an Ohio sting operation
at a strip bar, a 22-year-old student intern with the United States
Marshals Service was given a fake identity so she could work undercover
at the club. But instead of giving her a fabricated identity, the
police gave her the identity of another woman living in another Ohio
city. And they didn't tell the other woman.
Oddly enough, this is legal. According to Ohio's identity theft law, the police are allowed to do it. More specifically, the crime cannot be prosecuted if:
The person or entity using the personal identifying
information is a law enforcement agency, authorized fraud personnel, or
a representative of or attorney for a law enforcement agency or
authorized fraud personnel and is using the personal identifying
information in a bona fide investigation, an information security
evaluation, a pretext calling evaluation, or a similar matter.
I have to admit that I'm stunned. I naively assumed that the police
would have a list of Social Security numbers that would never be given
to real people, numbers that could be used for purposes such as this.
Or at least that they would use identities of people from other parts
of the country after asking for permission. (I'm sure people would
volunteer to help out the police.) It never occurred to me that they
would steal the identity of random citizens. What could they be
thinking? [Schneier on Security]