When a Stranger Calls, Beware of The Pretext

What is not in dispute is how easy it is to obtain closely held personal data.

Earlier this year, a blogger paid $89.95 to obtain the records of about 100 cellphone calls made by Ret. Gen. Wesley K. Clark.

Although sites such as Locatecell.com and dozens of others for years advertised phone records for sale, the Clark incident raised the specter of not only major privacy breaches but also potential national security concerns.

The Clark stunt led to a series of hearings on Capitol Hill over the summer, and resulted in House passage of legislation that imposed criminal penalties for accessing consumer phone records through pretexting. Some state legislatures are considering stiffening their own measures to prevent and punish pretexting by companies.

But security experts worry that lawmakers are focusing too narrowly.

"This is a much broader arena than just cellphones," Douglas said. "They steal your cable TV records, satellite TV records, gas records, power records and all the rest. Anything that will give them personal information about you that will add to the puzzle they're putting together, they will seek out. Often they will use one consumer company against another."

Police can use a form of pretexting during interrogations -- misleading a suspect into believing officers have evidence against him on one charge to get him to confess to another. And pretexting to get someone's phone records without their knowledge, such as in the HP case, has been a reliable tool for some private investigators.

"Going after someone's phone records -- that's black-letter stuff," said James H. Rowe, a former investigator on the Senate Watergate committee and executive vice president of the James Mintz Group Inc., an investigation firm. "That's not even in the world of being gray."

Staff writers Ellen Nakashima and Yuki Noguchi contributed to this report.