CIO — Memorial Day is typically the first big scuba weekend of the year, and the Friday before the 2002 holiday, May 24, proved no exception as dive shops around the country teemed with visitors. There was one notable difference, however. In addition to the usual beach bums, water bugs and vacationers renting equipment and booking trips, there were FBI agents demanding the names and addresses of everyone the shops had taught to dive since 1999.
They wouldn’t say why.
The Professional Association of Diving Instructors (PADI), an organization that oversees scuba certification, started hearing from panic-stricken shop owners that morning. "We got calls from all over the country saying, I don’t have [the data], what should I do?" says Jeff Nadler, PADI’s vice president of industry and government relations. In order to spare the dive shops further harassment on their first busy day of the year, Nadler made a critical decision: PADI would give the FBI a copy of its own database.
On Friday afternoon, he called the FBI agent in charge of the dive shop investigation and struck a deal. PADI would turn over its records if the FBI would agree not to share the information with any other organization, including other law enforcement groups.
Strictly speaking, PADI was acting voluntarily; the FBI had not subpoenaed its database. (One Florida dive shop owner refused the FBI’s request, and two-and-a-half hours later an agent returned with a subpoena.) The following Tuesday, Nadler mailed to the FBI a Zip drive containing the names, addresses and certification levels of almost every American who had learned to dive in the past three years?2 million names and their accompanying personal information.
PADI’s experience is not unique. In the year and a half since Sept. 11, 2001, supermarket chains, home improvement stores and others have voluntarily handed over large databases of customer records to federal law enforcement agencies?almost always in violation of their stated privacy policies. Many others have responded to court orders for information, as required by law. Clearly, the government wants your corporate data, and under new legislation passed in the shadow of Sept. 11, it has a right to it.
Companies that lack the proper procedures to handle the new government mandates can expect to lose business and even face lawsuits (from customers outraged at the loss of their privacy). And then there’s the cost of infrastructure improvements to meet the demand for data. As czars of information, CIOs must take a leading part in preparing their companies for when the feds come knocking. As a senior FBI official told Nadler, "Last month it was apartments; this month it is scuba. Who knows what it will be next month."
