More about that, "Little List"

[pecunium]

A lot of people are talking about the list of names I mentioned yesterday. In comments at The eyes are not here (on Making Light) one of the more common lines of, low-grade, apologia made its appearance; that it might have been legally collected.

In practical terms... it's not plausible. It is so implausible, in fact, as to rise to not worth giving any benefit of doubt. Yes, when caught the people who did this have to be presumed legally innocent. That doesn't mean I can't know beyond a reasonable doubt that story of how this little piece of Brownshirt-style intimidation/terrorism, is a pack of lies.

I did a back of the envelope analysis of what an investigation which didn't use an, "inside source," to collate the information would take... short answer, either a lot of money, or a lot, and I mean a lot of time.

How do I get there?

Because this sort of thing is part of what I did in the army; based on things claimed in the cover letter.pdf sent with the list.

They claim to have based it on observations, and reports from "legal Mexican nationals who infiltrate their social networks and help us obtain the necessary information we need to add them to our list."

One of the things being supposed is they may have used private investigators to do some of the leg work, i.e. to confirm suppositions. This isn't stated in the manifesto, it's just a guess.

Ok... let's assume they did some of that PIs are really bad about giving a cost upfront. Based on what few websites I found with pricing on them, we can guesstimate an average cost of $75 per hour, per investigator. Then we add $25 per hour for surveillance, and assume this was plain-jane, (two PIs in a vehicle, with a video camera. They don't care if they get made, so they don't need to engage in the complicated stuff). If we further assume the preliminary footwork has made it unnecessary to tail more than about 25 percent of the people; and they only did such surveillance once they were sure they were on the list; so as to reduce the waste of spending money only to eliminate the person, we can call it 325 people they tailed.

We'll also be generous and say none of that needed more than the 4 hour minimum of billable hours, and that mileage was trivial. That list of assumptions brings in a PI bill of $325,000.

Which, even before we look at the legal risks to the PI of trying to get HIPAA protected information, the cost alone makes it unlikely PIs were used.

Even if PIs were used it's still almost impossible to believe the story behind the list.

Te final list is more than 1,300 names long, with a huge amount of information which isn't the sort people share with other people (really, was the last time you gave someone who didn't have some right to it your SSN?). That means a lot of legwork. A lot of, "observation". A lot of informers "infiltrating" the social networks of the undocumented.

We are supposed to believe this happened, completely under the radar? That enough collaborators were recruited, to make it possible, and not one of them balked? Not one of them told people they'd had someone try to recruit them?

They then engaged in all the time needed to get this list, and went back to their handlers for their debriefings, and got new direction. All on the down-low?

Right.

Then the handlers did the write-ups of the debriefs, and they collated the data, and cross-indexed it, and ruled some people out, and tagged others as targets, and did the associations matrices, and tagged the supporting evidence, until they were sure they had 1,300+ undocumented workers.

At a conservative 20 hours of collaborator time, per name which went on the list (and that's really conservative), and a conservative back-end of four hours for the handlers and analysts we get, 31,200 man hours to do this.

It's really conservative, because it doesn't count for time spent on leads which didn't pan out. It's 31,000 man hours, 775 man weeks, 193 man-months.

It's 16 man-years.

That's conservative. That's not counting the time to recruit, sensitize and task the collaborators. Lets say each collabotor did ten people, and they were needed for 50 percent of the list: 650/10 = 65 collaborators (which is why I don't buy the "we used sympathetic Mexicans... and why Mexicans? What about the Guatemalans, Salvadoreñnos, Hondurans, Panamanians? The odds of getting ten and not having a fink are long... 65: which is a conservative number, not a fucking chance). Call it five hours to train them up (again, really low-ball, this isn't trivial stuff here, this is SSNs, medical records, daily routines, etc.), that's another 325 hours.

Who did that training? Was it one guy, running around the state giving workshops? Or are we to believe there is a group of guys with that knowledge, who just happen to be this big on the problem of undocumented workers in Utah, who managed to find each other? It's possible but it strains credulity a bit.

The other option, one guy (who's really good) managed to train others, and they did the training. So, lets say we have 7 guys who got trained on training the collaborators; call it 40 hours to train them... and they each did the lower down training.

This is why I don't buy the cover story. It's why I think (apart from the tone of, "The Shadow Knows" to the letter), it's a distraction.

As a distraction it does two things. One, it makes the undocumented, and those who might be accused of it, nervous. I think that is the place it succeeds. Because it might be so.

Two, it's meant to make the search less focused. I think this is, at most, a few people who have a similar mindset, and access. They grabbed a bunch of stuff from work, and put together this list, and cooked up a story to make it seem it wasn't that trivial (and venal) a thing. They also knew they were committing a crime, and this was their attempt to cover it up.

But they don't know just how much work it is to generate the sort of list they stole. Cops do, so I don't think the misdirection worked much. I'd also be very surprised to find out the list was circulated to all that many (if any) police agencies before this. Maybe it went to ICE, they are about the only group which could do anything on this scale. If it did, then the cats going to come out of the bag pretty soon, because the odds are (well, I hope) the criminal nature of the deed was evident from the get go.

The scary thing to ponder is that it might be true. That there is a group out there, which favors taking the law into its own hands, with the sort of skills, money, dedication, operational security, etc., to pull this off.

If that's the case, we have a lot bigger problem than some people sneaking over the border to take jobs the rest of us don't want.

Comments

[tlatoani.livejournal.com]

I'm a HIPAA expert. Do you have access to anything which would show me exactly what kind of medical information they got? I could probably tell you whether it's possible to obtain it legally, if that will help your analysis.

[pecunium.livejournal.com]

No. What I do know is pregnant women on the list had their due dates published, and they claim to have observed them, "entering our public welfare buildings."

More to the point, if I understand HIPAA properly, getting at the records, even if what they published was otherwise findable, is a violation.

Since I don't think the story about "observation" passes the smell test, I suspect they had to violate HIPAA, and I do know that asking a PI to get that info would be soliciting a violation.

[tlatoani.livejournal.com]

It depends on where the information came from. Without going into geeky HIPAA detail, the same information could be covered by HIPAA, or not, depending on the source. Getting at the records is a violation if the records were in the possession of a covered entity (a health care provider, payer, or clearinghouse, and some other stuff) or, now, a business associate (a third party who handles records for a covered entity, basically). If they were in the hands of some state agency that isn't a covered entity, it wouldn't violate HIPAA.

It seems likely, if they have detailed medical information, that they violated HIPAA to get it. But some stuff is available through safe channels.

[antonia-tiger.livejournal.com]

Something such as a pregnancy due date, I can think of possible non-HIPAA sources. But such sources aren't likely to be a single source, and that extends the chance of somebody talking about the question being asked. Unless you're pretending to be Homeland Security or similar, which would be another crime, and too likely to get you remembered.

[dagibbs.livejournal.com]

I wonder how much of the data is available by people sharing stuff they shouldn't on the internet?

[pecunium.livejournal.com]

Probably a fair bit.

How much of that is linkable to someone being an undocumented alien in the US?

How long would it take to collate, and sift?

[don-fitch.livejournal.com]

My guess is that the perpetrator(s) won't be rooted-out unless (or until) someone close to them finks. (Ideologues generally aren't especially close-mouthed.) And I'm wondering if records like that can be accessed from home computers, or whether the data was collected during working-hours.

[dagibbs.livejournal.com]

Your other post makes these speculations look kind of moot. But, with the idea of "crowdsourcing", this does get closer to what a group of volunteers could do, with far lower costs than the physical-world operations you are talking about. And, I'll bet they wouldn't actually care too much about accidentally making life hard for some of the legals, if they catch a bunch of false positives.

I do agree, though, this is a horrible thing to do, however it happened.

[pecunium.livejournal.com]

Thinking about it... I don't know how much would be on the net, because I don't know how much undocumented workers are on the net. I know that they aren't likely to be leaving their social security numbers just hanging out there and what places they do hang out would almost certainly be in spanish; making it a lot harder to collect the information.

[dagibbs.livejournal.com]

I do wonder how much they are on the net. Whether it is something they don't use much -- or whether it is a major under-ground access to home and stuff like that? Is Skype a cheap way to talk to family while they're away, for example?

Also... I don't understand the SSN, but if they're undocumented, would they even have an SSN?

The point about Spanish makes sense, though.

[pecunium.livejournal.com]

I can't say directly, but the prevalence of phone cards to Mexico, Central and South America in shops (from Tennessee to California) makes me think the phone is the preferred way.

In Ecuador the net was slow, and not trivial to get onto, and that was in Quito. I can't imagine that in rural areas it's even that good (Galapagos was a different case, the net was really slow; to the point of being impossible to use), and expensive, on the order of 10 cents a minute, when the local economy made that more like 50.

The SSN is required to work. Employers are required to get one from you; since all your tax records are attached to it (if one is working in the States, but not a permanent resident one gets a "Taxpayer ID Number", which is an SSN, that doesn't work in quite the same way).

So some number, in the right format, is attached to everyone who is being paid other than cash. Because it's attached to all of one's financial data (banks have to collect it, so they can report interest, or unusual transactions to the gov't), it tends to be closely held, because huge amounts of fraud are perpetrated with it.

As a result there are a number of laws making it criminal to improperly use/publish them, in part because, for a lot of people, the coding of the number reveals the area in which one was born, making searches for supporting documentation to get more information, and so better commit identity fraud, easier.

[dagibbs.livejournal.com]

Right. So the undocumenteds who are working cash under the table, or otherwise in the grey to black economy, might not/would not neccessarily have SSNs.

And, yeah, sounds like phone is still the way.

[harimad.livejournal.com]

The other possibility is that the reported SSNs are fake. But your basic premise is correct: if someone has a legit SSN then ze is legitimately in the US.

[billstewart.livejournal.com]

They also provided SSNs, which if they're a government worker misusing them (which it later turned out that they were), then that's also illegal for them to disclose, under whatever's left of the Privacy Acts.

[billstewart.livejournal.com]

Undocumented workers themselves don't have to be on the net - employers and almost anybody who gives credit or runs credit ratings (landlords etc.) could have them, and most medical providers and insurers use SSNs even if they sometimes try to use other ID numbers. But somebody with medical insider information they were violating was the obvious source, as opposed to somebody collating disparate information, and your speculation that they weren't the broad group of concerned citizens they pretended to be turned out to be correct.

[pecunium.livejournal.com]

For it to be a collecting of information publicly available on the net by people sharing thing they shouldn't (as opposed to an inside job), I think the victim proper would be the person.

Employers, potential landlords (though in my experience, the landlords of people in the gray-economy aren't running credit checks), medical providers, etc. are enjoined from secondary usages of that information.

Which doesn't mean there aren't some improper releases of the information, but not enough; I think, to compile such a collection of information as this was.