Retired General's Phone Records Pretexting Incident (2005-2006)

What happened

An online data-broker site obtained 100 consecutive calls made to and from a retired U.S. Army general's personal T-Mobile (Omnipoint) cell phone between Nov. 15 and 18, 2005, by pretexting the carrier: impersonating the account holder to a customer-service representative to get the call log released. In January 2006, blogger John Aravosis of AMERICAblog purchased that call log for $89.95, needing only the retired general's cell number and a credit card, and received the data within 24 hours. Aravosis had first tested the market on himself, buying his own Cingular Wireless records for $110 from a related site. He published the purchase on AMERICAblog on Jan. 12, 2006, as a proof-of-concept that private communications metadata could be bought online with little buyer verification.

How it worked

Web-based data-broker sites advertised the ability to produce a target's cell-phone call log for a fee, needing only the target's phone number and a credit card. Behind the storefront, brokers or subcontracted information specialists used pretexting by misrepresenting identity or authority to induce carrier personnel to release call-detail records. The broker then repackaged that data and sold it to the online purchaser.

The lure and the tell

The lure operated on two levels. First, data-broker sites attracted paying customers with a simple e-commerce promise of obtaining someone's call log from limited identifying information. Second, inside the transaction, the broker's pretext to the carrier involved impersonation or other misrepresentation to obtain the records. The transaction was publicly disclosed by John Aravosis on AMERICAblog as a proof-of-concept.

Outcome

An EPIC petition to the FCC described online data brokers offering telephone call records with only a telephone number and short turnaround times, and argued that existing authentication standards were insufficient to prevent unauthorized access to CPNI. The episode therefore fits a broader documented concern about weak carrier authentication, rather than establishing that this single disclosure triggered every later enforcement or legislative action.

Why it matters

This incident concerns the commercial sale of phone records and subsequent regulatory scrutiny. It illustrates privacy risks from unauthorized release of account records.

Defenses

The episode exposed the risk that weak carrier authentication could let pretexters impersonate account holders to obtain call-detail records. The broader control lesson supported by the EPIC petition is to strengthen authentication before releasing CPNI or similar account data by phone.