A 12-year veteran of the U.S. Drug Enforcement Administration (DEA) who went
on the run last February rather than face federal computer crime charges was
arrested in Guadalajara, Mexico last month, and is now being held without
bail in Los Angeles where he faces new charges for his brief turn as a
Emilio Calatayud, 35, skipped out on a $100,000 property bond on what was
scheduled to be his first day of trial on felony charges of illegally
selling sensitive information about private citizens from law enforcement
Prosecutors say Calatayud peddled data to Los Angeles private investigations
firm Triple Check Investigative Services for six years beginning in 1993,
supplementing his government paycheck by anywhere from $1,080 to $8,500 in
cash each year. In all, he allegedly earned at least $22,580 with his
computer access, at a rate of between $60 and $80 per target.
By those figures, Calatayud would have run queries on approximately 300 -
400 people who were being investigated by Triple Check -- though presumably
not all of those people had records to be found.
The purloined data allegedly came from three law enforcement computers to
which Calatayud had otherwise lawful access: the FBI's National Crime
Information Center (NCIC), which maintains nationwide records on arrest
histories, convictions and warrants; the California Law Enforcement
Telecommunications System (CLETS), a state network that gives agents access
to California motor vehicle records, rap sheets and fingerprints; and a DEA
system called the Narcotics and Dangerous Drug Information System (NADDIS),
described by a Justice Department Web page as a database of "over 3,500,000
individuals, businesses, vessels and selected airfields."
PRIVACY ISSUES. A January, 2001 grand jury indictment charged Calatayud with wire fraud,
tax evasion, bribery, and violation of the Computer Fraud and Abuse Act in
connection with the alleged data selling scheme. The federal case progressed
as far as empanelling a jury, but on his February 5th, 2002 trial date the
former agent disappeared.
After contemplating trying Calatayud in absentia, Judge William Keller
instead dismissed the jury and issued a bench warrant for the missing
The former agent's flight ended on June 6th, when Mexican Federal Police
arrested Calatayud in Guadalajara, and wasted no time in putting him on a
plane to the U.S., according to the Los Angeles U.S. Attorney's office. "He
was expelled by Mexico -- in other words, sent out of the county -- the same
day," says spokesman Thom Mrozek. A federal judge later ordered Calatayud
held without bail, and he was transported back to Los Angeles.
The former agent plead not guilty to all charges, including a new charge of
failing to appear in court, on June 17th. His trial is now set for August
6th. Calatayud's attorney John Yzurdiaga -- who briefly represented hacker
Kevin Mitnick in 1996 -- did not return phone calls.
If the indictment proves accurate, the Calatayud case highlights the risks
posed by the increasingly large number of law enforcement databases that
house information on individuals, and are widely accessible with minimal
security, some privacy advocates say.
"When you have all this aggregation of data in these large databases, with
literally hundreds of thousands of people with access to it at the same
time, it creates a situation where data is vulnerable," says James Plummer,
director of the libertarian National Consumer Coalition's Privacy Group,
which named Calatayud its "Privacy Villain of the Week" when he went on the
lam in February. "These federal agents aren't all saints. And the more
information on citizens that's in there, the more likely that things like
this are going to happen."
In an unrelated data-selling scandal last year, prosecutors charged Maria
Emeterio, an officer with the Nevada Attorney General's Office, and Mary
Ellen Weeks, an employee of the Las Vegas municipal court system, with
selling over 100 NCIC records to a Las Vegas private investigator for $100 a
piece. Both women and the private investigator, a former FBI agent, plead
guilty in the case. By Kevin Poulsen