Amy Boyer, 20, was shot and killed outside her Nashua, New Hampshire workplace by a man who had fixated on her for years. He bought her date of birth, Social Security number, and workplace address from the data broker Docusearch. Docusearch got the workplace address by pretexting: a subcontractor called Boyer at home, lied about who she was, and got Boyer to say where she worked. The case produced a New Hampshire Supreme Court ruling that data brokers owe a duty of reasonable care to the people whose information they sell.
What happened
On October 15, 1999, Liam Youens drove to the dental office in Nashua, New Hampshire, where 20-year-old Amy Boyer worked. He waited in the parking lot. When Boyer left work that afternoon, Youens shot her several times, then killed himself in the same vehicle. Boyer had no idea who Youens was. The two had attended the same schools years earlier and exchanged only a handful of words. Youens had spent the years since building a fixation on her and maintaining a public website that documented his stalking and his plan to kill her. To find her, Youens paid the data broker Docusearch. He bought her date of birth, her Social Security number, and, finally, her workplace address. Docusearch obtained the workplace address through a technique called pretexting: a Docusearch subcontractor called Boyer at home, posed as someone else, and lied about the reason for the call until Boyer said where she worked. In Remsburg v. Docusearch (149 N.H. 148, 2003), the New Hampshire Supreme Court ruled that data brokers owe a legal duty of reasonable care to the subjects of the data they sell, that selling a Social Security number without consent can constitute an invasion of privacy, and that pretext calling violates state consumer protection law. The case is widely cited as the first US decision to hold a data broker liable for downstream harm.
Why this case still matters
In Remsburg v. Docusearch (2003), the New Hampshire Supreme Court ruled that a data broker owes a legal duty of reasonable care to the people whose information it sells, that selling a Social Security number without the subject's consent can constitute an invasion of privacy, and that pretext calling violates state consumer protection law. It is widely cited as the first US decision to hold a data broker liable for downstream harm.
The ruling did not end the broker business. Federal law now restricts pretext calling for some categories of information. The core model did not change: a name goes in, and a home address, relatives, workplace, and phone number come back for a small fee. That is still how a people-search page works.
What this means for your exposure
The broker profile about you is the modern version of what Youens bought from Docusearch. The lookup is the same. A name resolves to a home address. Aggregated public records now return that address without a phone call, so the pretexting step Docusearch needed is rarely required.
This matters for anyone whose job produces people who want to find them: police officers, judges, prosecutors, nurses, and other public-facing workers. A home address on a broker page also exposes everyone who lives at that address.
Two laws let some covered workers act directly. Daniel's Law is a New Jersey statute that lets covered officers, judges, and prosecutors demand that data brokers remove their home address and unpublished phone number, and sue if the broker refuses. The federal Lieu Act gives federal judges and their families a similar right to demand removal of their personal information. Both depend on someone filing the demands and refiling when the address reappears.
Frontline Privacy scans data-broker and people-search sites for your home and work address, files removals, and keeps checking because brokers repost.
Related: Rebecca Schaeffer, 1989, an earlier stalking murder where the attacker traced the victim through a public records lookup.
What reduces this risk
Youens located Boyer by buying her address by name. The same lookup runs today, faster and cheaper, because public records are aggregated into people-search profiles that return a home or work address with no phone call. Reducing that exposure means finding the sites that list your addresses and filing to remove them, then checking again when they repost.
Public sources
- An Online Tragedy — CBS News, 2000-02-25
- Remsburg v. Docusearch, Inc. (149 N.H. 148) — FindLaw, 2003-02-18
- The Amy Boyer Case — Electronic Privacy Information Center, 2003-01-01
- Privacy in a Cyber World — University of New Hampshire Magazine, 2004-01-01