The Tribune computer searches that produced the identities, workplaces, post office box addresses and telephone numbers of hundreds of CIA employees here and abroad relied entirely on public records, not private data.

The data the Tribune used were derived from telephone listings, real estate transactions, voting records, legal judgments, property tax records, bankruptcies, business incorporation papers and the like.

Until recently, such public records represented a minimal threat to privacy, in large part because they were widely scattered in hundreds of libraries, city halls and courthouses around the country.

But when such public records are aggregated into an individual profile, as the data-brokerage industry has done, they acquire enormous power and can become a dangerous tool in the wrong hands.

The principal vendors of aggregated public records--the largest is LexisNexis, which claims more than 4 million subscribers and has compiled more than 5 billion documents and information from 32,000 published sources--say they have been careful about to whom they sell such information.

They say their clients must be established businesses with a demonstrated need for the information: law-enforcement and government agencies, employers and property managers wanting to check new hires and renters, lawyers, libraries, telemarketers, bill collectors, private investigators and major newspapers such as the Tribune.

Different categories of clients have access to different levels of information. Newspapers, for example, cannot access private information, such as medical or credit histories that might be available to law enforcement or government or even to certain private-sector companies.

The industry has become even more cautious about whom it accepts as subscribers since LexisNexis' smaller rival, ChoicePoint, recently agreed to pay $15 million in fines and penalties after failing to protect sensitive personal data from identity thieves.

But while the major data-mining companies are scrutinizing their customers, other Internet sites are offering anyone with a credit card virtually the same public-record data available to subscribers to LexisNexis and ChoicePoint--and some that the established services do not make available.

A search of one such Web site reveals, for example, that a CIA operative currently facing Italian charges of kidnapping a radical Muslim preacher in Milan has a criminal record in the U.S.--information that was not obtainable elsewhere.

Searching individual Web sites is more time-consuming than purchasing a comprehensive profile from a major data aggregator. But with only a credit card number, the Tribune was able to obtain nearly all the information it had acquired from data providers.

That included the names of clandestine CIA operatives assigned to U.S. embassies, covert mailing addresses used by some of those operatives, and the "cover names" used by several members of the CIA's paramilitary Special Activities Division, which has participated in scores of abductions of suspected terrorists abroad.

Home addresses and telephone numbers of CIA headquarters employees are also available for a price, as are those of some CIA officers who are operating overseas posing as business executives or using other "non-official cover."