Liam Youens paid $109 to a commercial data company to find out where Amy Boyer worked. He got the address. He drove there. He killed her.
Boyer worked as a receptionist at a small dental practice in Nashua, New Hampshire. She was twenty years old. The dental office was a legitimate small business, registered locally, listed in business directories, and accessible through the same commercial data lookup systems that tens of millions of small service businesses sit inside without knowing it. Her employer had done nothing wrong. The office had no location data policy because no one had told them one was needed.
The commercial data company was called Docusearch. Youens had been methodically building a file on Boyer for months through a combination of public records and paid lookups. He paid Docusearch $45 to retrieve her Social Security number and $109 to find her current workplace. The workplace lookup worked through a pretext call. A Docusearch employee contacted Boyer's mother, identified herself as being associated with a survey company, and asked where her daughter worked. The mother answered. The address flowed back to Youens.
No system failed. Every component worked as designed.
Youens had documented his obsession on a personal website he maintained during the months he spent building his file on Boyer. The site contained detailed records of his surveillance activity and his plans. None of that content was connected to any of the commercial lookup services he used. Each transaction with Docusearch was legal, anonymous, and completed within their standard service model. He was a paying customer. The service delivered.
The case eventually produced a landmark ruling from the New Hampshire Supreme Court. In Remsburg v. Docusearch, Inc., 149 N.H. 148 (2003), the court held that a commercial data company owes a duty of care to third parties when providing personal information to customers, because the risk of harm from that data reaching the wrong person is foreseeable. The ruling was significant not because it was surprising, but because the court stated plainly what the commercial data industry had long operated as if it were not true: when a business sells location data about a private person to an anonymous paying customer, the downstream harm is a predictable outcome, not a random one.
What the case did not change is the setup that made it possible.
The same commercial data market that located Boyer runs today on a significantly larger scale and at a significantly lower cost. A small business owner who operates from a home address, or who runs a licensed service business with any public-facing registration, sits inside the same data landscape. Their business license is a public record in the jurisdiction where they filed it. Their professional license is in a state database that data brokers query on a regular schedule. Their listing on an appointment booking platform, a local directory, or a review site confirms their location as a current operating address. Their phone number, which appears on all of those sources, is the thread that ties every separate record into one consolidated profile.
The dental practice where Boyer worked did not create a failure. They maintained a business. The small business owner who files a massage therapy license, registers an LLC, lists their business on a platform, and takes appointments by phone has not made a mistake. They have followed every normal and required step of operating a licensed service business. Those same steps are the data trail.
The pretext call that located Boyer is not a relic. Obtaining information from people by presenting a false or misleading identity remains the most reliable way to confirm an address that automated lookups have already narrowed to a short list. A small business owner whose name and city appear in a license database, whose phone number is on their booking profile, and whose photo is on their website has already provided the input. A single confirmation call, to a neighbor, a supplier, or a neighboring business, can resolve the home address behind the commercial one.
The New Hampshire Supreme Court ruling established legal accountability for one company in one state in 2003. The commercial data market now encompasses thousands of data broker companies, aggregators, and lookup services operating across jurisdictions with varying and often nonexistent regulations. The volume of records available has grown by orders of magnitude. The cost per lookup has fallen. The speed of profile assembly has accelerated.
The small business owner operating a legitimate licensed service today is not in a meaningfully different position than Amy Boyer's employer was in 1999. The business is registered. The records are public. The data brokers have them. The lookup services sell them. The gap between a name in a database and a physical address at a specific time of day is narrower than most small business owners understand, and it does not require technical knowledge to close.
What the Amy Boyer case proved, and what the court confirmed, is that the commercial data industry treats harm as an externality. The company that sold Youens the address did not plan for murder. It planned for profit. The harm was foreseeable and the company was found liable. That liability finding did not restructure the market. The market absorbed the precedent and continued operating.
The small business owner who has never examined where their address lives, which systems hold it, and how many separate paths lead back to their physical location is in the same position Boyer's employer was in. Not because they failed. Because the question was never put to them.
Source: Remsburg v. Docusearch, Inc., 149 N.H. 148 (2003). New Hampshire Supreme Court.
What does a small business owner's public presence actually expose about where they live, and how many separate records does it take to map that into a confirmed location?