[House Hearing, 108 Congress]
[From the U.S. Government Publishing Office]
USE AND MISUSE OF SOCIAL SECURITY NUMBERS
=======================================================================
HEARING
before the
SUBCOMMITTEE ON SOCIAL SECURITY
of the
COMMITTEE ON WAYS AND MEANS
U.S. HOUSE OF REPRESENTATIVES
ONE HUNDRED EIGHTH CONGRESS
FIRST SESSION
__________
JULY 10, 2003
__________
Serial No. 108-35
__________
Printed for the use of the Committee on Ways and Means
U.S. GOVERNMENT PRINTING OFFICE
93-570 WASHINGTON : 2004
_____________________________________________________________________
For sale by the Superintendent of Documents, U.S. Government Printing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800
Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001
COMMITTEE ON WAYS AND MEANS
BILL THOMAS, California, Chairman
PHILIP M. CRANE, Illinois CHARLES B. RANGEL, New York
E. CLAY SHAW, JR., Florida FORTNEY PETE STARK, California
NANCY L. JOHNSON, Connecticut ROBERT T. MATSUI, California
AMO HOUGHTON, New York SANDER M. LEVIN, Michigan
WALLY HERGER, California BENJAMIN L. CARDIN, Maryland
JIM MCCRERY, Louisiana JIM MCDERMOTT, Washington
DAVE CAMP, Michigan GERALD D. KLECZKA, Wisconsin
JIM RAMSTAD, Minnesota JOHN LEWIS, Georgia
JIM NUSSLE, Iowa RICHARD E. NEAL, Massachusetts
SAM JOHNSON, Texas MICHAEL R. MCNULTY, New York
JENNIFER DUNN, Washington WILLIAM J. JEFFERSON, Louisiana
MAC COLLINS, Georgia JOHN S. TANNER, Tennessee
ROB PORTMAN, Ohio XAVIER BECERRA, California
PHIL ENGLISH, Pennsylvania LLOYD DOGGETT, Texas
J.D. HAYWORTH, Arizona EARL POMEROY, North Dakota
JERRY WELLER, Illinois MAX SANDLIN, Texas
KENNY C. HULSHOF, Missouri STEPHANIE TUBBS JONES, Ohio
SCOTT MCINNIS, Colorado
RON LEWIS, Kentucky
MARK FOLEY, Florida
KEVIN BRADY, Texas
PAUL RYAN, Wisconsin
ERIC CANTOR, Virginia
Allison H. Giles, Chief of Staff
Janice Mays, Minority Chief Counsel
______
SUBCOMMITTEE ON SOCIAL SECURITY
E. CLAY SHAW, JR., Florida, Chairman
SAM JOHNSON, Texas ROBERT T. MATSUI, California
MAC COLLINS, Georgia BENJAMIN L. CARDIN, Maryland
J.D. HAYWORTH, Arizona EARL POMEROY, North Dakota
KENNY C. HULSHOF, Missouri XAVIER BECERRA, California
RON LEWIS, Kentucky STEPHANIE TUBBS JONES, Ohio
KEVIN BRADY, Texas
PAUL RYAN, Wisconsin
Pursuant to clause 2(e)(4) of Rule XI of the Rules of the House, public
hearing records of the Committee on Ways and Means are also published
in electronic form. The printed hearing record remains the official
version. Because electronic submissions are used to prepare both
printed and electronic versions of the hearing record, the process of
converting between various electronic formats may introduce
unintentional errors or omissions. Such occurrences are inherent in the
current publication process and should diminish as the process is
further refined.
C O N T E N T S
__________
Page
Advisories announcing the hearing................................ 2
WITNESSES
U.S. General Accounting Office, Barbara D. Bovbjerg, Director,
Education, Workforce, and Income Security Issues; accompanied
by Dan Bertoni, Deputy Director................................ 7
Social Security Administration, Hon. James G. Huse, Jr.,
Inspector General.............................................. 18
______
Electronic Privacy Information Center, Chris Jay Hoofnagle....... 51
Georgia Bureau of Investigations, InfraGard Atlanta Chapter Watch
and Warn Committee, Georgia's Stop Identity Theft Network,
National White Collar Crime Center, and Financial Crimes
Enforcement Network, Steve Edwards............................. 60
Identity Theft Resource Center, Theodore Wern.................... 38
SUBMISSIONS FOR THE RECORD
American Benefits Council; American Society of Pension Actuaries,
Arlington, VA; College and University Professional Association
for Human Resources, Knoxville, TN; ERISA Industry Committee;
Financial Executives International's Committee on Benefits
Finance, Florham Park, NJ; National Association of State
Retirement Administrators, Baton Rouge, LA; National Council on
Teacher Retirement, Sacramento, CA; National Rural Electric
Cooperative Association, Arlington, VA; Profit Sharing/401(k)
Council of America, Chicago, IL; joint letter and attachment... 72
Consumer Data Industry Association, Stuart K. Pratt, statement
and attachment................................................. 75
Hooley, Hon. Darlene, a Representative in Congress from the State
of Oregon, statement........................................... 80
Sandlin, Hon. Max, a Representative in Congress from the State of
Texas, statement............................................... 80
USE AND MISUSE OF SOCIAL SECURITY NUMBERS
----------
THURSDAY, JULY 10, 2003
U.S. House of Representatives,
Committee on Ways and Means,
Subcommittee on Social Security,
Washington, DC.
The Subcommittee met, pursuant to notice, at 1:18 p.m., in
room B-318, Rayburn House Office Building, Hon. E. Clay Shaw,
Jr. (Chairman of the Subcommittee) presiding.
[The advisory and revised advisory announcing the hearing
follow:]
ADVISORY
FROM THE
COMMITTEE
ON WAYS
AND
MEANS
SUBCOMMITTEE ON SOCIAL SECURITY
CONTACT: (202) 225-1721
FOR IMMEDIATE RELEASE
July 02, 2003
SS-3
Shaw Announces Hearing on
Use and Misuse of Social Security Numbers
Congressman E. Clay Shaw, Jr. (R-FL), Chairman, Subcommittee on
Social Security of the Committee on Ways and Means, today announced
that the Subcommittee will hold a hearing on both the use and misuse of
Social Security numbers. The hearing will take place on Thursday, July
10, 2003, in room B-318 Rayburn House Office Building, beginning at
10:00 a.m.
In view of the limited time available to hear witnesses, oral
testimony at this hearing will be from invited witnesses only. However,
any individual or organization not scheduled for an oral appearance may
submit a written statement for consideration by the Committee and for
inclusion in the printed record of the hearing.
BACKGROUND:
The Social Security number (SSN) was originally created in 1936 to
track workers' earnings for benefit purposes. Use of the SSN by both
government agencies and the private sector has exploded over the
decades as automation of record keeping and other business processes
encouraged use of this simple, unique number that virtually every
American possesses. As a result, many have called it a de facto
national identifier, though it was never intended as such.
Today, even the most routine transactions may involve sharing of
SSNs. Banks, schools, stores, and other businesses often use SSNs as
account numbers. The SSN is used to help compile information from many
different public and private sources for use in everything from
tracking down criminals to issuing credit. Additionally, SSNs are
easily found on display to the general public on employee badges,
licenses, or court documents. In short, SSNs are the key to an
individual's financial and other personal information, but their
confidentiality is not well protected.
Use of the SSN as a personal identifier has produced some
beneficial results for the public, including reduction in government
waste from program fraud, enhanced collection of child support, and
better law enforcement. Unfortunately, widespread utilization and
public exposure of SSNs have also made them an invaluable tool for
identity thieves. According to the Identity Theft Resource Center, an
estimated 700,000 people of all ages, races, and economic backgrounds
were victims of identity theft last year. The harm inflicted can be
devastating difficulty obtaining credit, harassment by debt collectors,
or even arrest because of the crimes of the identity thief. Worse yet,
according to the Federal Bureau of Investigation, terrorists have
utilized Social Security number fraud and identity theft to obtain
employment, access secure locations, and finance their activities all
of which threaten our national security.
The Social Security Administration (SSA) serves as the front line
of defense in ensuring SSN integrity. It is responsible for accurately
assigning SSNs and ensuring the wages earned and Social Security
benefits claimed on that number are only those of the number holder.
The SSA's Inspector General (IG) has long criticized the agency's
failure to verify the authenticity of identification documents, and
last year SSA began verifying supporting immigration records before
issuing SSN cards. In addition, despite the agencies efforts to reduce
wage-reporting discrepancies--including outreach to employers 2 to 3
percent of wage items, equaling about $50 billion, will remain
unmatched after wage processing is complete, according to the SSA.
In announcing the hearing, Chairman Shaw stated: ``The Social
Security number was originally intended to ensure American's hard-
earned wages were properly credited to their record, so that they could
receive their due benefits at retirement. Today, however, use and
misuse of these numbers is rampant. The Federal Government requires the
use of Social Security numbers and, therefore, has the responsibility
to ensure they are assigned accurately, exchanged only when necessary,
and protected from indiscriminant disclosure. We must stem the tide of
attacks on Social Security number privacy. As in previous Congresses, I
remain committed to pursuing bipartisan legislation to protect the
privacy and integrity of Social Security numbers.''
FOCUS OF THE HEARING:
The Subcommittee will examine the widespread use and misuse of the
SSN in the public and private sectors and the effects of such use and
misuse, as well as the integrity of the SSA's Social Security number
issuance and wage crediting process.
DETAILS FOR SUBMISSION OF WRITTEN COMMENTS:
Please Note: Due to the change in House mail policy, any person or
organization wishing to submit a written statement for the printed
record of the hearing should send it electronically to
[email protected], along with a fax copy to
(202) 225-2610, by the close of business, Thursday, July 24, 2003.
Those filing written statements who wish to have their statements
distributed to the press and interested public at the hearing should
deliver their 200 copies to the Subcommittee on Social Security in room
B-316 Rayburn House Office Building, in an open and searchable package
48 hours before the hearing. The U.S. Capitol Police will refuse
sealed-packaged deliveries to all House Office Buildings.
FORMATTING REQUIREMENTS:
Each statement presented for printing to the Committee by a
witness, any written statement or exhibit submitted for the printed
record or any written comments in response to a request for written
comments must conform to the guidelines listed below. Any statement or
exhibit not in compliance with these guidelines will not be printed,
but will be maintained in the Committee files for review and use by the
Committee.
1. Due to the change in House mail policy, all statements and any
accompanying exhibits for printing must be submitted electronically to
[email protected], along with a fax copy to
(202) 225-2610, in WordPerfect or MS Word format and MUST NOT exceed a
total of 10 pages including attachments. Witnesses are advised that the
Committee will rely on electronic submissions for printing the official
hearing record.
2. Copies of whole documents submitted as exhibit material will not
be accepted for printing. Instead, exhibit material should be
referenced and quoted or paraphrased. All exhibit material not meeting
these specifications will be maintained in the Committee files for
review and use by the Committee.
3. Any statements must include a list of all clients, persons, or
organizations on whose behalf the witness appears. A supplemental sheet
must accompany each statement listing the name, company, address,
telephone and fax numbers of each witness.
Note: All Committee advisories and news releases are available on
the World Wide Web at http://waysandmeans.house.gov.
The Committee seeks to make its facilities accessible to persons
with disabilities. If you are in need of special accommodations, please
call 202-225-1721 or 202-226-3411 TTD/TTY in advance of the event (four
business days notice is requested). Questions with regard to special
accommodation needs in general (including availability of Committee
materials in alternative formats) may be directed to the Committee as
noted above.
* * * NOTICE--CHANGE IN TIME * * *
ADVISORY
FROM THE
COMMITTEE
ON WAYS
AND
MEANS
SUBCOMMITTEE ON SOCIAL SECURITY
CONTACT: (202) 225-1721
FOR IMMEDIATE RELEASE
July 08, 2003
SS-3 Revised
Change in Time for Hearing on
Use and Misuse of Social Security Numbers
Congressman E. Clay Shaw, Jr. (R-FL), Chairman, Subcommittee on
Social Security of the Committee on Ways and Means, today announced
that the Subcommittee hearing on use and misuse of Social Security
numbers, previously scheduled for Thursday, July 10, 2003, at 10:00
a.m., in room B-318 Rayburn House Office Building, will now be held at
1:00 p.m. or immediately following the completion of the full Committee
informal mark up of the Singapore and Chilean Free Trade Agreements.
All other details for the hearing remain the same. (See
Subcommittee Advisory No. SS-3, dated July 3, 2003).
Chairman SHAW. I am sorry. We are a few minutes late
starting, but we had a busy morning with our Committee. Good
afternoon. Today, the Subcommittee will examine the use and
misuse of Social Security Numbers (SSNs). Using the SSN as a
personal identifier has proven both a blessing and a curse. On
one hand, the public is served when governmental agencies can
use the number in matching information from other sources to
reduce program waste, fraud and abuse, or when law enforcement
agencies employ SSNs to help track down criminals or deadbeat
dads. On the other hand, easy access to these numbers and their
widespread use has provided a new tool for identity thieves.
Worse yet, terrorists use SSN fraud and identity theft to
assimilate themselves into our society, as did those
responsible for the September 11th attacks. Identity theft
continues to threaten our national security. Identity theft is
the fastest growing white collar crime, and no one is immune,
but the public is increasingly recognizing the vulnerabilities
of SSNs and is working to protect them. Businesses are taking
steps on their own to move away from using SSNs and several
States have passed legislation, including Texas just last week,
to protect SSNs from public display.
The Social Security Administration (SSA) serves as the
front line of defense in ensuring the integrity of SSNs from
the moment they are issued throughout the number holder's
lifetime and even after his or her death, a responsibility the
SSA takes very seriously. It is also responsible for ensuring
the wages earned and Social Security benefits claimed on that
number are only those of the number holder. As our witnesses
will tell us, while the agency has taken steps to improve the
number assignment process, there is still more to do to prevent
people from fraudulently obtaining and using SSNs. However,
protecting the privacy and accuracy of SSNs is not the SSA's
responsibility alone. Employers and individuals have a
responsibility for submitting correct information to the SSA or
correcting erroneous information. The Internal Revenue Service
(IRS) has responsibility for imposing appropriate penalties on
employers who submit erroneous wage reports to the SSA. The
Bureau of Citizenship and Immigration Services must better
coordinate with the SSA in verifying eligibility for a SSN and
acting on information regarding earnings reported to nonwork
numbers. Lastly, every public agency that uses and shares SSNs
has the responsibility to protect their privacy.
The Subcommittee has been working on a bipartisan basis to
protect the privacy of SSNs and prevent identity theft since
the 106th Congress, when it first approved the Social Security
Number Privacy and Identity Theft Prevention Act of 2000 (H.R.
4857). In the 107th Congress I, along with Ranking Member
Matsui and 80 other Members of Congress, reintroduced a similar
bill. Mr. Kleczka, of our full Committee, has also been very
active in this regard. Consideration of this legislation was
rightly preempted by necessary congressional response to 9/11
attacks. In coming days, Mr. Matsui and I will again introduce
bipartisan legislation to restrict the sale and public display
of SSNs, establish penalties for violations, limit
dissemination of SSNs by credit reporting agencies, make it
more difficult for businesses to deny services if a customer
refuses to provide their SSN, and improve the integrity of the
SSN assignment process. Congress must act this session to
protect the very number it requires each of us to obtain and
use throughout our lifetime. Providing for uses of SSNs that
benefit the public while protecting these numbers from being
used by criminals or even terrorists is a complex balancing
act, as we found out in previous Congresses. We can make
significant progress toward this goal by ensuring SSNs are
assigned accurately, exchanged only when necessary, and
protected from indiscriminate disclosure. I look forward to
hearing from each of our witnesses, and thank them in advance
for sharing with us their experiences and their
recommendations. I understand Mr. Matsui is otherwise engaged
this afternoon, and he has asked Mr. Cardin to sit in for him.
The gentleman from Maryland.
[The opening statement of Chairman Shaw follows:]
Opening Statement of the Honorable E. Clay Shaw, Jr., Chairman, and a
Representative in Congress from the State of Florida
Good afternoon. Today, the Subcommittee will examine the use and
misuse of Social Security numbers.
Using the Social Security number as a personal identifier has
proved both a blessing and a curse. On one hand, the public is served
when government agencies can use the number in matching information
from other sources to reduce program waste, fraud and abuse, or when
law enforcement agencies employ Social Security numbers to help track
down criminals or deadbeat dads. On the other hand, easy access to
these numbers and their widespread use has provided a new tool for
identity thieves. Worse yet, terrorists use Social Security number
fraud and identity theft to assimilate themselves into our society, as
did those responsible for the September 11th attacks. Identity theft
continues to threaten our national security.
Identity theft is the fastest growing white collar crime, and no
one is immune. But the public is increasingly recognizing the
vulnerabilities of Social Security numbers and is working to protect
them. Businesses are taking steps on their own to move away from using
Social Security numbers, and several States have passed legislation,
including Texas just last week, to protect SSNs from public display.
The Social Security Administration serves as the front line of
defense in ensuring the integrity of Social Security numbers from the
moment they are issued, throughout the number-holder's lifetime, and
even after his or her death--a responsibility the SSA takes very
seriously. It is also responsible for ensuring the wages earned and
Social Security benefits claimed on that number are only those of the
number-holder. As our witnesses will tell us, while the agency has
taken steps to improve the number assignment process, there is still
more to do to prevent people from fraudulently obtaining and using
Social Security numbers.
However, protecting the privacy and the accuracy of Social Security
numbers is not the Social Security Administration's responsibility
alone. Employers and individuals have a responsibility for submitting
correct information to the Social Security Administration, or
correcting erroneous information. The Internal Revenue Service has
responsibility for imposing appropriate penalties on employers who
submit erroneous wage reports to the Social Security Administration.
The Bureau of Citizenship and Immigration Services must better
coordinate with the Social Security Administration in verifying
eligibility for a Social Security number and acting on information
regarding earnings reported to non-work numbers. Lastly, every public
agency that uses and shares Social Security numbers has the
responsibility to protect their privacy.
This Subcommittee has been working on a bipartisan basis to protect
the privacy of Social Security numbers and prevent identity theft since
the 106th Congress when it first approved the Social Security Number
Privacy and Identity Theft Prevention Act of 2000. In the 107th
Congress, I, along with Ranking Member Matsui and 80 other Members of
Congress reintroduced a similar bill. Consideration of this legislation
was rightly preempted by necessary Congressional response to the
September 11th attacks.
In coming days, Mr. Matsui and I will again introduce bipartisan
legislation to restrict the sale and public display of Social Security
numbers, establish penalties for violations, limit dissemination of
Social Security numbers by credit reporting agencies, make it more
difficult for businesses to deny services if a customer refuses to
provide their Social Security number, and improve the integrity of the
Social Security number assignment process. Congress must act this
session to protect the very number it requires each of us to obtain and
use throughout our lifetime.
Providing for uses of Social Security numbers that benefit the
public while protecting these numbers from being used by criminals, or
even terrorists, is a complex balancing act. We can make significant
progress toward this goal by ensuring Social Security numbers are
assigned accurately, exchanged only when necessary, and protected from
indiscriminant disclosure.
I look forward to hearing from each of our witnesses, and thank
them in advance for sharing with us their experiences and their
recommendations.
Mr. CARDIN. Thank you, Chairman Shaw. Let me thank you for
holding this hearing. I also want to thank you for your
leadership on this very important issue. I also want to
acknowledge Mr. Matsui and Mr. Kleczka for the work they have
done on identity fraud and the use of SSNs. Mr. Chairman, it is
noteworthy to point out this is our ninth hearing on this
subject, and it is a commitment that we have to take action in
this area. As you pointed out, identity theft is considered one
of the fastest growing crimes in the United States, with an
average of an estimated 700,000 people being affected last
year. It can ruin an individual's good name and destroy their
credit rating. It even has affected the credit ratings of their
young children. While credit issuers have been willing to
refund fraudulent charges, victims are still faced with the
effects of poor credit, the time commitments of restoring their
ratings with multiple credit bureaus and credit issuers and the
fear and anxiety associated with knowing someone is using their
personal information to charge goods and services.
As a result of identity theft, victims have been turned
down for jobs, mortgages and other important extensions of
credit. So, therefore this is a very important subject, and we
need to take action. As you pointed out, it even goes beyond
the immediate problems of individuals that have found that the
criminal elements, including terrorists, have used the identity
of other people through SSNs in order to carry out their
activities. We have a dilemma, the SSN is basically a national
identifier. We have used it. We can't guarantee the
confidentiality of that number, and therefore it can be used
for identity theft. I am looking forward to the testimony from
the U.S. General Accounting Office (GAO) and the Inspector
General, who have been extremely helpful to us in coming
forward with suggestions on how we can protect the
confidentiality or use of the SSNs and how we can protect
against identity theft. The bottom line is we need to take
action in this area. The Chairman has indicated that he will be
filing legislation shortly with Mr. Matsui. I can assure you we
want to move forward as quickly as possible in a bipartisan way
in order to try to help our people against this growing element
of crime. Thank you, Mr. Chairman.
Chairman SHAW. Thank you, Mr. Cardin. I would like to just
point out I think that we share jurisdiction with two other
committees with regard to this legislation. Our Committee has
moved forward in the past but we need to bring the other
committees along with us in order to have a complete
comprehensive bill rather than just picking and choosing the
small portions of which our Committee has jurisdiction. Any
other Members have an opening statement? The record will remain
open. Without objection, they will be included in the
transcript. On our first panel are two old friends of this
Committee, Barbara Bovbjerg, who is the Director of Education,
Workforce, and Income Security Issues from the GAO, and she is
accompanied by Dan Bertoni, I believe that is the correct
pronunciation, who is the Deputy Director. From the SSA, we
have the Honorable James Huse, who is the Inspector General. As
you all well know, we have your full statement which will be
made a part of the record. We invite you to summarize as you
see fit. Ms. Bovbjerg.
STATEMENT OF BARBARA D. BOVBJERG, DIRECTOR, EDUCATION,
WORKFORCE, AND INCOME SECURITY ISSUES, U.S. GENERAL ACCOUNTING
OFFICE; ACCOMPANIED BY DAN BERTONI, DEPUTY DIRECTOR
Ms. BOVBJERG. Thank you, Mr. Chairman, and Members of the
Subcommittee. I am pleased to be here again today--I don't
think it has been nine times for me, but it has been a number--
to discuss issues associated with the integrity and use of the
SSN. Although the SSN was originally created as a means to
track workers' earnings and their eligibility for Social
Security benefits, today the number is used for many non-Social
Security purposes in both the public and private sectors. The
wide use of SSNs causes concern because these numbers are among
the personal identifiers most often sought by identity thieves.
Today, I will present results of our completed and ongoing work
on a variety of issues associated with the SSN. I would like to
focus first on public and private sector use of the SSN and
then, second, on the role of the SSA in preventing the
proliferation of false identities. My testimony is based on a
report we did for this Subcommittee on government uses of the
SSN and on ongoing work that focuses on private sector uses and
on SSA's role in assigning SSNs and verifying them for others.
I have so much material today that is relevant to this hearing
and some visual aids to illustrate my points, I would ask to
speak longer than the usual 5 minutes. I hope that will be
acceptable to the Subcommittee. I will try not to prey on your
good nature for very much longer.
Let me speak first about public and private uses. We
reported last year that Federal, State, and county agencies
rely extensively on the SSN. Although government agencies told
us of various steps they take to safeguard the SSNs they use,
we found that key protections are not uniformly in place at any
level of government. We also found that some Federal agencies
and many of the State and county agencies we surveyed,
including courts in all the three levels of government,
maintain public records that contain SSNs. Public records are
documents routinely made available to the public for inspection
such as marriage licenses or property transactions. For
customer service reasons, some public officials told us they
were considering making such records available on their
websites. Because such actions would create new opportunities
for identity thieves to gather SSNs from public records on a
broad scale, we are beginning work for this Subcommittee to
examine the extent to which SSNs in public records are already
accessible on the Internet. Although we are not far along
enough in this work to report the results today, I can assure
you that we have already found SSNs in several public websites.
With regard to the private sector, we are finding that
companies too are increasingly using SSNs, often collecting
them from customers as a condition for providing service. For
example, consumer reporting agencies (CRAs) build and maintain
credit histories around an individuals' name, address, and SSN.
The CRAs obtain SSNs from individuals who seek credit and from
information resellers and public records. Some businesses
aggregate information, including SSNs, from various public and
private sources for resale. They obtain data from public
records like bankruptcy proceedings, tax liens, and voter
registration rolls--and from private compilations like
telephone directories. These businesses combine and resell this
information to a variety of customers. The ones we contacted
told us that to comply with current law they generally limit
their services to customers who establish accounts with them
and with whom they have contracts that restrict the extent to
which the data purchased can be redisclosed.
Despite protections such as these, large databases of
information still represent a vulnerability for Americans. In
the course of our work we have identified numerous instances in
which the public and private databases have been compromised
and personal data, including SSNs, stolen. Such cases
illustrate the vulnerability of these databases to criminal
misuse. Let me turn now to the role of the SSA in preventing
the proliferation of false identities. This Subcommittee asked
us to examine two aspects of the SSA role: SSA's assignment of
new SSNs, a process called enumeration, and SSA's verification
of SSNs for State driver's licensing agencies. Our review of
SSA's enumeration process found that SSA has begun to implement
important new policies and procedures to prevent the
inappropriate assignment of SSNs to noncitizens. For example,
SSA has required staff to verify identity information and
immigration status with the U.S. Department of State and the
U.S. Department of Homeland Security prior to issuing an SSN.
The SSA has also begun implementation of a program called
Enumeration at Entry, where an applicant's information is
vetted by the Department of Homeland Security and the
Department of State before the applicants enter the United
States. In addition, the SSA has created a special center in
Brooklyn, New York to focus solely on enumeration and
verification.
These three initiatives all hold promise of improved
enumeration accuracy. However, the enumeration process overall
still has vulnerabilities that could result in fraudulent use
of Social Security cards and SSNs. I am speaking specifically
of replacement Social Security cards and policies regarding
SSNs for children under the age of 1. Let me turn to those now.
As to replacement cards, SSA policy currently allows
individuals to obtain up to 52 replacement cards a year. That
is one a week. Of the 18 million cards SSA issued last year,
12.4 million, or almost 70 percent, were replacements. While
SSA requires noncitizens to provide the same identity and
immigration information that they need to obtain an original
card when they get a replacement, citizens can use things like
health insurance cards or church memberships when they apply
for replacements. The ease of obtaining replacements creates
the potential that these cards can be accumulated and sold to
those not eligible for their own cards. This is an obvious
vulnerability that should be better controlled.
With regard to enumerating young children, although SSA
revised its policies to require that field staff obtain
verification of birth records for most U.S.-born individuals
applying for enumeration, agency policy requires only visual
inspection of a birth certificate for children under the age of
1. Although such visual inspection can identify false
documents, and indeed we found an instance where an alert
Social Security field office staff member did identify a false
birth certificate, we were able ourselves to create false
documents and enumerate two nonexistent infants; the documents
we used to do this are shown in the exhibit on your right. It
is the left board, and I believe you have that in your packets
in front of you. We have full names and other identifying
information blacked out for security reasons. To support our
applications for these cards, we used fake documents that you
see on the left under the heading, ``counterfeit documents.''
We used birth certificates and certificates of baptism for both
of the applications we made. In one we used an employer
identification card. In the other we also used a State driver's
license to provide identification for the so-called parents who
were applying for this infant's card. We created these
documents with inexpensive, commercially-available software.
You see the results on the right. We received one card already,
and the written assurance below is that the other card is in
the mail. After receiving these cards for children who do not
exist we could have passed them to someone who is not eligible
for a SSN. We wouldn't do that, but it is a clear vulnerability
that SSA needs to address.
Let me now move on to SSA's verification of information for
State driver's licensing agencies. Since driver's licenses are
a widely accepted form of identification, the agencies that
issue such licenses can be focal points for identity fraud. The
SSA has a verification service in place that allows State
agencies to verify the name, date of birth, and SSN of driver's
license applicants. In our work for this Subcommittee and the
House Judiciary Committee, we have found that 25 States have
used the SSA service, but they have not all used it regularly.
Most of them use the online verification method, but a few use
only the batch method, which takes longer but costs less to
use. States that don't use either verification method told us
they were concerned about start-up costs and system
performance. Indeed, there are 10 States awaiting improvement
to the online verification system's capacity before they can be
allowed to use it. Others already using the system have scaled
back their use because of capacity problems.
In addition to the capacity problems the system has
experienced, we also identified a key weakness in the batch
method that exposes States to a higher risk of fraud. Unlike
the online method, batch does not match verification requests
against SSA's death records. As a result, the batch method will
verify the name and SSN of a dead person as an accurate record.
We observed this ourselves and again we have prepared a visual
to illustrate--the one on the right. Our undercover
investigators were able to obtain licenses in two States that
use the batch verification method. We presented counterfeit
identity documents that contain the name, data of birth, and
SSN of a dead person to motor vehicle agencies in these States.
In one instance, you can see we presented a fake birth
certificate, a military identification, and a Social Security
card. In another, we presented only the fake Social Security
card and a fake driver's license from another State. In both
instances, we received the driver's licenses you see before you
on the right. The ease with which our staff were able to obtain
these licenses suggests that the batch method must change and
must change immediately to protect the State driver's licensing
system. Our report on this topic will be issued in September
and is likely to contain recommendations to improve SSA's
verification systems, both online and batch.
In conclusion, let me say that SSNs are used for many
beneficial purposes, but as we all know SSNs are also used for
illegal financial gain and for immigration fraud. While most
uses are for the benefit of the taxpayer and to ease the
provision of various services such as granting credit, this
personal information is not always adequately protected.
Further, those who would live in the United States illegally
have sought not just stolen SSNs, but their own Social Security
cards and driver's licenses--fraudulently obtained, of course.
The SSA has an important role to play both in limiting the
issuance of SSNs only to those who are eligible to have them
and to verifying personal information for State driver's
licensing agencies. While progress is being made on both these
fronts, we have demonstrated the vulnerabilities that remain.
We look forward to continuing work with this Subcommittee to
strengthen needed protections to ensure that false identities
are not readily available to those who would harm the United
States and its people. That concludes my statement, Mr.
Chairman. I really appreciate the extra time, and I am here to
answer any questions.
[The prepared statement of Ms. Bovbjerg follows:]
Statement of Barbara D. Bovbjerg, Director, Education, Workforce, and
Income Security Issues, U.S. General Accounting Office; accompanied by
Dan Bertoni, Deputy Director
Mr. Chairman and Members of the Subcommittee:
I am pleased to be here today to discuss ways to better protect
Social Security Numbers (SSNs) to help prevent the proliferation of
false identities whether for financial misuse or for assuming an
individual's identity. Although the Social Security Administration
(SSA) originally created SSNs as a means to track worker's earnings and
eligibility for Social Security benefits, over time the SSN has come to
be used for a myriad of purposes. As you know, SSNs are a key piece of
information in creating false identities. Allegations of SSN misuse
include, for example, incidents where a criminal uses the SSN of
another individual for the purpose of fraudulently obtaining credit,
acquiring goods, violating immigration laws, or fleeing the criminal
justice system.
Although Congress has passed a number of laws to protect the
security of personal information, the continued use of and reliance on
SSNs by private and public sector entities and the potential for misuse
underscores the importance of identifying areas that can be further
strengthened. Accordingly, you asked us to talk about the uses of SSNs
and ways that the integrity of the SSN may be preserved. My remarks
today will focus on describing (1) public and private sector use and
display of SSNs, and (2) SSA's role in preventing the proliferation of
false identities. My testimony is based on a report we did for this
subcommittee on government uses of the SSN,\1\ ongoing work that
focuses on private sector SSN uses, and work we are completing on SSA's
enumeration process and the agency's verification of SSNs for state
driver licensing.
---------------------------------------------------------------------------
\1\ U.S. General Accounting Office, Social Security Numbers:
Government Benefits from SSN Use but Could Provide Better Safeguards,
GAO-02-352 (Washington D.C.: May 31, 2002).
---------------------------------------------------------------------------
In summary, public and some private sector entities rely
extensively on SSNs. We reported last year that federal, state and
county government agencies rely extensively on the SSN to manage
records, verify eligibility of benefit applicants, collect outstanding
debt, and conduct research and program evaluations. SSNs are also
displayed on a number of public record documents that are routinely
made available to the public. To improve customer service, some state
and local government entities are considering placing more public
records on the Internet. In addition, some private sector entities have
come to rely on the SSN as an identifier, using it and other
information to accumulate information about individuals. This is
particularly true of entities that amass public and private data,
including SSNs, for resale. Certain laws have helped to restrict the
use of SSN and other information by these private sector entities to
specific purposes. However, as a result of the increased use and
availability of SSN information and other data, more and more personal
information is being centralized into various corporate and public
databases. Because SSNs are often the identifier of choice among
individuals seeking to create false identities, to the extent that
personal information is aggregated in public and private sector
databases it becomes vulnerable to misuse.
As the agency responsible for issuing SSNs and maintaining the
earnings records and other personal information for millions of SSN
holders, SSA plays a unique role in helping to prevent the
proliferation of false identities. Following the events of September
11, 2001, SSA formed a task force to address weaknesses in the
enumeration process and developed major new initiatives to prevent the
inappropriate assignment of SSNs to non-citizens, who represent the
bulk of new SSNs issued by SSA's 1,300 field offices. For example, SSA
now requires field staff to independently verify the identity
information and immigration status of all non-citizen applicants with
the Department of Homeland Security (DHS), prior to issuing an SSN.
However, some SSA field staff are relying exclusively on the DHS
verification system, while neglecting other standard practices for
visually inspecting documents. SSA's automated system for assigning
SSNs also does not prevent the issuance of an SSN if staff by-pass
required verification steps. Other areas remain vulnerable and could be
targeted by those seeking fraudulent SSNs. These include SSA's process
for assigning social security numbers for children under age one and
issuing replacement social security cards. In addition to its
enumeration process, SSA provides a service to states to verify the
SSNs of individuals seeking driver's licenses. We found that fewer than
half the states have used SSA's service and the extent to which they
regularly use the service varies widely across states. Factors such as
cost, problems with system reliability, and state priorities and
policies determine whether or not states use SSA's service. We also
identified a weakness in SSA's verification service that exposes some
states to fraud by those who would use the SSN of a deceased
individual.
BACKGROUND
The Social Security Act of 1935 authorized the Social Security
Administration to establish a recordkeeping system to help manage the
Social Security program, and resulted in the creation of the SSN.
Through a process known as ``enumeration,'' unique numbers are created
for every person as a work and retirement benefit record for the Social
Security program. Today, SSNs are generally issued to most U.S.
citizens and are also available to, non-citizens lawfully admitted to
the U.S. with permission to work. Lawfully admitted non-citizens may
also qualify for a SSN for nonwork purposes when a federal, state, or
local law requires an SSN to obtain a particular welfare benefit or
service. SSA is required to verify information from such applicants
regarding their age, identity, foreign citizenship, and immigration
status. Most of the agency's enumeration workload involves U.S.
citizens who generally receive SSNs via SSA's birth registration
process handled by hospitals. However, individuals seeking SSNs can
also apply in-person at any of SSA's field locations, through the mail,
or via the Internet.
The uniqueness and broad applicability of the SSN have made it the
identifier of choice for government agencies and private businesses,
both for compliance with federal requirements and for the agencies' and
businesses' own purposes. In addition, the boom in computer technology
over the past decades has prompted private businesses and government
agencies to rely on SSNs as a way to accumulate and identify
information for their databases. As such, SSNs are often the identifier
of choice among individuals seeking to create false identities. Law
enforcement officials and others consider the proliferation of false
identities to be one of the fastest growing crimes today. In 2002, the
Federal Trade Commission received 380,103 consumer fraud and identity
theft complaints, up from 139,007 in 2000.\2\ In 2002, consumers also
reported losses from fraud of more than $343 million. In addition,
identity crime accounts for over 80 percent of social security number
misuse allegations according to the SSA.
---------------------------------------------------------------------------
\2\ Identity theft records broken out of consumer fraud totaled per
year: 31,117 (2000), 86,198 (2001), and 161,819 (2002).
---------------------------------------------------------------------------
PUBLIC AND PRIVATE SECTOR USES AND DISPLAY OF SSNS
As we reported to you last year, federal, state, and county
government agencies use SSNs.\3\ When these entities administer
programs that deliver services and benefits to the public, they rely
extensively on the SSNs of those receiving the benefits and services.
Because SSNs are unique identifiers and do not change, the numbers
provide a convenient and efficient means of managing records. They are
also particularly useful for data sharing and data matching because
agencies can use them to check or compare their information quickly and
accurately with that from other agencies. In so doing, these agencies
can better ensure that they pay benefits or provide services only to
eligible individuals and can more readily recover delinquent debts
individuals may owe. In addition to using SSNs to deliver services or
benefits, agencies also use or share SSNs to conduct statistical
research and program evaluations. Moreover, most of the government
departments or agencies we surveyed use SSNs to varying extents to
perform some of their responsibilities as employers, such as paying
their employees and providing health and other insurance benefits.
---------------------------------------------------------------------------
\3\ U.S. General Accounting Office, Social Security Numbers:
Government Benefits from SSN Use but Could Provide Better Safeguards,
GAO-02-352 (Washington D.C.: May 2002).
---------------------------------------------------------------------------
Many of the government agencies we surveyed in our work last year
reported maintaining public records that contain SSNs. This is
particularly true at the state and county level where certain offices
such as state professional licensing agencies and county recorders'
offices have traditionally been repositories for public records that
may contain SSNs. These records chronicle the various life events and
other activities of individuals as they interact with the government,
such as birth certificates, professional licenses, and property title
transfers. Generally, state law governs whether and under what
circumstances these records are made available to the public, and they
vary from state to state. They may be made available for a number of
reasons, including the presumption that citizens need key information
to ensure that government is accountable to the people. Certain records
maintained by federal, state, and county courts are also routinely made
available to the public. In principle, these records are open to aid in
preserving the integrity of the judicial process and to enhance public
trust and confidence in the judicial process. At the federal level,
access to documents generally has its grounding in common law and
constitutional principles. In some cases, public access is also
required by statute, as is the case for papers filed in a bankruptcy
proceeding. As with federal courts, requirements regarding access to
state and local court records may have a state common law or
constitutional basis or may be based on state laws.
Although public records have traditionally been housed in
government offices and court buildings, to improve customer service,
some state and local government entities are considering placing more
public records on the Internet. Because such actions would create new
opportunities for gathering SSNs from public records on a broad scale,
we are beginning work for this subcommittee to examine the extent to
which SSNs in public records are already accessible via the Internet.
In our current work, we found that some private sector entities
also rely extensively on the SSN. Businesses often request an
individual's SSN in exchange for goods or services. For example, some
businesses use the SSN as a key identifier to assess credit risk, track
patient care among multiple providers, locate bankruptcy assets, and
provide background checks on new employees. In some cases, businesses
require individuals to submit their SSNs to comply with federal laws
such as the tax code. Currently, there is no law that prohibits
businesses from requiring a person's SSN as a condition of providing
goods and services. If an individual refuses to give his or her SSN to
a company or organization, they can be refused goods and services
unless the SSN is provided.
To build on previous work we did to determine certain private
sector entities use of SSNs, we have focused our initial private sector
work on information resellers and consumer reporting agencies
(CRAs).\4\ Some of these entities have come to rely on the SSN as an
identifier to accumulate information about individuals, which helps
them determine the identity of an individual for purposes such as
employment screening, credit information, and criminal histories. This
is particularly true of entities, known as information resellers, who
amass personal information, including SSNs. Information resellers often
compile information from various public and private sources.\5\ These
entities provide their products and services to a variety of customers,
although the larger ones generally limit their services to customers
that establish accounts with them, such as entities like law firms and
financial institutions. Other information resellers often make their
information available through the Internet to persons paying a fee to
access it.
---------------------------------------------------------------------------
\4\ U.S. General Accounting Office, Social Security: Government and
Commercial Use of the Social Security Number is Widespread, GAO/HEHS-
99-28 (Washington, D.C.: Feb. 16, 1999.)
\5\ The information compiled may include public records of
bankruptcy, tax liens, civil judgments, criminal histories, deaths,
real estate ownership, driving histories, voter registration, and
professional licenses. Private data sources include information from
telephone directories and copyrighted publications.
---------------------------------------------------------------------------
CRAs are also large private sector users of SSNs. These entities
often rely on SSNs, as well as individuals' names and addresses to
build and maintain credit histories. Businesses routinely report
consumers' financial transactions, such as charges, loans, and credit
repayments to CRAs. CRAs use SSNs to determine consumers' identities
and ensure that incoming consumer account data is matched correctly
with information already on file.
Certain laws such as the Fair Credit Reporting Act, the Gramm-
Leach-Bliley Act, and the Driver's Privacy Protection Act have helped
to limit the use of personal information, including SSNs, by
information resellers and CRAs. These laws limit the disclosure of
information by these entities to specific circumstances. In our
discussion with some of the larger information resellers and CRAs, we
were told that they have to take specific actions to adhere to these
laws, such as establishing contracts with their clients specifying that
the information they obtain will be used only for accepted purposes
under the law.
The extensive public and private sector uses of SSNs and
availability of public records and other information, especially via
the Internet, has allowed individuals' personal information to be
aggregated into multiple databases or centralized locations. In the
course of our work, we have identified numerous examples where public
and private databases have been compromised and personal data,
including SSNs, has been stolen. In some instances, the display of SSNs
in public records and easily accessible websites provided the
opportunity for identity thieves. In other instances, databases not
readily available to outsiders have had their security breached by
employees with access to key information. For example, in our current
work, we identified a case where two individuals obtained the names and
SSNs of 325 high-ranking United States military officers from a public
Website, then used those names and identities to apply for instant
credit at a leading computer company. Although criminals have not
accessed all public and private databases, such cases illustrate that
these databases are vulnerable to criminal misuse.
SSA HAS A ROLE IN PREVENTING SSNS FROM BEING USED TO CREATE FALSE
IDENTITIES BUT SOME AREAS REMAIN VULNERABLE
Because SSA is the issuer and custodian of SSN data, SSA has a
unique role in helping to prevent the proliferation of false
identities. Following the events of September 11, 2001, SSA began
taking steps to increase management attention on enumeration and formed
a task force to address weaknesses in the enumeration process. As a
result of this effort, SSA has developed major new initiatives to
prevent the inappropriate assignment of SSNs to non-citizens. However,
our preliminary findings to date identified some continued
vulnerabilities in the enumeration process including SSA's process for
issuing replacement Social Security cards and assigning SSNs to
children under age one. SSA is also increasingly called upon by states
to verify the identity of individuals seeking driver licenses. We found
that fewer than half the states have used SSA's service and the extent
to which they regularly use the service varies widely. Factors such as
costs, problems with system reliability, and state priorities have
affected states use of SSA's verification service. We also identified a
key weakness in the service that exposes some states to inadvertently
issuing licenses to individuals using the SSNs of deceased individuals.
We plan to issue reports on these issues in September that will likely
contain recommendations to improve SSA's enumeration process and its
SSN verification service.
SSA's Enumeration Process Helps Prevent the Proliferation of False
Identities, but Additional Actions are Needed to Safeguard the
Issuance of SSNs
SSA has increased document verifications and developed new
initiatives to prevent the inappropriate assignment of Social Security
numbers (SSNs) to non-citizens who represent the bulk of all initial
SSNs issued by SSA's 1,300 field offices. However, in some key areas,
weaknesses remain. SSA has increased document verifications by
requiring independent verification of the documents and immigration
status of all non-citizen applicants with the issuing agency--namely
the Department Homeland Security (DHS) and Department of State (State
Department) prior to issuing the SSN. However, in our audit work, we
found that many field offices are relying heavily on DHS's verification
service, while neglecting standard, in-house practices for visually
inspecting and verifying identity documents. We also found that while
SSA has made improvements to its automated system for assigning SSNs,
the system is not designed to prevent the issuance of an SSN if field
staff by-pass essential verification steps. SSA also has begun
requiring foreign students to show proof of their full-time enrollment,
but does not require field staff to verify with the school the
students' enrollment or their authorization to work. Consequently, SSNs
for non-citizen students may still be improperly issued.
SSA has also undertaken other new initiatives to shift the burden
of processing non-citizen applications from its field offices. SSA
recently piloted a specialized center in Brooklyn, New York, which
focuses exclusively on enumeration and utilizes the expertise of DHS
document examiners and SSA's OIG investigators. However, the future of
this pilot project and DHS' participation has not yet been determined.
Meanwhile, in late 2002, SSA began a phased implementation of a long-
term process to issue SSNs to non-citizens at the point of entry into
the United States, called ``Enumeration at Entry'' (EAE). EAE offers
the advantage of using State Department and DHS expertise to
authenticate information provided by applicants for subsequent
transmission to SSA who then issues the SSN. Currently, EAE is limited
to immigrants age 18 and older who have the option of applying for an
SSN at one of the 127 State posts worldwide that issue immigrant visas.
SSA has experienced problems with obtaining clean records from both the
State Department and DHS, but plans to continue expanding the program
over time to include other non-citizen groups, such as students and
temporary visitors. The agency also intends to evaluate the initial
phase of EAE in conjunction with the State Department and DHS. However,
this evaluation has not yet been planned or scheduled.
While SSA has embarked on these new initiatives, it has not
tightened controls in two key areas of its enumeration process that
could be exploited by individuals seeking fraudulent SSNs. One area is
the assignment of SSNs to children under age one. Prior work by SSA's
Inspector General identified the assignment of SSNs to children as an
area prone to fraud because SSA did not independently verify the
authenticity of various state birth certificates. Despite the training
and guidance provided to field office employees, the OIG found that the
quality of many counterfeit documents was often too good to detect
simply by visual inspection. Last year, SSA revised its policies to
require that field staff obtain independent third party verification of
the birth records for U.S.-born individuals age one and older from the
state or local bureau of vital statistics prior to issuing an SSN
card.\6\ However, SSA left in place its policy for children under age
one and continues to require only a visual inspection of documents,
such as birth records.
---------------------------------------------------------------------------
\6\ Most U.S.-born individuals receive a SSN through a process SSA
refers to as Enumeration-at-Birth (EAB). Under EAE parents can apply
for a SSN for their newborn child at the hospital as part of the birth
registration process. Under this process hospitals send birth
registration information to a state or local bureau of vital statistics
where it is put into a database. SSA accepts the data captured during
the birth registration process as evidence of age, identity, and
citizenship, and assigns the child an SSN without further parental
involvement. The appropriate bureau of vital statistics forwards SSA
the required information, usually by electronic means. Once SSA
receives the required information, it performs edits, assigns the SSN
and issues the card.
---------------------------------------------------------------------------
SSA's policies relating to enumerating children under age one
expose the agency to fraud. During our fieldwork, we found an example
of a non-citizen who submitted a counterfeit birth certificate in
support of an SSN application for a fictitious U.S. born child under
age one. In this case, the SSA field office employee identified the
counterfeit state birth certificate by comparing it with an authentic
one. However, SSA staff acknowledged that if a counterfeit out-of-state
birth certificate had been used, SSA would likely have issued the SSN
because of staff unfamiliarity with the specific features of the
numerous state birth certificates. Further, we were able to prove the
ease with which individuals can obtain SSNs by exploiting SSA's current
processes. Working in an undercover capacity our investigators were
able to obtain two SSNs. By posing as parents of newborns, they
obtained the first SSN by applying in-person at a SSA field office
using a counterfeit birth certificate and baptismal certificate. Using
similar documents, a second SSN was obtained by our investigators who
submitted all material via the mail. In both cases, SSA staff verified
our counterfeit documents as being valid. SSA officials told us that
they are re-evaluating their policy for enumerating children under age
one. However, they noted that parents often need an SSN for their child
soon after birth for various reasons such as for income tax purposes.
They acknowledge that a challenge facing the agency is to strike a
better balance between serving the needs of the public and ensuring SSN
integrity.
In addition to the assignment of SSNs to children under the age of
one, SSA's policy for replacing Social Security cards also increases
the potential for misuse of SSNs. SSA does not limit the number of
replacement cards individuals can receive. Of the 18 million cards
issued by SSA in FY2002, 12.4 million, or 69 percent, were replacement
cards. More than 1 million of these cards were issued to non-citizens.
In several of the field offices we visited, replacement cards
represented 70 percent of the total enumeration workload. While SSA
requires non-citizens applying for a replacement card to provide the
same identity and immigration information as if they were applying for
an original SSN, SSA's evidence requirements for citizens are much less
stringent. Citizens applying for a replacement card need not prove
their citizenship; they may use as proof of identity such documents as
a driver's license, passport, employee identification card, school
identification card, church membership or confirmation record, life
insurance policy, or health insurance card. The ability to obtain
numerous replacement SSN cards with less documentation creates a
condition for requestors to obtain SSNs for a wide range of illicit
uses including selling them to non-citizens. These cards can be sold to
individuals seeking to hide or create a new identity, perhaps for the
purpose of some illicit activity. SSA told us the agency is considering
limiting the number of replacement cards with certain exceptions such
as for name changes, administrative errors, and hardships. However,
they cautioned that while support exists for this change within the
agency, some advocacy groups oppose such a limit.
Field staff we interviewed told us that despite their reservations
regarding individuals seeking excessive numbers of replacement cards,
they were required under SSA policy to issue the cards. Many of the
field office staff and managers we spoke to acknowledged that the
current policy weakens the integrity of SSA's enumeration process.
SSA's Verification of Driver Licenses Applicants Helps Prevent
Fraudulent Documents, but Vulnerabilities Still Exist
The events of September 11th, 2001 focused attention on the
importance of identifying people who use false identity information or
documents, particularly in the driver licensing process. Driver
licenses are a widely accepted form of identification that individuals
frequently use to obtain services or benefits from federal and state
agencies, open a bank account, request credit, board an airplane, and
carry on other important activities of daily living. For this reason,
driver licensing agencies are points at which individuals may attempt
to fraudulently obtain a license using a false name, social security
number (SSN), or other documents such as birth certificates to secure
this key credential.
Given that most states collect SSNs during the licensing process,
SSA is uniquely positioned to help states verify the identity
information provided by applicants. To this end, SSA has a verification
service in place that allows state driver licensing agencies to verify
the SSN, name, and date of birth of customers with SSA's master file of
SSN owners. States can transmit requests for SSN verification in two
ways. One is by sending multiple requests together, called the
``batch'' method, to which SSA reports it generally responds within 48
hours. The other way is to send an individual request on-line, to which
SSA responds immediately.
Twenty-five states have used the batch or on-line method to verify
SSNs with SSA and the extent to which they use the service on a regular
basis varies. About three-fourths of the states that rely on SSA's
verification service used the on-line method or a combination of the
on-line and batch method, while the remaining states used the batch
method exclusively. Over the last several years, batch states estimated
submitting over 84 million batch requests to SSA compared to 13 million
requests submitted by on-line users. States' use of SSA's on-line
service has increased steadily over the last several years. However,
the extent of use has varied significantly, with 5 states submitting
over 70 percent of all on-line verification requests and one state
submitting about one-third of the total.
Various factors, such as costs, problems with system reliability,
and state priorities affect states' decisions regarding use of SSA's
verification service. In addition to the per-transaction fees that SSA
charges, states may incur additional costs to set up and use SSA's
service, including the cost for computer programming, equipment,
staffing, training, and so forth. Moreover, states' decisions about
whether to use SSA's service, or the extent to which to use it, are
also driven by internal policies, priorities, and other concerns. For
example, some of the states we visited have policies requiring their
driving licensing agencies to verify all customers' SSNs. Other states
may limit their use of the on-line method to certain targeted
populations, such as where fraud is suspected or for initial licenses,
but not for renewals of in-state licenses. The non-verifying states we
contacted expressed reluctance to use SSA's verification service based
on performance problems they had heard were encountered by other
states. Some states cited concerns about frequent outages and slowness
of the on-line system. Other states mentioned that the extra time to
verify and resolve SSN problems could increase customer waiting times
because a driver license would not be issued until verification was
complete.
Indeed, weaknesses in SSA's design and management of its SSN on-
line verification services have limited its usefulness and contributed
to capacity and performance problems. SSA used an available
infrastructure to set up the system and encountered capacity problems
that continued and worsened after the pilot phase. The capacity
problems inherent in the design of the on-line system have affected
state use of SSA's verification service. Officials in one state told us
that they have been forced to scale back their use of the system
because they were told by SSA that their volume of transactions were
overloading the system. In addition, because of issues related to
performance and reliability, no new states have used the service since
the summer of 2002. At the time of our review, 10 states had signed
agreements with SSA and were waiting to use the on-line system and 17
states had received funds from Department of Transportation for the
purpose of verifying SSNs with SSA. It is uncertain how many of the 17
states will ultimately opt to use SSA's on-line service. However, even
if they signed agreements with SSA today, they may not be able to use
the service until the backlog of waiting states is addressed. More
recently, SSA has made some necessary improvements to increase system
capacity and to refocus its attention to the day-to-day management of
the service. However, at the time of our review, the agency still has
not established goals for the level of service it will provide to
driver licensing agencies.
In reviewing SSA's verification service, we identified a key
weakness that exposes some states to issuing licenses to applicants
using the personal information of deceased individuals. Unlike the on-
line service, SSA does not match batch requests against its nationwide
death records. As a result, the batch method will not identify and
prevent the issuance of a license in cases where an SSN name and date
of birth of a deceased individual is being used. SSA officials told us
that they initially developed the batch method several years ago and
they did not design the system to match SSNs against its death files.
However, in developing the on-line system for state driver licensing
agencies, a death match was built into the new process. At the time of
our review, SSA acknowledged that it had not explicitly informed states
about the limitation of the batch service.
Our own analysis of one month of SSN transactions submitted to SSA
by one state using the batch method identified at least 44 cases in
which individuals used the SSN, name, and date of birth of persons
listed as deceased in SSA's records to obtain a license or an
identification card.\7\ We forwarded this information to state
investigators who quickly confirmed that licenses and identification
cards had been issued in 41 cases and were continuing to investigate
the others. To further assess states' vulnerability in this area, our
own investigators working in an undercover capacity were able to obtain
licenses in two batch states using a counterfeit out-of-state license
and other fraudulent documents and the SSNs of deceased persons. In
both states, driver licensing employees accepted the documents we
submitted as valid. Our investigators completed the transaction in one
state and left with a new valid license.\8\ In the second state, the
new permanent license arrived by mail within weeks. The ease in which
they were able to obtain these licenses confirmed the vulnerability of
states currently using the batch method as a means of SSN verification.
Moreover, states that have used the batch method in prior years to
clean up their records and verify the SSNs of millions of driver
license holders, may have also unwittingly left themselves open to
identity theft and fraud.
---------------------------------------------------------------------------
\7\ SSA's death records may contain inaccuracies because SSA
records all reports of death but only verifies those involving benefit
payments.
\8\ This state does not use SSA's batch verification process for
initial licenses, but only for license renewals. Therefore, the use of
the deceased person's SSN will not be caught by the system when the
state ultimately verifies it using the batch method.
---------------------------------------------------------------------------
CONCLUSIONS
The use of SSNs by both public and sector entities is likely to
continue given that it is used as the key identifier by most of these
entities and there is currently no other widely accepted alternative.
To help control such use, certain laws have helped to safeguard such
personal information, including SSNs, by limiting disclosure of such
information to specific purposes. To the extent that personal
information is aggregated in public and private sector databases, it
becomes vulnerable to misuse. In addition, to the extent that public
record information becomes more available in an electronic format, it
becomes more vulnerable to misuse. The ease of access the Internet
affords could encourage individuals to engage in information gathering
from public records on a broader scale than they could before when they
had to visit a physical location and request or search for information
on a case-by-case basis.
SSA has made substantial progress in protecting the integrity of
the SSN by requiring that the immigration and work status of every non-
citizen applicant be verified before an SSN is issued. However, without
further system improvements and assurance that field offices will
comply fully with the new policies and procedures this effort may be
less effective than it could be. Further, as SSA closes off many
avenues of unauthorized access to SSNs, perpetrators of fraud will
likely shift their strategies to less protected areas. In particular,
SSA's policies for enumerating children and providing unlimited numbers
of replacement cards may well invite such activity, unless they too are
modified.
State driver license agencies face a daunting task in ensuring that
the identity information of those to whom they issues licenses is
verified. States effectiveness verifying individual's identities is
often dependent on several factors, including the receipt of timely and
accurate identity information from SSA. Unfortunately, design and
management weaknesses associated with SSA's verification service have
limited its effectiveness. States that are unable to take full
advantage of the service and others that are waiting for the
opportunity to use it remain vulnerable to identity crimes. In
addition, states that continue to rely primarily or partly on SSA's
batch verification service still risk issuing licenses to individuals
using the SSNs and other identity information of deceased individuals.
This remains a critical flaw in SSA's service and states' efforts to
strengthen the integrity of the driver license.
GAO is preparing to publish reports covering the work I have
summarized within the next several months, which will include
recommendations aimed at ensuring the integrity of the SSN. We look
forward to continuing to work with this Subcommittee on these important
issues. I would be happy to respond to any questions you or other
members of the Subcommittee may have.
CONTACTS AND ACKNOWLEDGMENTS
For further information regarding this testimony, please contact
Barbara D. Bovbjerg, Director, or Dan Bertoni, Assistant Director,
Education, Workforce, and Income Security at (202) 512-7215.
Individuals making key contributions to this testimony include Mindy
Bowman, Alicia Cackley, Tamara Cross, Patrick DiBattista, Melissa
Hinton, Jason Holsclaw, George Scott, Jacquelyn Stewart, and Tony
Wysocki.
Chairman SHAW. Very good. We appreciate your testimony. Mr.
Huse.
STATEMENT OF THE HONORABLE JAMES G. HUSE, JR., INSPECTOR
GENERAL, SOCIAL SECURITY ADMINISTRATION
Mr. HUSE. Thank you, Mr. Chairman, Mr. Matsui, and Members
of the Subcommittee. As always--and I have probably been here
nine times--it is a pleasure to be here to assist you in your
important work involving the SSN and its protection. In the
interest of brevity and since you have accepted my full written
testimony, I will summarize the major points that I have in
that testimony. This Subcommittee and the Office of the
Inspector General have been fighting SSN misuse and identity
theft together for quite a few years now, beginning when I was
Acting Inspector General at Social Security. So, now I am
pleased to be here today and to see that the Subcommittee's
continuing and tenacious dedication to stopping and reversing
what is now a long-standing upward trend in SSN misuse and
identity theft has never wavered. I come in support of
legislation to strengthen protection for the SSN, our national
identifier. We as a government remain ill-equipped to afford it
the protection it needs and deserves. We need to protect the
SSN at three stages: upon issuance, during the life of the
number holder, and following the number holder's death. Perhaps
the most important step we can take in preventing SSN misuse is
to limit the SSNs' easy availability. Any meaningful
legislation designed to protect the SSN must strictly limit the
number's availability on public documents. The financial
industry relies on the SSN and no one is suggesting that we
change the way legitimate business is conducted in the United
States. The use of the SSN as a student or patient
identification number, as part of a car rental contract or to
rent a video must be curtailed.
Finally, I respect and support the SSA's strict privacy
regulations. The information SSA stores on each of us is
personal and is entitled to all of the protections we can
provide. However, there are times when that privacy must be
abridged for the greater good. Following September 11th, and
again during last year's sniper attacks in the Washington, D.C.
area, it became necessary to share with appropriate law
enforcement authorities information stored by SSA to permit
those authorities to conduct their investigations and, more
importantly, to prevent additional lives from being lost. On
both occasions, I asked the Commissioner of Social Security to
use the ad hoc authority vested in the Commissioner by SSA's
regulations to permit me to share SSA information with our law
enforcement partners. I now ask this Subcommittee for statutory
authority that would enable the Inspector General to make such
disclosures when necessary to protect human lives without prior
formal authorization from the Commissioner. When lives are at
stake, we cannot waste precious moments in order to sustain
some bureaucratic modality.
Before I close, I would like to emphasize one part of my
discussion. While the SSN is issued by SSA, the responsibility
for protecting its integrity reaches far beyond the agency's
boundaries. The SSA has come very far and is willing to do
more, yet other Federal, State and local jurisdictions as well
as the private sector must each also do their part. With
everyone's participation we can protect the SSN and ultimately
our homeland. Mr. Chairman, I thank you for your continuing
commitment to these critical issues. I might add to sharpen all
of this, that this very morning in California, we, along with
the Los Angeles Police Department and other local police
departments, made a raid and have arrested three suspects while
one suspect remains at large. We also seized computers,
printers, books of templates of every conceivable kind of
identification, SSNs, lists of SSNs, birth certificates,
driver's licenses, the seals to make driver's licenses,
doctor's certificates, and infant footprints. Now what do you
think they were going to do with those? This is a serious
matter. It goes on every day. Thank you, Mr. Chairman.
[The prepared statement of Mr. Huse follows:]
Statement of the Honorable James G. Huse, Jr., Inspector General,
Social Security Administration
Good Morning Mr. Chairman, Mr. Matsui, and members of the
Subcommittee. As always, it is a pleasure to be here to assist you in
your important work. We have been fighting Social Security number (SSN)
misuse and identity theft together for quite a number of years now,
starting when I was Acting Inspector General of the Social Security
Administration's (SSA) Office of the Inspector General. On March 30,
2000, I testified before this Subcommittee about SSA program integrity
issues in general. On that occasion, I expressed my appreciation that
the Subcommittee had recognized the importance of confronting SSN
misuse, and looked forward to separate hearings that you promised to
hold on the issue.
Five weeks later, on May 9, 2000, I returned and reported at length
on the misuse of SSNs in many areas, including identity theft. I
explained that my office could not possibly investigate every instance
of identity theft that involved an SSN. I testified that we were
working vigorously on the audit side to identify and eliminate
weaknesses in SSA's enumeration process, and just as vigorously on the
investigative side to stop SSN misuse crimes that had a direct impact
on SSA's programs and operations.
In the year that followed, even as we worked to tighten controls
over the issuance of SSNs and fought to deter and punish SSN misuse,
identity theft continued to increase. It became apparent that under
existing law, we could not do enough to stop criminals from obtaining
SSNs, and did not have sufficient enforcement tools to deter them from
doing so.
So on May 22, 2001, I returned to this Subcommittee asking for its
help. I asked for legislation that would severely restrict the use of
SSNs in the private and public sector, and that would criminalize the
sale of SSNs. I asked for an administrative safety net in the form of
Civil Monetary Penalty authority for those instances of SSN misuse that
could not be criminally prosecuted. And I pledged my office's
unwavering support of the Subcommittee's efforts to prevent SSN misuse
and, by extension, identity theft.
The Subcommittee's response was swift. H.R. 2036, which provided
all of the relief I had requested and more, was an important step
forward. Tragically, before we could take that step forward, we all
took an enormous step back. September 11, 2001 stopped us all in our
tracks, and H.R. 2036 understandably took a temporary back seat to more
pressing Congressional responsibilities.
But it was a very short time before we collectively realized that
H.R. 2036 and September 11 shared more common ground than we had ever
contemplated. We had always seen SSN misuse as a bureaucratic problem
for the government and a financial problem for the private sector and
the citizenry. As our investigative offices were besieged with requests
from the FBI for assistance in the September 11 investigation, we
quickly came to realize that SSN misuse and identity theft threatened
not only credit ratings and government records, but lives as well.
Shortly after the attacks on New York and Washington, I again came
before this Subcommittee and testified about individuals seeking to
assimilate themselves into our society for nefarious purposes. The
assimilation process begins with the use of an SSN whether obtained
legally or fabricated. Without it, I explained, it would be all but
impossible to function in our society for any extended period. H.R.
2036, which had been an important piece of legislation eight weeks
earlier, had become a critical one. Unfortunately, despite the best
efforts of this Subcommittee and my office, the 107th Congress
adjourned before that Bill became law.
Then just last week, Treasury Secretary John Snow called upon
Congress to take additional steps to help stem what he correctly terms
``the growing menace of identity theft.'' While the Secretary's focus
was on the harm identity theft visits upon consumers, this Subcommittee
knows the damage is much broader than that.
So, I am pleased to be here today, and to see that the
Subcommittee's continuing and tenacious dedication to stopping and
reversing what is now a long-standing upward trend in SSN misuse and
identity theft has never wavered. As you well know, the use of the SSN
in American society has expanded to the breaking point. Created in 1935
to track workers' earnings and pay them retirement benefits, its use
has increased so dramatically that it has become a part of more
government functions and financial transactions than we could ever
count. It is our national identifier, and while it serves its purpose
well, we as a government remain ill-equipped to afford it the
protection it needs and deserves.
I have previously testified as to the need to protect the SSN at
three stages: upon issuance, during the life of the number-holder, and
following the number-holder's death. This three-tiered approach remains
critical.
At Stage One, my office is doing more work than ever, working
closely with this Subcommittee and SSA to strengthen controls over the
enumeration process, ensure the integrity of identification documents,
and make it as difficult as possible to obtain an SSN from the Federal
government fraudulently. If we cannot accomplish this much--ensuring
that the government is not an unwitting accomplice to identity theft
and other SSN-related crimes--then we will have failed before we have
begun. But I can testify today with confidence that this is not the
case. Together with you and with SSA, we have made important strides in
reducing enumeration vulnerabilities, and that effort continues. Still,
legislation is sorely needed to limit the number of replacement Social
Security cards an individual can obtain, and to require better cross-
verification of records in the enumeration at birth process, to ensure
that SSNs are not inappropriately issued in this important program.
Excellent progress has been made in the enumeration arena, and we
remain dedicated to even further improvements. At present, SSA is
drafting two regulations to tighten the issuance of SSNs to non-workers
and foreign students.
Similarly, Stage Three, following the death of the number-holder,
is an area in which we are working hard to ensure that, through timely
reporting, appropriate cross-matching, and better controls, the SSNs of
deceased individuals are not recycled for inappropriate purposes.
But it is at Stage Two where we have focused the majority of our
efforts, and where we have made the most progress. In the last several
years, we have conducted numerous audits and made sweeping
recommendations to SSA to improve the SSN misuse problem in the
earnings reporting process, and most importantly, to improve controls
over SSN misuse as it pertains specifically to Homeland Security.
Further, over the last six months, we have led the President's Council
on Integrity and Efficiency community in conducting an audit in
assessing their respective Agency's practices in the use of SSNs. The
final report noted that despite safeguards to prevent improper access,
as well as disclosure and use of SSNs by external entities, many
agencies remain at risk.
As I stated, the SSN was never intended for the uses to which it is
now put millions of times every day. The Identity Theft and Assumption
Deterrence Act of 1998 and the Internet False Identification Prevention
Act of 2000 provided law enforcement with the initial tools necessary
to punish SSN misuse as it relates to identity theft. But each SSN
begins and ends at SSA, and true stewardship over that number must
reside in the Act that created it, the Social Security Act. That
stewardship must focus not only on punishment and deterrence, but also
on prevention.
Perhaps the most important step we can take in preventing SSN
misuse is to limit the SSN's easy availability. Any meaningful
legislation designed to protect the SSN must strictly limit the
number's availability on public documents. As long as criminals can
walk into the records room of a courthouse or local government building
and walk out with names and SSNs culled from public records, we can
never reverse the trend. Any meaningful legislation must also
specifically prohibit the sale of SSNs--including one's own SSN--on the
open market. As long as criminals can buy a list of names and SSNs in
an Internet auction, we will continue to be plagued by the
consequences. And legislation, if it is to be meaningful, must limit
the use of the SSN to appropriate and valid transactions.
The financial industry relies on the SSN, and no one is suggesting
that we change the way legitimate business is conducted in the United
States. But the use of the SSN as a student or patient identification
number, as part of a car rental contract or to rent a video, must be
curtailed. Secretary Snow commented, ``Secure, reliable information is
the lifeblood of all financial services, among which consumer credit is
fundamental. It is not an overstatement to suggest that preserving the
integrity and availability of consumer credit in this economy is
preserving prosperity itself.'' This is why I have testified that
Congress should consider requiring the cross-verification of SSNs
through both governmental and private sector systems of records to
identify and address anomalies in SSA's files, and in data bases at
various levels of government and the financial sector. Only in such a
way can we combat and limit the spread of false of identification and
SSN misuse. In fact, SSA has taken initial steps toward implementing
provisions of the Patriot Act. This Act requires the Treasury
Department to develop a system for domestic financial institutions to
verify the identities of foreign nationals seeking to open accounts
with information held by Government agencies.
If we can implement these changes, all of which come down to the
acceptance of the fact that the SSN has become our national identifier
and the application of common sense, criminals will have a far more
difficult time obtaining an SSN from SSA or from other sources, and we
will be able to better focus on enforcement.
The Identity Theft legislation I discussed earlier provides
criminal penalties, but those penalties were designed for broader
crimes involving Social Security cards and/or SSNs, not for SSN misuse
itself. Meaningful legislation that is focused solely on SSN misuse
must provide meaningful criminal penalties in the Social Security Act,
must provide enhanced penalties for those few SSA employees who betray
the public trust and assist criminals in obtaining SSNs, and must
provide an administrative safety net in the form of Civil Monetary
Penalties to allow for some form of relief when criminal prosecution is
not available for SSN misuse and other Social Security-related crimes.
Finally, I respect and support SSA's strict privacy regulations.
The information SSA stores on each of us is personal, and is entitled
to all of the protections we can afford it. I have learned, however,
through a series of unfortunate events, that there are times when that
privacy must be abridged for the greater good. Following September
11th, and again during last year's sniper attacks in the Washington,
D.C. area, it became necessary to share with appropriate law
enforcement authorities information stored by SSA to permit those
authorities to conduct their investigations and, more importantly,
prevent additional lives from being lost. On both occasions, I asked
the Commissioner of Social Security to use the ad hoc authority vested
in the Commissioner by SSA regulations to permit me to share SSA
information with our law enforcement partners. I now ask this
Subcommittee for statutory authority that would enable the Inspector
General to make such disclosures when necessary to protect human lives
without prior formal authorization from the Commissioner. When lives
are at stake, we cannot waste precious moments.
Before I close, I would like to emphasize one part of my
discussion. While the SSN is issued by SSA, the responsibility for
protecting its integrity reaches far beyond this Agency's walls. While
SSA has come very far and is willing to do more, other Federal, State
and local jurisdictions, as well as the private sector must each do
their part. With everyone's participation, we can protect the SSN and
ultimately our homeland.
I thank you for your continuing commitment to these critical
issues, and would be happy to answer any questions.
Chairman SHAW. Thank you, Mr. Huse. What is the criminal
penalty for supplying fraudulent documents in order to obtain a
Social Security card--SSN? Or is there State law that you are
familiar with that would do the same thing with regard to
getting a driver's license that you are aware of?
Mr. HUSE. The answer to your question is, there are Federal
statutes that cover those crimes, and State statutes also.
There is a strong law enforcement remedy for all of this
criminal activity. What there isn't, though, is an elastic
enough charge or felony charge for Social Security misuse in
and of itself, which oftentimes is the common denominator
through all of these levels of government and the crimes that
have been established. If we had a strong, simple Social
Security misuse felony, it would cut through a lot of this
criminal justice activity.
Chairman SHAW. Let's take the examples that are up on the
board. If one were to go in to the Social Security office and
give them a birth certificate, a baptismal certificate and some
other type of picture identification such as the one you use up
there with the United Airlines employee type of identification,
in order to obtain a SSN--these documents are fraudulent--what
would be the criminal penalty that this person is liable for?
Mr. HUSE. There is a Federal criminal statute that covers
this type of criminal activity. However, if I sold my SSN to
Barbara to use illegally, there is no crime for the actual
sale. I can't be charged for that. So, these are some of the
aspects of this that we are trying to get in a specific SSN
misuse felony.
Chairman SHAW. I am just talking about the individual who
goes in and tries.
Mr. HUSE. It is a crime, and we can charge them.
Chairman SHAW. Is it a felony?
Mr. HUSE. It is a felony crime.
Chairman SHAW. Five years?
Mr. HUSE. Five to 10.
Chairman SHAW. Five to 10. Thank you.
Mr. HUSE. I would also add that in the Federal system there
are also the sentencing guidelines.
Chairman SHAW. Are the prosecutors prosecuting these cases?
Many of our courts I know in south Florida, are overworked so
much, and the question of whether you are going to be
prosecuted even for a felony can depend upon the severity of
the felony because of short-handedness within the prosecutor's
offices themselves, the right to speedy trial, overcrowded
dockets, those type of things. Are these cases being
prosecuted?
Mr. HUSE. Some of them are. I think the prosecutors try to
do the right thing. They triage cases just like everybody else.
There are those cases, as you just pointed out, that are not
prosecuted, perhaps because the dollar amount is minimal, or
the urgency, or there is no terrorism nexus, or what have you.
Those cases usually fall out. That is why we are asking for
this civil money penalty, a provision that would allow us to
sanction those people who aren't prosecuted. They would still
have to pay a substantial fine, and in that way perhaps we can
do something about the proliferation of this crime.
Chairman SHAW. Mr. Cardin.
Mr. CARDIN. Thank you, Mr. Chairman. Let me again thank our
witnesses for their testimony. The SSN is supposed to be the
identification number for the Federal Government for Social
Security purposes. Yet it is used as an identification number
by a lot of different organizations and groups. I have my
health insurance card, which my membership number is identical
to my SSN. I am sure that is not unusual. Until 2 or 3 years
ago, our U.S. House of Representatives identification cards
included, mandatorily, our SSNs. So, I guess my question is,
how important is it for us to try to protect the
confidentiality of an individual SSN? You point out that you
can go on the Internet and probably find the SSNs of most of us
in some documents that are probably public today. If you
couldn't find it there you, probably with a little effort,
could find out our SSNs. How much is that a contributing factor
to identity theft? Should we be much more vigilant about
protecting the use of the SSN as a way to protect against
identity theft? How major is this? How much effort should we
put behind keeping these numbers confidential or for use only
by the SSA?
Ms. BOVBJERG. It couldn't hurt to quit giving people your
SSN when you don't know what they are going to do with it. The
Privacy Act (P.L. 93-579) requires all levels of government,
not just the Federal Government, when they ask for your SSN, to
tell you whether you are required to give it, and for what
purpose it is to be used. This is not a provision of the
Privacy Act that is followed very routinely. We have made a
recommendation to the Office of Management and Budget to take
some action to inform government agencies, particularly State
and local governments, that this provision applies to them. I
think as an individual it is probably also important to ask why
Blockbuster Video or someone like that is asking you for your
SSN and how it will be used, or to simply not give it to them.
You are really also asking to put the genie back in the bottle.
Mr. CARDIN. I don't think people think about this. If they
are asked to give their SSN they give their SSN because it is
there, it is on the form. They don't think twice about it.
Unless we develop policy nationally that prevents the use of
the SSN for non-governmental purposes or provide additional
protection for the individual to make that judgment, it seems
to me it is not going to happen.
Mr. HUSE. I agree with everything our distinguished witness
from the GAO said, but I would add that that is 50 percent of
the issue. The other 50 percent is for those numbers that are
already out there. I believe there is also a governmental
obligation to ensure that there is due diligence on the data
that is stored by all of these entities in matching those
records with the true records of government at all of the
levels, but including the Federal level--to ensure that there
is an attempt to make positive identification occur. I think
that is the other half of the identity theft problem. I think
we are doing a lot of work on the front end in trying to get
the integrity in the system that issues numbers, but we are not
doing enough on the back end to verify that data and to make
sure that anomalies in it are rooted out and given to
appropriate law enforcement authorities at the local, State,
county and Federal level to deal with. This is a universal
problem, it is way beyond just the SSA.
Mr. CARDIN. I agree with your point. I guess my point is,
how do you put this all together? Would it make it a lot easier
if these numbers weren't so readily available? I guess the
answer is, it wouldn't hurt and certainly it would make it more
difficult for identity theft. Unless we are prepared also to be
very aggressive on the use of identity, and the verification of
identity, and all the other issues there would still be a
significant problem out there?
Mr. HUSE. I think you are at a point where, as Barbara
said, you can't put it back in the bottle. I think we have to
accept the status quo.
Mr. CARDIN. Why? I am not sure I agree with that. Unless we
are willing to take action on who can use SSNs, and how they
are to release and protect them, I agree with you. I guess my
point is, that is one area that we could control here from
Washington. It may cause disruptions and maybe it is not worth
all the disruptions it causes, but I am trying to get a sense
as to how important it would be to restrict the availability of
SSNs. What I am getting from you is, that would certainly help
us in reducing the amount of identity theft.
Mr. HUSE. The answer is yes.
Ms. BOVBJERG. If I could just add briefly, you have already
done things that have helped. Certainly the Drivers Protection
Act of 1993 (P.L. 103-322) helped enormously to prevent motor
vehicle records that had SSNs on them from being sold in bulk.
There are other things that have occurred over the last 10
years that have made the SSN, particularly in government, more
secure. So, I think there are things that you already have done
that have helped.
Mr. CARDIN. Why should my health insurance company require
to use my SSN?
Ms. BOVBJERG. They want to know that you are you. It is a
unique identifier. They want to distinguish you.
Mr. CARDIN. Well.
Mr. HUSE. From another person with a similar name.
Mr. CARDIN. Is that a responsibility of government, or the
private insurance industry?
Ms. BOVBJERG. The government did not provide it to the
insurance company.
Mr. CARDIN. No, but we provide the SSN. Thank you, Mr.
Chairman.
Chairman SHAW. Mr. Collins.
Mr. COLLINS. No questions.
Chairman SHAW. Mr. Brady.
Mr. BRADY. Thank you, Mr. Chairman, for holding this
hearing. Thank you to the witnesses for being here. It is very
helpful. Reading the testimony in advance, I wanted to focus on
defining the problem a little better. It seems like there are
widely varying estimates of how big a problem identity theft
is. I am wondering between thefts used for financial fraud that
are--sometimes we identify them because of complaints, those
used for illegal immigration purposes, those used for national
security access. Do you think we really know how big the
problem of identity theft is in America right now?
Mr. HUSE. I don't think we do. The numbers that come to us
from the financial sector are those that they choose to share
with us. All of the credit card entities have huge insurance
bonds that mask a lot of the activity. By this I mean that they
assume a lot of this is risk. In the context of the national
security dimension, I think we do get good information, and it
has really been emerging since 9/11, as to how important it is
for someone that comes into this country to do ill, to be able
to get underneath our radar by obtaining whatever requisite
identification we need--principally the driver's license
because that is the one that allows you to move around as
someone who has some kind of status. I think, to use a
metaphor, this is the tip of the iceberg. We just see the top
from the hysteria that we hear and the reporting. I think the
problem is far bigger than we even know.
Mr. BRADY. Thank you. Ms. Bovbjerg.
Ms. BOVBJERG. I agree, we don't know. We have reported to
Mr. Johnson in the past, that it is difficult to get statistics
on this. I have brought Federal Trade Commission (FTC)
statistics that said in calendar-year 2002, 380,000 consumer
fraud and identity theft complaints came to their hotline. How
many of those are SSN-related is unclear. They certainly don't
get at the point that Mr. Huse made about the criminal
immigration fraud, the terrorism side of identity theft. They
also reported losses of more than $340 million. We know that
not all of these losses get reported, so indeed this figure is
lower than actual losses.
Mr. BRADY. Those aren't the answers I wanted to hear, but I
think it is what we all know in the room--that it is the tip of
the iceberg on this issue, and leads to the follow-up question,
how successful are we in catching and prosecuting those who
steal identities for various reasons? Do we have any numbers on
how many prosecutions occur each year, and if I steal someone's
identity for whatever reason, what are the chances that I will
get caught--other than being a Member of Congress, we are
likely to get caught--but still in the most part, how
successful are we?
Mr. HUSE. I would say we are as successful there as we are
with a number of issues when we talk about the criminal justice
system. We know what we know. We have statistics, and I don't
have them at my finger tips but we will supply them to you
later, from what we do and the rest of Federal law enforcement.
The U.S. Department of Justice garners the statistics from
across the country. I don't think we really get at the universe
of identity fraud through the criminal justice system. I think
we probably, to use my metaphor from before, I think we are
just getting at the surface of it. It is one of those crimes
that has become provocative enough to warrant our attention. A
lot of it goes on unnoticed. Some of it is because a victim has
to discover that they have been violated. That is the part we
don't really know yet.
[The information follows:]
Social Security Administration
Baltimore, Maryland 21235
May 5, 2004
The Honorable Kevin Brady
House of Representatives
Washington, D.C. 20515
Dear Mr. Brady:
During the Ways and Means Social Security Subcommittee hearing on
July 10, 2003, you asked then Inspector General James Huse some
questions related to the prosecution of identity theft cases. I would
like to take the opportunity to respond to each of your questions in
turn.
First, you asked how successful we are in catching and prosecuting
those who steal identities for various reasons. It is important to note
that the Social Security Administration (SSA) Office of the Inspector
General (OIG) is responsible for investigating and referring for
prosecution a small portion of the overall universe of identity theft
cases--those that relate to Social Security disability benefits,
earnings or other fraud issues that concern SSA programs generally.
With regard to these cases, the SSA OIG has been instrumental in
successfully apprehending and referring violators for prosecution.
Second, you asked whether we have any numbers on how many identity
theft prosecutions occur each year. As previously stated, the SSA OIG
has statistics on the number of identity theft prosecutions relating to
Social Security fraud, but not the number of identity theft
prosecutions that occur nationwide as the result of investigations
conducted by other federal, state and local entities. Between FY 2001
and FY 2003, the SSA OIG investigated over 1800 allegations of identity
theft related to SSA's programs. These cases resulted in over 1100
convictions.
Finally, you asked how likely it is that someone will get caught
for stealing an identity. Identity theft is often referred to as a
crime that entails minimal risk. According to the Federal Trade
Commission, the incidence of identity theft continues to rise. Through
its investigations of Social Security-related identity theft
allegations, and its referral process, the SSA OIG is making a
significant contribution to the fight against identity theft. It is
clear that more work needs to be done. We look forward to working
cooperatively with other agencies and the Social Security Subcommittee
in furtherance of this effort.
Sincerely,
Patrick P. O'Carroll, Jr.
Acting Inspector General
Mr. BRADY. Sure. Ms. Bovbjerg.
Ms. BOVBJERG. I am leaving the criminal justice statistics
up to Mr. Huse.
Mr. HUSE. I didn't even answer them.
Mr. BRADY. I think really you did. I think the point you
made earlier about more flexible criminal justice penalties and
charges I think are real important. Mr. Chairman, I conclude
with that. I think your bill on Social Security theft and
response is an excellent approach. Perhaps we ought to find a
way to better define this problem as well as better identify
how successful we are because then we can at least start
measuring our improvement against that. I yield back the
balance of my time. Thank you.
Chairman SHAW. Mr. Pomeroy.
Mr. POMEROY. Mr. Chairman, I want to commend you for not
just this hearing, but your long-standing work on this
important issue. I would ask Ms. Bovbjerg whether there are
some systems' investments that we need to make at SSA that will
address some of the concerns your report notes. How do we get
to where we need to go in terms of bringing a greater measure
of security in the areas that you cite? Obviously the
replacement cards, I suppose, if you don't issue--you don't
allow 52 in a year would be a good start perhaps, but more
specifically what recommendations you might have in that area,
and the children's cards, the batch systems, what specifically
do you think we ought to--how should we respond?
Ms. BOVBJERG. We are still thinking about recommendations
in those areas. We will be issuing a report to the Subcommittee
in September. We have been discussing these things with the
SSA, and I know they have a concern about replacement cards and
reducing the number permitted, thinking that, maybe 52 is too
many, and certainly I think 52 is too many. The SSA raises the
point about the homeless person who comes in regularly for his
card, he needs it for benefits. The SSA doesn't want to cut
that person off from his benefits. On the other hand, perhaps
that person needs something more than a replacement card if he
is coming in to SSA offices that often. We are thinking about
what would be a reasonable approach to fixing that problem. I
think we have thought, particularly with regard to verification
for enumeration that there might be some things that ought to
be done, perhaps having SSA's staff have a means to acknowledge
in the SSA system that they have done the third party
verification. That is, the new SSN number could be issued.
Things like that. These are recommendations that we are still
thinking about, that we are discussing with the SSA. We don't
want to recommend something that is not feasible. I think there
are some things that can be done to strengthen the verification
process.
Mr. POMEROY. Is your investigation also evaluating what
legitimate private uses are occurring with SSNs as a national
identifier in trying to find ways that put in place protections
but on the other hand don't unduly disrupt existing systems
that depend upon this identifier?
Ms. BOVBJERG. We are trying to look at that balance. In the
work that we are doing for this Subcommittee on the private
sector, we are asking certain parts of the private sector how
they are using the number, how do they obtain it, what
safeguards they have, because some companies have really
thought about this a lot and are attempting to grapple with the
safeguard issue. We will be reporting back in the fall on this.
We are still in the middle of our work.
Mr. POMEROY. Mr. Huse.
Mr. HUSE. I just wanted to say that I think I can speak for
Commissioner Barnhart here, too, that her interest in this is
as strong as my own. The SSA does have a regulation moving
through the vetting process now that will restrict the number
of replacement cards available to an individual during the
course of the year. It markedly reduces the number down from 52
to 2 in a given year, and 10 over the course of a lifetime,
which I think is far more reasonable. That is going through the
vetting process in the executive branch before it is issued as
a regulation. So, it is there. I only answered that so that you
understand that the SSA is not static on this issue. It is just
a question of the process.
Ms. BOVBJERG. Your office too?
Mr. HUSE. My office too.
Mr. POMEROY. Do you have a feel for as we move to address
identity theft it is going to significantly curtail commercial
use of SSNs?
Mr. HUSE. I think it will. It will probably also spur the
private sector to look to the promise in new technology for
identification that takes us away from the number and its
universal use now to biometrics and other more facile uses of
identification. I think by drawing the line now, we are saying,
that the continued use of the SSN will become too expensive for
you, it would be better to try another way. The information
technology will require this in any case.
Mr. POMEROY. Thank you. Thank you, Mr. Chairman.
Chairman SHAW. Mr. Johnson.
Mr. JOHNSON. Thank you, Mr. Chairman. Mr. Huse, I asked you
a question I think before on one of your nine appearances. I
wonder if you could give me an update on where we are with the
regulatory process on the issuance of SSNs for nonwork purposes
and for foreign students as well as those who are issued to
foreigners. I have got a question along those lines. I believe
you testified before with reference to the illegals that were
allowed to have work permits in Dallas, that if they were
issued a work permit they were allowed to get a SSN. What kind
of documentation do they use to get that, one; and two, you
said it was for life, good for life. Is that still true?
Mr. HUSE. Once a number is issued, it is valid for life.
Mr. JOHNSON. Well, then, what is this deal about you all
issuing different kinds of SSNs for temporary work permits or
students or people who are in the country temporarily from
foreign countries? Is there such a thing? You were talking
about different colors, I think.
Mr. HUSE. I never understood how complex this was until I
took this office.
Mr. JOHNSON. It is, but you know the currency was
counterfeited all over the world and we came up with coloration
to take care of that. It isn't working, but it is still--well,
it isn't. They keep changing it. It is an effort to stop the
counterfeit process. I wonder why we don't do that with the
Social Security card?
Mr. HUSE. The nonwork card, for example, was required as a
means to provide legitimate visitors to this country with the
ability to get a driver's license and be insured and to----
Mr. JOHNSON. They don't have to have a Social Security card
to get a driver's license.
Mr. HUSE. Well, in some States you do need an SSN to get a
driver's license. It is the underpinning of the driver's
license system.
Mr. JOHNSON. That is not the purpose of the number. So, we
are misusing it when we use it that way.
Mr. HUSE. The nonwork number, because there were these
requirements, the SSA came up with this as a service. Now that
was curtailed after September 11th. Commissioner Barnhart
notified the governors of our States that the SSA would no
longer do that. There were court challenges to that decision
and the SSA has gone back to it temporarily, but it is under
scrutiny now.
Mr. JOHNSON. So, what you are saying is the States use the
SSN as verification to get a driver's license?
Mr. HUSE. They do. It is the underpinning of our driver's
license system. That is why I used to use the term de facto
national identifier for the SSN. If you notice over the time I
have been here I have dropped that ``de facto.'' If this is
truly the case, that the number is underneath even the driver's
license, we can't call it a de facto number, it is the national
identifier until something changes.
Mr. JOHNSON. Do we legislate against that? I see driver's
licenses being used as fake identification, too.
Mr. HUSE. The driver's license is probably the most
counterfeited identification we have. In any case there is a
lot of scrutiny on the uses of the nonwork number. There are
foreign visitors to this country, students that obtain the
appropriate visas that are in this country to be educated that
for Citizenship and Immigration Services, if I got this right.
Mr. JOHNSON. I know what you are talking about. When you
issue a SSN are you verifying it by one document or several
documents? It seems to me if there is a fraudulent effort out
there to obtain them, I don't know where they get them all
from. Do they just make up the numbers or are they buying them
or what?
Mr. HUSE. Thieves steal genuine numbers, thieves make up
counterfeit numbers out of thin air and then create a myriad of
identification from that. Between the two, all of this migrates
into databases, and that is why I suggest that verification of
these records is a way to root out SSN misuse.
Mr. JOHNSON. The IRS is your primary enforcement agency
right now?
Mr. HUSE. It is.
Mr. JOHNSON. It seems to me that--how are they verifying
the authenticity of the SSN? I know there is a lot of
mismatches. How are we fixing that and are your computers being
updated as we speak?
Mr. HUSE. There are efforts to do that. Our work and the
work of the GAO have suggested system fixes to Social Security,
and they have those in their queue to do along with their own
systems enhancements. Those are under way. Are they done yet?
No, they are not finished.
Mr. JOHNSON. We talked about this at least 2 years ago.
Where are we with reference to that issue?
Mr. HUSE. We are moving toward the goal line, but it is not
done yet.
Mr. JOHNSON. Can you see the goal line?
Mr. HUSE. Well, some things you take on faith.
Mr. JOHNSON. More than 100 yards away. Thank you very much.
Thank you, Mr. Chairman.
Chairman SHAW. Mr. Becerra.
Mr. BECERRA. Thank you, Mr. Chairman. Before I begin my
questions, I want to thank the Chairman for continuing to press
on this issue. I know he has had legislation in the past, and I
hope we are able to move something. I am sure it is going to be
a bipartisan piece of legislation. I thank the Chairman for his
efforts on this particular subject. To our witnesses, thank you
again for being here. A couple of questions. First, with regard
to the maintenance or the integrity of the SSN itself, the war
on terrorism, the need for more security, it is becoming more
and more important now that we check and verify. Now, I recall
before 9/11, the SSA was already having problems trying to find
the resources to take care of this massive work. Can you tell
us what kind of monies you have post-9/11, or let's just focus
on this year's budget, what kind of moneys you have in addition
to what you already had to try to deal with this issue of
identity theft.
Mr. HUSE. First of all, we do have built into our 2004
budget request appropriate funding to do some more significant
work with----
Mr. BECERRA. How much are you asking for?
Mr. HUSE. Let me look back and get a dollar. The total
appropriation we have asked for is $90 million, but in there,
there is about an $8 million increase over current
appropriations. We were looking to build out this SSN misuse
capacity.
Mr. BECERRA. Let me make sure. Of the $90 million that you
are asking for, $8 million of it would focus on the identity
theft issue or all $90 million would focus on the identity
theft issue?
Mr. HUSE. The $90 million covers all of our
responsibilities, which is beyond just this particular mission.
What we were looking for in the $90 million is $2 million, a
modest amount to develop what we call SSN misuse teams that we
have. The teams will include auditors, investigators and----
Mr. BECERRA. That is $2 million. Keep going.
Mr. HUSE. That is the only growth we asked for.
Mr. BECERRA. That's $2 million for a country the size of
the United States?
Mr. HUSE. Well, we----
Mr. BECERRA. I suspect the folks that are forging these
documents could give you more than $2 million off their profits
just of what they have made.
Mr. HUSE. Now, I need to be careful here, because my role
in relation to all of this is the integrity to the SSN business
process itself. The whole issue that you speak to is a massive
universe that involves----
Mr. BECERRA. That is very true.
Mr. HUSE. The whole government.
Mr. BECERRA. Outline for us what moneys you are getting for
your particular role within the Inspector General's office, and
perhaps we could ask, Mr. Chairman, for the SSA to break down
the monies it is requesting to deal specifically with the
identity theft issue so we have a sense. I am almost positive
what we will find is that you all need more resources, and we
should know that now so that when you come back and testify for
the 10th or 11th time, we won't be asking why you haven't made
more progress along the yardage markers to get closer to the
goal line. Another question for you. Do government
administrators or employees today at any level of government,
whether Federal, State, local, or any business employees that
you are aware of, undergo any training for identification
verification to know when a document is real or fraudulent?
Mr. HUSE. They do. Even Social Security field employees get
training in the identification of----
Mr. BECERRA. Without going further, because I want to make
sure I get all my questions in, if you could provide us or
provide my office with the literature, whatever you have in
writing that says what the training is----
Mr. HUSE. I would be glad to.
Mr. BECERRA. If you know what other State or local
governments do as well, because I guess one of the problems is
we have a lot of folks who aren't trying or doing much of an
effort to figure out if these are authentic documents or
identification cards or not.
Mr. HUSE. Sure.
Mr. BECERRA. If someone asks for a replacement Social
Security card--I lost my card, I write to the SSA and say I
need to get another one, I can get one; right?
Mr. HUSE. Right away.
Mr. BECERRA. If a year later I write back and say, you know
what, I lost it again.
Mr. HUSE. You would get it again.
Mr. BECERRA. If I say, you know what, I ripped it up. I
lost it. Can I get another one?
Mr. HUSE. You can, and that goes on and on and on.
Mr. BECERRA. Does that trigger within SSA any thought that
perhaps this individual is misusing the SSN?
Mr. HUSE. It does now, because we analyze the enumeration
process, and where there are clusters of these, some are
referred to us for an investigative look, where there is
suspicion, which can't be----
Mr. BECERRA. So, we are doing something?
Mr. HUSE. Yes. Yes, we are.
Mr. BECERRA. Thank you, Mr. Chairman.
Chairman SHAW. The replacement card has the same number,
doesn't it?
Mr. HUSE. Yes.
Chairman SHAW. Your concern with the replacement card is
they are just handing them off to their buddies.
Mr. HUSE. Correct. We have, in some instances, where people
get hundreds of these in a year, or almost 100 in a year.
Now, some people may be generationally used to the fact
that they think they have to have this card at all times. Some
of us get older, and we forget, misplace them and we think we
have to get another one, and that is a service. That is a
service some people believe they have to have, so a lot of
these really aren't criminal, but when you see 80 or 90 a year,
you begin to wonder, and those we are now----
Mr. BECERRA. I'd think you would begin to wonder before 80
or 90.
Chairman SHAW. Mr. Collins.
Mr. COLLINS. Maybe we ought to flag those and send them to
them in bulk. I was just looking at some information the
Subcommittee provided for us on mismatched records to see where
the Social Security matches information with the IRS weekly
about, and that is W-E-E-K-L-Y, not W-E-A-K-L-Y, about
discrepancies. Interesting figures that no match letters were
sent out to employers for employers to actually verify the
employee, that it went from 110,000 to 950,000 letters last
year, representing 10 million mismatches. Now, to go back to
what Mr. Johnson was talking about, the immigration bill, and
you talked about earlier, the raid that you all were successful
with this morning in California where you apprehended three and
one is on the loose. A lot of the cards or the material they
had there to create cards will be part or a large part of this
mismatch?
Mr. HUSE. There is absolutely no doubt that there is a
demand for counterfeit identification documents brought on by
our undocumented worker population in this country. That is
fact.
Mr. COLLINS. A driver's license or most any kind of
identification that has a SSN on it also has a photo on it. Any
thoughts toward a photo? You get a SSN as an infant, but once
you reach legal age, some age----
Mr. HUSE. There is no plan to do that. In fact, at the
present time the SSA does not require a photograph for any of
Social Security's services, including any of the insurance
programs. Your number is the key that unlocks those benefits.
In addition, there is not any biometrics involved.
Mr. COLLINS. It is also becoming a key to a lot of other
folks too, using it in a wrong pattern. What can an
individual--what has the Administration done to assist an
individual in how to be more responsible or protective of their
SSN?
Mr. HUSE. I can speak to what we, at SSA, and what I know
from the FTC, and they have done extensive outreach work and
activity in their communications arena to apprise people of the
issues involved and the personal responsibility to protect your
number, what to do when something happens to you, when you
detect someone else has used your number and what remedies to
take, and those are very understandable brochures and mailings.
We have a fraud hotline at SSA that provides these answers to
hundreds of people that call in with these problems. The FTC
does the same thing. We also tell people in the process of
getting their statement on Social Security every year, which is
very important, that is a critical document, just like your
monthly credit card statements, that you should review it
carefully to be sure that the wages and earnings that are
posted on it track with your recollection of your earnings
history, because if there are differences there, that is almost
a sure sign there has been a compromise of your identity. The
other thing that SSA has advised people for some time now is to
cease the practice of putting your SSN on private checks, and
that is just not necessary. You shouldn't put your phone number
either. This is just a desire by businesses to gather some data
on folks that they don't really need to have.
Mr. COLLINS. Thank you. Thank you, Mr. Chairman.
Chairman SHAW. You had a follow-up on--go ahead and then we
will go to Ms. Tubbs Jones.
Mr. JOHNSON. Thank you. I would just like to ask, in the
military, they ask you for your SSN. That is why we used to put
them on the checks. I don't anymore.
Mr. HUSE. I remember, too.
Mr. JOHNSON. That, and phone number. That as well.
Mr. HUSE. So, they could get your officer's club bill to
you.
Mr. JOHNSON. That is so you would pay them. That's right. I
would like to ask a question real quick. Kids that get--when
you give a baby a SSN, he isn't going to work. Why does he need
one? The IRS asks you to do that, didn't they?
Mr. HUSE. They did.
Mr. JOHNSON. They use it, and it is if that is where how
much of the fraud do you know what percentage of the fraud is
in young kids?
Mr. HUSE. Well, the fraud that happens with the young
children is when parents of young children get earned income
credits for the purpose for----
Mr. JOHNSON. Kids get earned income credits?
Mr. HUSE. No. The parents do for the number of children
they have, depending upon the level of the parent's income.
That is a type of fraud. We can get you some information on
that.
Mr. JOHNSON. Well, why isn't it possible to give a child a
number that is not a SSN, that the IRS can use until they get
of working age? We have child labor laws too. They are not
supposed to work under a certain age.
Mr. HUSE. Like many things in government, this was a
process that emerged out of a need to prevent fraud in filing
income tax returns, where people claimed----
Mr. JOHNSON. It has turned around on us and we are having
fraud develop in the Social Security regime. Then we maybe need
to look at that again.
Mr. HUSE. That could be a possible area for adjustment. I
know of the time in my youth you didn't get a number until you
went to work.
Mr. JOHNSON. That's right. Thank you. Thank you, Mr.
Chairman.
Mr. COLLINS. That may be part of the problem with the $10
billion of fraud that we have with the earned income tax credit
each year.
Chairman SHAW. Ms. Tubbs Jones.
Ms. TUBBS JONES. Thank you. Do you have any indication that
there is more abuse by earned income tax credit people filing
than there is abuse of fraud in businesses across the country?
Mr. HUSE. No.
Ms. TUBBS JONES. Thank you. Let me go on. I heard you
earlier raise the question that or say that there is no way you
could prosecute Ms.--I don't know how to pronounce your name.
Ms. BOVBJERG. Bovbjerg.
Ms. TUBBS JONES. Thank you--for selling her SSN to you.
Mr. HUSE. You could prosecute her, but you couldn't
prosecute me if I sold my number to her.
Ms. TUBBS JONES. Why not?
Mr. HUSE. There is no penalty for me to sell my genuine
SSN.
Ms. TUBBS JONES. Oh, absolutely. There is a penalty for
theft and deception and fraud.
Mr. HUSE. I meant in the Social Security Act (1935, 49
Stat. 620).
Ms. TUBBS JONES. I want you to be clear on that, because
there is a law that covers that conduct.
Mr. HUSE. I believe there is a law on the books for just
about every particular aspect of this, but it is sorting
through those to get to the right penalty that makes it very
difficult.
Ms. TUBBS JONES. Let me tell you the reason I raise the
question with you, sir, is I am a former judge and a former
prosecutor, prosecuted cases for Cuyahoga County for 8 years
with 300 and some assistants, and the thing I worry about is us
always trying to create another crime to prosecute conduct that
can be prosecuted under existing law, and I just wanted the
record to be clear that there is a law that you can be
prosecuted for engaging in that conduct.
Mr. HUSE. I am sure.
Ms. TUBBS JONES. Let me ask you also. You said that you
have been here nine times. My first time meeting you, it is
nice to meet you. Have you, in the nine times that you have
been here, requested sufficient dollars to be able to do the
type of work that the SSA needs to do to adequately protect the
people of the United States and their numbers?
Mr. HUSE. Yes, I think I have done that.
Ms. TUBBS JONES. So, the $2 million you asked for is
sufficient to cover the needs of the SSA to help deal with this
issue?
Mr. HUSE. To clarify, that was to add to what we already
have received through the support of this Subcommittee and the
House Committee on Appropriations over time. We have come some
distance in the last 8 years from a very small organization to
a very respected law enforcement organization. Most of which
has occurred through the good will of this Subcommittee, and
the Committee on Appropriations.
Ms. TUBBS JONES. I think you are being generous to the
Subcommittee, and to yourself, to say that you have asked for
enough money, because if you had asked for enough money,
hopefully we would be further along than we are; and I don't
mean to be accusatory, but I am just suggesting to you that
prosecuting white-collar crime costs much more money. It costs
many more law enforcement folks. It costs a lot more time than
prosecuting a robbery or a burglary, and so the reality is that
in order to be able to do some of the things that you really
need to do to protect the people of the United States and their
SSNs, you probably haven't asked for enough money, and you may
be thinking that, well, they are probably not going to give it
to me anyway, so I am not going to ask for it, but I would
suggest to you that perhaps that might be, you might ratchet up
that request so that if all of us, as Members of Congress, are
sincere about trying to alleviate this problem for the people
of the United States, we would put our money where our mouth
is. That is all I am saying to you.
Mr. HUSE. I would say thank you, then. I will take your
counsel.
Ms. TUBBS JONES. I appreciate it. Let me also, just one
more area, Mr. Chairman. Commissioner, you say on page 5 that I
asked the Commissioner of Social Security to use the ad hoc
authority vested in the Commissioner by SSA regulations to
permit me to share SSA information with our law enforcement
partners. Can you tell me what that ad hoc authority is,
please, sir?
Mr. HUSE. Well, it is authority that allows the
Commissioner to disclose SSA information if not prohibited by
Federal law.
Ms. TUBBS JONES. Why then, if you have that extraordinary
authority under the ad hoc authority vested in the Social
Security administrator, do you need statutory authority to
enable the Inspector General to make such disclosures when
necessary to protect human lives without formal authorization
from the Commissioner?
Mr. HUSE. Well, this authority, because it is
extraordinary, is a special and time-consuming process. Often
the emergency is very time-restricted, where even seconds
count, and that is the reason for this proposal in a simple
statement.
Ms. TUBBS JONES. Under that authorization, what would be
the circumstances upon which you would want this legislation to
authorize the Commissioner to receive the--to be able to give
up my SSN?
Mr. HUSE. It is actually the data that is in, they would be
extremely limited to those, and it would be based--it is a
discretionary authority. It would be based on my judgment,
which I would have to answer for, as I do now to the
Commissioner.
Ms. TUBBS JONES. So, if you can do it already, I guess my
problem is in the name of terrorism, we have caused so many of
the rights of the people of the United States to be abridged,
and I am all for going after the terrorists and I am all for
law enforcement having what they need to do their job and just
for background, I am a former judge and I used to issue search
warrants all of the time. I just fear the process of enlarging
opportunities to give away a number that we are worried about
giving away and we can't control government, so forth and so
on, in the name of saving lives, per se. I would just suggest
that it would be a good idea when we go through this process
that we are real clear if we give away that authority that if
he already has it in an ad hoc authority, maybe we might change
the process but not expand it.
Mr. HUSE. That is what we seek in this legislation. The
same restrictions would apply. We are merely moving the process
from the Commissioner to the Inspector General, who, like the
Commissioner, is Presidentially appointed and confirmed by the
Senate. This proposal would just move the process into the law
enforcement function in Social Security. The same rules would
apply.
Ms. TUBBS JONES. There may be some advantage of having some
oversight. That is why the law enforcement has to go to the
judges to get search warrants, but I don't want to argue with
you about it. What I would like to see, though, is the proposal
that you have for the change in that authority. I thank you
very much for your time, sir.
Mr. HUSE. Thank you.
Ms. BOVBJERG. Could I add something to that, please? Ms.
Tubbs Jones, the Chairman has asked GAO to look at Social
Security's policy with regard to sharing information with law
enforcement. We are comparing it to the terms of the Privacy
Act and to the policies of other Federal agencies. In this
work, we are really looking at the balance between the privacy
associated with the personal data that the SSA maintains and
the needs of law enforcement, and of course we have been
working with Mr. Huse and his office on that. We will be
reporting out in September.
Ms. TUBBS JONES. I would be interested in hearing from you
as well, and I would say the same thing to you, to you and
anyone else looking at that area, that in the name of
terrorism, we have abridged a whole bunch of rights. Let's
think about it before we--especially to an area that has given
us so much dilemma so far. Thank you, Mr. Chairman.
Chairman SHAW. Mr. Becerra asked for another follow-up
question.
Mr. BECERRA. Thank you, Mr. Chairman. Quickly, if either of
you, any of the three of you could respond to this, the breeder
documents, I think at the end of the day we all recognize that
as much integrity as we may put into the SSA's process for
issuing cards, if the breeder documents that are used to obtain
the SSN and card are fraudulent, that are very good fraudulent
numbers or cards, identifiers, then we are still in the same
place we were before. So, how--what can we do? Is there a
carrot-or-stick approach that we can use to get the underlying
State or local authorities who issue identifiers that are used
often to obtain a SSN or any other private sector industries or
businesses that issue identifies that are also used, health
care, health insurance card, for example, which is often used
or accepted by some as an identification card. How can we make
sure that those breeder cards or identity cards can be made
more authentic? How can we provide the integrity in that
process?
Ms. BOVBJERG. Well, third-party verification is really
important. What we observed in the case of the driver's
licenses, was that the third-party verification wasn't looking
in the right place, so it was incomplete. In the other case,
the SSN they weren't checking. There wasn't a verification of
the birth record to see that the child didn't exist.
Mr. BECERRA. On that point, say the two faulty Social
Security cards you got were verified by the SSA, so even if you
take a State driver's license from whatever State and ask the
State administrator, can you verify if this is a true
identifier for you, is it an authentic State driver's license,
someone might say, yeah, because it is such a great fake,
forged document. So, how do you stop the process of creating
what are clearly very good forgeries?
Mr. BERTONI. I will take a shot at that. We have criss-
crossed the country looking at the processes for driver's
license as well as SSNs, and I reiterate what Barbara says. We
really need a system where we can have some independent third-
party verification. So, if I am coming to the table with
documents that look really good, even with training, and other
tools that a driver's license clerk is given, or an SSA person
is given, the documents are often just too good to catch. You
really need to corroborate this information with third-party
sources. In the case of the SSN, if I were to bring a birth
certificate, SSA staff should bump that against State Bureau of
Vital Statistics information from the issuing State. There are
a number of other data sources that SSA could use to
corroborate the name, date of birth, Social Security, and other
elements. If the data comes back matching and you have other
documents that corroborate the rest of the story, then you have
a comfort level and you can issue the document. The same is
true for driver's licenses. If you are a State using SSA's
online process, you are going to get the full, I guess, the
plate of services from SSA, including the death match. States
that use a batch process, are not getting that match and if
persons come to the table with a name, date of birth and SSN of
a dead person and it is on the documents, SSA could do that
check. I am sorry. The Department of Motor Vehicles could check
with SSA, and it would still come back verified.
So, again, it goes back to what third-party verification
are States doing, and what is the quality of that third-party
verification. Another aspect is that if not SSA, or another
government agency, some States use private vendors to perform
data mining, and data cross-matching across the public and
private sector sources to give the person that is verifying
your identity documents greater comfort level that you are who
you say you are. This brings me to the issue of how extensive
identity theft is, and I will use the driver's license example.
We took 1 month of transactions from 1 State and matched that
data against SSA's master death file and got initially 160
instances where it looked like someone had used the identity
documents of a deceased individual. We immediately forwarded 44
good ones to the State of issuance, because these folks were
dead 10, 15, or 20 years, and it looked like identity theft was
likely. We got a quick response back from the State that they
had issued a license or identification card to 41 of 44 of
these people. So, one State, 1 month of data show that this is
a problem. There are a lot of States out there, and identity
information is being used over and over and over again. I think
there are driver's licenses out there that are issued to folks
who shouldn't have them, and I think the problem is bigger than
we all think it is, at least in the driver's license area.
Mr. HUSE. That is why, to sum this up, I think there are so
many benefits to the cross-verification of data. Some privacy,
of course, will be abridged, but anomalies will be reduced that
everybody, whatever sector they are from, government,
commercial, financial, will have to deal with these anomalies.
These people were dead people that basically were used to
produce this, we need to get a control over, it is not just
government's problem. It is a universal problem. It will never,
ever be perfect. That is a fact. There is nothing that can't be
counterfeited. One day, though, all of this will lead us to a
place where we will go to biometrics. We have to. That is not
my role to suggest that. I just know that that is the ultimate
answer.
Mr. BECERRA. It sounds like what you are saying is, if it
is going to gain better protection of our privacy, we may have
to give up a little bit of privacy----
Mr. HUSE. We may have to give up a little. It is this
willingness to have our records cross-checked against----
Mr. BECERRA. This cross-checking isn't cheap. It is----
Mr. HUSE. No. It is expensive.
Mr. BECERRA. Mr. Chairman, thanks for the time.
Chairman SHAW. I think also by limiting the use of SSNs, we
are actually going the other way. We are pulling back and we
are increasing the right of privacy, which is something that we
seem to be losing a little bit, as Ms. Tubbs Jones was pointing
out, because of 9/11. I cannot remember a single time that I
have been asked, somebody has asked to see my Social Security
card. I am constantly asked for a SSN, and I have gotten to be,
whether it is an application or something like that, I will
just leave that blank, and usually nobody ever follows up to
ask for it. This is something we have certainly got to do
something about. When you think about the number one identifier
in this country today is a card with a name and a number on it,
period, no description, no date of birth, nothing else involved
in it and this is being used as a prime identifier, there is
something wrong with that picture and something we need to work
on. We are just so vulnerable with regard to the use of those,
and those numbers really have to be protected. Someone was--I
think Mr. Johnson brought up the question that and you can see
on that board to the right where the military identification
uses the same numbers as Social Security.
Mr. HUSE. Exactly.
Chairman SHAW. Rank, name, and serial number. I used to kid
Mr. Johnson. I would say, when you were in prison in Vietnam,
the Vietnamese have your SSN, because that is the serial
number, and when you go to many of the PXs on Army bases or any
military base, you try to give them a check and not put your
serial number on it, they won't take it, and that means that
they are getting the SSN, and we had testimony a few years ago,
I think it was a colonel whose credit was absolutely destroyed
because of, because somebody somewhere in the chain from the PX
to the bank had picked up his SSN and just used that as the
jumping off spot in order to assume his identity. We have, at
this point, a vote on the floor. I think it is a point of
order, and I assume that----
Ms. TUBBS JONES. Mr. Chairman, since we have a vote, can I
ask just one other question, real short?
Chairman SHAW. Your questions go on for a long time.
Ms. TUBBS JONES. I know.
Chairman SHAW. I have got the gavel. You are----
Ms. TUBBS JONES. Okay. I won't have any problem. Just gavel
me. By the time someone realizes that there is an identity
theft problem and they go to law enforcement, the track is
pretty cold, isn't it?
Mr. HUSE. Very often, yes.
Ms. TUBBS JONES. See. I am done, Mr. Chairman, and you
didn't even know it.
Chairman SHAW. Very good. That is a record. I am a little
confused about exactly how long we are going to be gone, but we
will be coming back and go into the second panel immediately
upon our return. So, I appreciate your patience in dealing with
the schedule that we have. We will be in recess until
approximately 10 minutes after the next vote.
[Recess.]
Chairman SHAW. We are going to go ahead and start. One of
our witnesses has not returned as yet, but the vote has been
over for a few moments and Mr. Collins is coming in now. So, we
are going to go ahead and start with the next panel. We have
Theodore Wern who is the Chicago, Illinois Regional
Coordinator, the Identity Theft Resource Center in Chicago.
Chris Hoofnagle, who is the Deputy Counsel, Electronic Privacy
Information Center. We have an additional witness from Georgia,
whom Mr. Collins will introduce when he returns. Mr. Wern.
STATEMENT OF THEODORE WERN, CHICAGO AND ILLINOIS REGIONAL
COORDINATOR, IDENTITY THEFT RESOURCE CENTER, SAN DIEGO,
CALIFORNIA
Mr. WERN. Thank you. Good afternoon. My name is Ted Wern,
and I am the Midwest Regional Coordinator for the Identity
Theft Resource Center. I am also an attorney in private
practice in Chicago, Illinois. I began my work with the
Resource Center after I recovered from my own personal identity
theft problems. My battle lasted about 3 years, and from that
process, I learned what millions of Americans have learned--
that identity theft can truly wreak havoc on a person's life.
What I have also learned as an attorney and as an educator to
corporations in this area is that identity theft can result in
some very significant liabilities for corporations. Therefore,
my role both as an attorney, and as a volunteer for the
Resource Center is to ensure responsible information handling,
both for the benefit of potential individual victims as well as
for the benefit of institutions which face potential liability
in this area. Next I would like to provide a real-life
perspective on the problem of identity theft by talking about a
small sample of cases that the Identity Theft Resource Center
has handled in the past, keeping in mind that they handle
thousands of cases each year, and these are just a few that
seem particularly relevant to this hearing.
The first case involves a widow of the September 11th
attacks. Approximately a year after her husband died in those
attacks, she found out that her deceased husband's SSN was
being used by an illegal immigrant for both fraudulent credit
purposes and employment purposes. We don't know exactly how
that person got the SSN, but public death records, which often
display SSNs, are probably a very good guess. We also handle
numerous cases involving the theft of children's identities.
Mr. Johnson had a concern about this, and in response to that,
children are becoming a new target of identity thieves. Here is
why. Basically, a child's SSN and personal information can be
stolen when the child is young, 6, 7, or 8 years old, by either
a family member or stranger. By the time the child finds out,
i.e., when the child is 18 or 19, or after adult age, to apply
for credit or sign a landlord lease, by that time the thief has
had 15 or 12 years to use that information to his or her
advantage. So, the reason the children are such a hot target is
because there is this lengthy discovery period for the crime.
The other group of cases to talk about, and one stands out
in particular, involves military personnel. I would like to
highlight a case that was the centerpiece of the Parade
Magazine issue that comes in your Sunday newspapers. It was
issued just this past Sunday. It involved a man named John
Harrison who was a retired Army captain. His name and SSN and
other personal information were stolen and used by a man who
was able to buy, for example, a Harley Davidson, who was able
to rent an apartment, was able to buy a timeshare, and the list
goes on and on, all with Mr. Harrison's name. The importance of
this article, and the story is that within hours of this
article hitting the news stands, the Resource Center was
flooded with calls and e-mails from citizens who were concerned
about their identities, and the vast majority of those citizens
were elderly persons, military personnel, and people who were
concerned about their SSN appearing or being displayed on their
military identification cards, which is a common practice,
Medicare identification cards and of course, health
identification cards as Mr. Cardin showed us a few moments ago.
The common thread from all of these cases is the fact that
the SSN is at use in all of them. Without the SSN being
available to criminals, none of these cases would have been
possible. I would love to give you hard data about how many
thieves extract their SSN from particular sources, whether they
be death records or government records, but the data just isn't
available, because, one, thieves rarely get caught; and two,
when they are caught, their stories about where they got the
information are hardly credible. What I can tell you, however,
is that the SSN is the golden piece of data for identity
thieves. A thief can only go so far with a date of birth or
with an address. The SSN rounds out the crime, and with it,
along with other information, getting fraudulent credit is as
easy as picking up the phone or signing up on the Internet. So,
even though we don't know exactly how the thieves are getting
the information, what we do know is that the number itself is
worthy of any protections, any confidentiality restrictions
that the government or the private industry can impose on it.
Let me point out that our goal here is not to create an
undo burden on industry. We have looked at this bill, and we
believe that, as Chairman Shaw indicated earlier, that it is a
balancing act. You have to look at the potential benefits of
the bill weighed against the burdens. In this case, we believe
after careful study that the benefits of this bill far outweigh
the potential burdens. With regard to that balancing, first of
all, the SSN has no intrinsic value to governments or private
industry. What I mean by that is that you don't use a SSN to
dial up a person at home. You don't send marketing materials to
a SSN. It is a random number, the only significance of which is
to identify the particular person. There is no intrinsic value
in the number itself. So, as Mr. Cardin raised before, why is
his number and my number on our health identification cards? So
that our doctor can have an emergency response number to call
us or so that our medical records can be sent to that number?
No. It is a random number, and there are plenty of other random
numbers that could replace that number. So, especially in the
area of publicly displaying these numbers on identification
cards, unless it is for a legitimate IRS purposes or some of
the exceptions that you have laid out in your bill, but for
general commercial purposes like this, it just makes no sense.
It is a random number. Why not get it out of circulation?
Also, with regard to balancing, it is important to point
out that this is not a bill that imposes huge financial or
administrative burdens on the industries or the government
agencies that are subjected to it. We are not talking about
huge capital expenditures here. We are not talking about
complete overhauls to data systems. There are simple practical
solutions of taking this number off the market, basically
removing it from circulation. Furthermore, with regard to costs
and benefits, there is an economic benefit for corporations and
government agencies to not having that number out there for two
reasons. One, there is a serious source of liability for
corporations and government agencies who are responsible for
information getting out into the public and identity thieves
grabbing it. For example, when you have a large identity theft
situation and outbreak, there is enormous class action
potential in that situation, and these sorts of cases are
growing exponentially in the marketplace today. So, this bill,
in fact, is doing what exactly some of my clients, when we give
our corporate workshops, are asking us to help them do, and
that is help them to remove sensitive information from public
display within their organizations, because they are very
concerned about this source of liability. Finally, very
obviously, as you reduce identity theft, you reduce direct
losses to merchants, to banks, to credit card companies, and
the losses in the last year we estimated at $17 billion. We
took the average direct loss of an identity theft victim,
losses that are borne by credit card companies and other
creditors, multiplied it by the number of estimated victims
which are between 700,000 and a million last year. Those are
real numbers. So, not only do you have--if you can prevent
identity theft, a prevention of liability. You also have a
prevention of direct losses. So, with these points in mind, I
think the balancing act strongly favors this bill.
[The prepared statement of Mr. Wern follows:]
Statement of Theodore Wern, Chicago and Illinois Regional Coordinator,
Identity Theft Resource Center, San Diego, California
``Identity Theft and the Social Security Number''
Members of the committee: Thank you for the opportunity to provide
both written and oral testimony for your committee today and for your
interest in the topic of identity theft.
The Identity Theft Resource Center (ITRC) is passionate about
combating identity theft, empowering consumers and victims, assisting
law enforcement, reducing business loss due to this crime and helping
victims. Our organization is honored by your invitation and will
continue to make its opinions available upon request to your
representatives over the next few months as you grapple with this
complex crime. The following testimony was written along with ITRC's
executive directors, Linda and Jay Foley, and I have their permission
to represent ITRC today at this hearing.
About ITRC and the experts testifying:
ITRC's mission is to research, analyze and distribute information
about the growing crime of identity theft. It serves as a resource and
advisory center for consumers, victims, law enforcement, legislators,
businesses, media and governmental agencies.
In late 1999, ITRC Executive Director Linda Foley founded this San
Diego-based nonprofit program after becoming a victim of identity
theft. In her case, the perpetrator was her employer. Co-Executive
Director Jay Foley has spent hundreds of hours speaking and
corresponding with thousands victims while assisting in their recovery,
listening as they discuss their revictimization by ``a system that
doesn't care, understand or listen.''
ITRC also works with credit grantors, representatives from the
credit reporting agencies (CRAs), law enforcement officers,
governmental agencies and private businesses to prevent and resolve
identity theft problems.
As one of the few groups that deal with a victim at all stages of
the recovery process, we have a unique perspective on the crime. ITRC's
information does not arise only from moment of discovery statistics.
Its information comes at the cost of minutes, hours, days, weeks,
months and years of a victim's life.
I (Theodore Wern) was an identity theft victim and serve as the
ITRC Chicago and Illinois Regional Coordinator and victim advocate. My
own case was complicated and required me to go to the extreme measure
of changing my Social Security Number (SSN) in order to stop the crime
from continuing. Because of my experiences, I am one of ITRC's
designated specialists in severe cases. Since I work with others who
must also change their SSN (only recommended in extreme situations), I
serve as one of ITRC's representatives on a taskforce with the Social
Security Administration (SSA) on defining and smoothing the procedures
for changing one's SSN in extreme cases of ID theft. My expertise as a
corporate attorney also gives me added insight into the business
implications of using the SSN as an identifier, as well as liability
issues surrounding this subject.
The ITRC has worked for a number of years to make changes in laws,
policies, business practices and trends to combat this crime. As a
result ITRC has composed a list of recommendations that we feel will
make a difference both in crime prevention (keeping the information
from the hands of criminals and preventing the issuance of fraudulent
credit) and in victim recovery.
ITRC's Testimony: ITRC has been asked to address the following
points:
The problem of identity theft including its impact on
victims
Issues surrounding the use and abuse of the SSN
Recommendations for new laws regarding the SSN, including
those listed in the Social Security Number Privacy and Identity Theft
Prevention Act of 2001 (H.R. 2036).
Part One: Summary of the Problem
H.R. 2036 succinctly summarizes the history of the creation of the
SSN and how this Pandora's box was opened. Unfortunately, in 1943,
President Roosevelt could not have predicted the impact of the
information age and the role computer technology would play in our
lives. He could not have foreseen how it would change business
practices or expose United States citizens to a harsh crime--that of
financial identity theft.
Identity theft is not a new crime. The crimes of criminal identity
theft and identity cloning (the use of another person's name instead of
your own) can be traced back to biblical times. Credit card fraud and
checking account fraud began soon after the advent of those financial
transactions.
As stated in Mr. Shaw's summary, the Federal Government requires
virtually every individual in the United States to obtain and maintain
a Social Security account number in order to pay taxes, to qualify for
Social Security benefits, or to seek employment. The use of this number
as an identifier has grown tremendously and it is now common practice
to use the SSN for purposes that have nothing to do with the extension
of credit or governmental purposes. This extensive use of the SSN
provides criminals with easy access to fresh credit and a new identity.
To an identity thief, a victim's name, date of birth and address can be
valuable, but such data alone is often not sufficient to commit
identity theft. A thief generally needs a SSN as well. Because the SSN
is ``golden data'' to the identity thief, it should be given the
greatest privacy protections.
As pointed out in Mr. Shaw's summary:
An individual's Social Security account number may be
sold or transferred without the individual's knowledge or permission.
Today, the Social Security account number is generally
regarded as the single-most widely used record identifier by both
government and private sectors within the United States.
No one should seek to profit from the sale of Social
Security account numbers in circumstances that create a substantial
risk of physical, emotional, or financial harm to the individuals to
whom those numbers are assigned.
The prevalence of the use of the Social Security account
number and the ease by which individuals can obtain another person's
Social Security account number have raised serious concerns over
privacy and opportunities for fraud.
Social Security cards may be counterfeited for illegal
aliens and individuals use false Social Security account number
information to improperly apply for and receive benefits under Federal
and State programs.
Misuse of the Social Security account number is a central
component of identity theft, considered the fastest growing financial
crime in the country as well as welfare and Social Security fraud.
Growing concern over fraud and privacy and the absence of
a comprehensive Federal law regulating the use of Social Security
account numbers prompt the need for the Congress to act.
ITRC does not believe it will be possible to completely eliminate
this crime but we certainly hope to do the following:
Make it extremely difficult for criminals to obtain SSN
and other information that can be used to commit financial identity
theft by severely cutting back on the exchange of such information.
Tighten the procedures used by the issuers of credit so
that criminals have a more difficult time in using ill-gotten
information.
Assist in victim recovery and shorten the time and duress
suffered by its victims.
Because the federal government, through the SSA, created and
maintains SSNs, it is appropriate for the federal government to take
steps to stem the abuse of SSNs both in private industry and by
governmental agencies. It will be far more efficient for the federal
government to pass regulations about the use and misuse of the SSN than
to rely on state regulations. California has come a long way in
addressing the abuse of the SSN but to do this in 49 more states would
be a daunting task.
Part Two: Victim Impact
Identity theft is a dual crime and no one is immune, from birth to
beyond death. Who are these victims? It could be you, unknown to you at
this very moment. I'd like to introduce you to some of ITRC's clients/
victims who have turned to us for assistance. Many of these cases are
taken directly from emails ITRC has received from victims. We present
them to you so that you can see what we work with on a daily basis.
Personal identifiers have been changed to protect each victim's privacy
and some grammar/spelling corrections have been made.
Case 1: Child ID theft
The victim, Jose, owes about $65,000, $4,700 in child arrears and
has 3 DUI warrants in his name. One problem: Jose is only 6 years old
now and those arrears are to himself. The perpetrator is his father,
now divorced from Jose's mother, an illegal immigrant who is subject to
deportation when found.
Case 2: Identity theft of the deceased
Perhaps one of the most poignant stories we have heard (NJ Star
Ledger reported it) is the theft of a man's identity who died in the
World Trade Center attack on Sept. 11th. His widow was notified about
10 months after the event to discuss her husband's recent auto
accident. She went through hours of turmoil only to discover that an
illegal immigrant had created a false driver's license and was living
and working as her deceased husband.
Unfortunately this is only one of more than several dozen cases
that we have worked on involving the deceased. In some cases the
imposter has purchased the information, in others the imposter is a
family member or even a caregiver. Some may ask what is the harm in
using the SSN of the deceased. Not only can identity theft involving a
deceased person affect the estate but also the survivors still dealing
with the grief of losing a loved one. In one other case, a mother has
had to fight collectors trying to collect money from accounts opened in
her daughter's name, a daughter who died several years ago. Each new
call opens up the wound again.
Case 3: Workplace identity theft
T's identity was stolen by her doctor's receptionist. She found out
when applying for her first home loan, her dream home. Months later,
after clearing her records, spending her own time to research how her
thief got her information and used it, and seeing another family move
into her home, she was able to convince authorities to prosecute her
offender. The result--the thief is now living in a halfway house,
driving the car she bought with T's identity and working for another
doctor as a staff member. T was finally able to buy a house almost 2
years later, at a higher purchase cost, with a higher interest rate due
to the multiple accounts that had been opened in her name after the
placement of a fraud alert.
Case 4: Victim recovery issue
Victim owns her own business. For the past 3 years, she has been in
a fight with her bank. They repeatedly open new fraudulent accounts in
her name and grant fraudulent access to her existing accounts, even
generating dual credit cards and sending them to the imposters as well
as herself. At one point she went to the local branch of her bank
regarding the transfer of her account information. With multiple pieces
of identification in her possession she was devastated by the bank
officers who would not acknowledge her right to discuss the accounts in
question or accept her identifying documents including passport,
driver's license, utility bills, business license and SS card. To date
she still has problems with her bank and her accounts. She is currently
talking to an attorney and plans to sue the multiple companies who
continue to torment her and refuse to correct their errors. She
believes that lawsuits are her only option left.
Case 5: Financial ID theft turns into criminal case
Two nights ago, I was arrested as part of a 4-year ongoing theft of
my identity. The arrest was over bad checks written in Lincoln, NE near
where I reside.
The issue, other than the arrest and all that goes with it, is the
fact that J.P.M. was able to open fraudulent accounts because the
Nebraska DMV issued her a license with her picture and my information.
I don't know what documentation she provided them, but we clearly do
not have the same physical features. This should have sent up a red
flag to the DMV. As a result, J.P.M. illegally used my identity to
spend almost $40,000, with new credit cards and with fraudulent checks.
I am doing the best I can to be compensated for the money spent on
bail, loss of work time, personal stress, which all occurred while I
was finishing my undergraduate degree and throughout my master's
degree. Needless to say, this has interfered with my performance in
school because of the time it takes to free myself as a citizen and as
a consumer. The arrest was the last straw, and I've been told that the
statute of limitations to sue the woman who stole my identity has
expired. I am looking for help.
Case 6: SSN used as driver's license number
Victim had car broken just prior to a move from HI to DE. A file
with all of her personal information was stolen in HI including her
driver's license that used her SSN as the identity number. Since then a
fraudulent cell phone account was setup with Voicestream generating a
bill for $10,000.00. The victim has made some payments during the
course of the account dispute due to the bullying action of collectors
threatening to attach to possessions. Because of that payment,
Voicestream refuses to acknowledge the account is fraudulent.
Case 7: Security breach
Victim was referred to ITRC by the FBI Victim/Witness Coordinator.
The victim is a 72 year old retired Air Force Major. His dentist told
him his identifying information might have been stolen. The dentist had
befriended a man who saw the victim's dental records. This man then
copied and used all of victim's info. The dentist found out when he saw
files out of place. This befriended man/handyman was the only person
who had access. The imposter purchased a condo, a BMW, and used the
victim's HMO for medical services. The victim's HMO paid for this. Upon
arrest, it was discovered that the imposter had a prior record of
fraud. The imposter is now in jail on non-related charges.
Case 8: Identity Cloning
Victim lives in San Diego and is receiving disability benefits. The
imposter is living and working in IL. Fraud is impacting her disability
benefits. The IRS and SSA have been contacted. Victim is fearful of
losing housing and being unable to cover living expenses due to the
lengthy time of recovering her good name and clearing the records.
Case 9: Co-Worker ID theft
The victim recently found out of the identity theft. In 1999, a co-
worker stole her credit card. The victim went through all the necessary
procedures with her credit card company to remove the charges including
filing a police report. In January 2002, the victim applied for a loan
with a small finance company. The victim was told her social security
number had already been used to apply for a loan with this company. The
victim retrieved the application and found it was used back in 1999 by
the same woman who stole her credit card. The victim had never been
contacted by this company. The company's reply was that they denied the
application. Unfortunately, in doing so, they did not indicate that it
was denial due to fraud but due to not enough income.
Victim did speak to the finance company about this and even spoke
with the Vice President in South Carolina who was not helpful. Victim
still has not received a copy of her credit report so she is not sure
if the imposter has done any real damage or not. Victim is certain that
she used her social security number and she is not sure how else she
can file a report if the police are not helpful.
Case 10: Extreme identity theft case
Victim's identity was stolen by a co-worker 10 years ago. She knows
who the imposter is and he has been questioned but released by police
(refusal to take action due to ``extenuating family circumstances'').
In the meantime, the victim has been unable to stop the imposter from
opening credit and checking accounts, fraudulently applying for
welfare, etc. She has had to change her SSN, driver's license number
and name, essentially recreating herself in order to separate and
protect her from the actions of the imposter.
Case 11: Reoccurring identity theft
My wife was a victim of identity theft in 1999. After many letters,
a police report and an affidavit of forgery, we thought everything was
settling. We were reassured that the loan and credit that was taken out
in our name was removed from our reports and that our credit was
restored. We asked several times for correspondence that this was taken
care of but no one returned a letter. As time passed and we received no
bills and we forgot about it. That is until we received an Equifax
report on 6-2-02 showing that the fraud was still on the report. I
tried to contact the office that I communicated with before but no one
would return my call.
The date reported was after we had notified Equifax of the dispute.
Are they in violation of the (FCRA)? Please advise or direct.
Case 12: Family ID theft
Victim's relative used victim's identity to clear out victim's bank
accounts. This relative has victim's SSN and stolen checks. Victim has
filed a police report and is in contact with the managers at her bank.
Law enforcement is not investing a great deal of time on case, usually
claiming that this is a family dispute.
Family identity theft is one of the most difficult crimes we work
on, in part due to lack of police action and in part due to the
emotional impact of this crime. How does one turn one's own mother in
to the police? Unfortunately, we receive about 3-5 of these types of
cases each week.
Case 13: Domestic abuse and harassment
The victim was divorced in 1987. She now lives in Florida. The ex-
husband is operating in San Diego. Due to the actions of her ex, the
victim is having IRS and SSA problems and is dealing with 3 accounts
opened in her name. Unfortunately ID theft is the perfect tool to
harass another person and to perpetuate domestic abuse after a divorce
or separation.
Case 14: Stolen wallet
I live in TX. On June 2, 2002 my wallet was stolen in New York
City. On June 6, 2002 a woman began using my identity from the wallet
including drivers license, social security number from a medical
insurance card, place of employment and stolen cards to establish
instant credit at 9 different stores in 3 different states. I have
placed a fraud alert on my credit report with the three credit
reporting agencies but there has already been theft totaling in excess
of $16,000 dollars. I am now having difficulty getting anyone to follow
through with a police report and also changing my drivers license
number. Because the theft occurred out of my home state, I have to
follow up on the phone and not getting much response or help.
Case 15: Military spouse
I have had the frustrating and humiliating experience of somebody
taking my maiden name and social security number in order to open
numerous fraudulent utility accounts leaving my credit reports a mess.
I am also a military wife who is required to show my social security
number on my ID card, which is used for everything.
Case 16: Enable credit granting behavior
I was a victim of credit fraud/ID theft beginning in November of
2001, and continuing until approximately April of 2002. All of the many
fraudulent credit applications using my name and identifying
information were done in the Los Angeles area. Somehow, my personal
identifying information (SSN, name, birth date, etc.) were obtained and
used to apply for instant store credit at Radio Shack, Gateway
Computers, and approximately a dozen other merchants. Additionally, my
personal credit card was ``taken over'' by these criminals. By calling
Visa and posing as me, they changed my billing address, and claimed
that they had lost the credit card. They then received my new Visa card
in the mail at the fraudulent address. They applied for many credit
cards under my name and were even successful at getting a few, then
charging the cards up to the maximum very quickly.
Case 17: Mail theft by an acquaintance
I just found out on June 14, 2002 that I am the victim of identity
theft by my housekeeper/babysitter. Since she had access to my mail it
was easy. She opened the first account in April 2001. She has charged
over 10,000.00 that I am aware of and I have jewelry etc. missing from
my home.
This is so recent that I don't even know what I'm up against yet--
what I do know is that this has hurt my eleven year old daughter very
badly. My daughter sang in the housekeeper's wedding last May, I wonder
now if the wedding was all charged to me!
I would be happy to talk to anyone about this. I live in a small
town of 12,000 people right now I know 4 people personally that this
has happened to including the president of one of the banks here in
town. Something must be done!! She is having trouble getting creditors
off her back.
Case 18: Domestic abuse, insurance fraud
My ex-husband and his employer used my Social Security number to
file medical claims on my health insurance. My ex has not been covered
on my insurance since 1999, and I have changed employers and insurance
carriers since that time. However, claims for February 2002 through May
2002 have been filed on my current insurance. He has obtained the
information without my knowledge. I found out about the claims after
receiving Explanation of Benefit forms from my insurance provider. The
claims have been denied, so the insurance provider states that they are
doing their job. The insurer will not file a report with the police.
Case 19: IRS complications
Someone has stolen my social security number and from that caused
me to have false credit bureau claims and a warning from the IRS that I
had underreported my income. Creditors have harassed me and required me
to go to extraordinary lengths to prove that I could not have incurred
the debt in question. The IRS has required extensive documentation as
well. Right now the activity has settled down, but anytime the next
shoe could fall.
Even though there is a certain person I suspect of engaging in this
identity theft, law enforcement authorities turn a deaf ear. I really
don't blame them; it's not a high priority crime to them. To me, it is
a major theft and close akin to rape.
This whole situation has been aided by the use of computers and the
overuse of the social security number. I understand that the original
law establishing the issuance of social security numbers stated that
that number should only be used for social security, but indeed that
has not been the case.
Case 20: Victim frustration--complex case
I became a victim of identity theft in March 2001. I found out when
the person who had my social security number tried to open a credit
card with a bank that I already had a card with. The woman was not able
to give my correct birthday. They contacted me but they gave me a hard
time saying that it was my daughter. They suggested that I contact the
credit agencies about a fraud alert. That is when I found out that the
person had many credit cards and a cell phone and they even bought a
computer from Dell. Since I found out early I was able to stop almost
everything before it was way out of hand. I filed a report with the
Dallas police department and talked to a detective on a regular basis;
only to find out they would do nothing. They had the address to which
the credit cards and computer were sent but they would not go there.
They even had another address where the person used a credit card in my
name to buy a pizza. It took many months to clear everything up and I
still have the fraud alert on my report for seven years. This is a
crime that is to easy for someone to do and they get away with it
because our laws are too easy and the officers are not trained on this
type of crime. I feel I am luckier then most because I found out early
and was able to clear up the damage within a year.
While you know my story, that only tells part of the picture. What
I discovered disturbed me greatly:
1. Fraud alerts only help a little. Most places do not even honor
them. So I'm not sure they help very much.
2. After I put the fraud alert on, they still opened a few more
credit cards. All of the accounts they opened were done on the
Internet.
3. I found that the credit card companies did not care much, they
just closed the accounts. But before they will close the accounts you
have to prove to them it was not you who opened the account.
4. They also made you wait on the phone a long time and you are
transferred to many people before you found one that could help you.
Most of the people I talked with acted like they were not educated
enough on the subject.
5. They treat you like it was your fault and most of them need
more training on this issue.
6. The police are no help at all.
7. The credit agencies take forever to remove the fraud accounts
from your file.
8. The victim spends hundreds of hours writing letters and phone
calls trying to remove the damage the thief caused while they are free
to go to the next victim.
9. The Laws should help the victims, but you are alone when it
comes to identify theft.
Case 21: Child ID theft
(Address, email and phone of victim will be provided to the members
of the committee upon request. Copy and paste with permission of
victim)
I am a mother of a thirteen-year-old son. I share joint legal
custody with his father, who lives in a different county. Although my
two boys primarily live with their father in ###, California, they
visit frequently and spend all of their summers and vacations with my
new husband and me.
About two years ago, my mother and I were in the process of setting
up college fund accounts for my two sons. We were informed by our
investor that my oldest son's social security number had several active
accounts and recommended that we research this matter further before
proceeding to open any financial accounts under his name and social
security number. Unfortunately for my son, the thief is his own father.
They both share the same base name and physical address. Therefore, the
theft of my son's social security number was an easy accomplishment by
his father.
In going through this case of Identity Theft, I have encountered
various problems along the way. First being that the local law
enforcement agency in the county in which my son resides with his
father, refused to take an identity theft report because their county
does not have a department that handles such matters. Because of this
and the fact that my son is a minor, it took several months, almost the
remainder of the year to obtain a copy of my sons credit report. The
three credit reporting agencies refused to issue any information
because he was a minor. Instead of investigating the matter further,
they sent a standard ``refusal to issue information letter'' based on
the fact that he was under the age of 18 and that they do not issue
reports for minors. Without this report, it has been nearly impossible
to get any response from creditors as well as getting a credit issuer
to take me seriously. The report was subsequently acquired, through
diligence and perseverance.
I have also attempted to write letters to each lender and attach a
copy of his credit report as proof of an existing account, I have had
to send follow up letter as well, and have yet to hear a reply as they
are not required to respond or assist with fraudulent accounts.
As a mother of a victim of Identity Theft, I would highly recommend
that all state and local law enforcement agencies be required to
generate a report on identity theft complaints in the jurisdiction
where the victim lives and to provide a copy of the report to the
victim, regardless of their subsequent decision on whether or not the
agency will investigate the case. If by chance, there had already been
laws in effect, it would clearly have been easier to obtain credit
reports for a minor with parental documentation. It would also have
directly influenced the ability to stop further debit from occurring.
As you might imagine the recourse for this action can lead in
several directions. Although I do not wish to amend this crime out of
vengeance towards my son's father. I am deeply worried that as my son
approaches adulthood and tries to obtain college grants, scholarships,
etcetera, he will be denied due to his already existing debt. To this
day, his father has acquired over $250,000.00 in debt under our son's
social security number. I cannot begin to imagine the long-term affect
that this amount of debt will have on my son's future.
Knowing my son as I do, it has been a difficult decision to keep
this information from him. As he has already suffered emotionally from
the divorce, I deeply fear that this will emotionally tear him apart
and sever all bonds he has created with his father. I also fear that
the impact of knowing that his father was the criminal will have a
psychological scaring on him for the remainder of his life.
Finally, in trying to rectify this matter with the social security
administration, and in conjunction with my family law attorney, this
entire matter must be handled with diligence and on an efficient
manner. Because of the fact that I share joint custody with my ex
husband, I have an incredible fear, based on past actions, that if and
when his father is confronted with the truth of his crimes, he will
then take matters to extreme action and kidnap my son, making it
impossible for me to have any further contact with him. This also
presents the problem of obtaining a new social security number. Because
our son is still a minor, the new number will have to be disclosed to
his father for medical and scholastic purposes. An even greater fear is
that his father will continue to abuse his son in this manner. Based on
passed history of his fathers actions of first destroying his own
credit, and now destroying his son's credit, what will prevent him from
committing the crime once again. Unfortunately, I do not see this cycle
ending without laws to protect victims of fraud as well as minors.
Part Three: Issues to be discussed
It is clear that a list of commonalities can be derived from ITRC's
victim accounts set forth above. Categories where the SSN has been an
instrument to create havoc include:
Use of the SSN for as a driver's license number
ID theft of the Deceased
Child identity theft
Failure of governmental agencies to find alternate ways
to protect identifying numbers used by the government: military ID
number, Medicare/state health insurance number (could be done by random
number matching to SSN in a closed, secure database)
Employer use of the SSN as an individual employee
(private or governmental) ID number, including public display of the
SSN, e.g., timecards, badges
The use of the SSN as an identifier by a business group,
printed on a card carried by the person on a regular basis
Mail theft--where the SSN is printed (unnecessarily) on
the document being mailed and is intercepted by another person
Theft of SSN given in good faith to or displayed or sold
by a business which required the information to complete a transaction
or activity--e.g., to obtain health care benefits.
Collection of information not needed for the necessary
task or program
Failure to protect collected information--e.g., disposed
of inadequately
Database or information breach--failure to provide proper
security
Database or information breach--due to the actions of an
individual who had access to the information that never should have
been collected in the first place
Domestic abuse, harassment of an ex--due to extensive use
of the SSN as an identifier
Restrictions on sale of SSN and credit info to third
parties by governmental agencies or private entities
Unrestricted ability to print SSN of individuals on web
sites, e.g. Ancestry.com
Failure to truncate parts of SSN on documents available
to the public--electronic court records, birth and death certificates,
etc., unless the requesting party has a legitimate reason for such
information
Part Four: Recommendations for Laws
ITRC likes to use a Finding/Recommendation format to advise on new
legislation. In this testimony, ITRC will limit its findings with the
belief that this esteemed committee has studied this subject at length
and does not need substantial background information.
This list is a preliminary discussion and ITRC's directors would be
honored to continue to work with the committee as they explore this
topic and prepare legislation that will protect all of us from SSN
abuse.
1. Use of the SSN as the driver's license number
Finding: At this time, individuals have a choice in those remaining
states that continue to use the SSN as the driver's license number.
This practice means that each check written includes one's SSN and that
individuals with social security numbers on their license suffer
greater loss due to lost/stolen wallets.
Recommendation: Due to lack of consumer education, ITRC believes
that states MUST be required to adopt a random number system and
replace the SSN on all drivers' licenses within 1 year of the passage
of this legislation.
2. Identity theft and the Deceased
Finding: Despite a person's death, a SSN continues to be active and
may be used for the extension of credit. The Master Death Registry
controlled by the SSA does not include the names of all deceased.
Information is added to this list in a variety of methods, some of
which are only consumer generated. Too many stories have been printed
and too many cases have occurred where a deceased individual's SSN has
been used to get credit.
Example: Florida Department of Law Enforcement agents arrested
William Troy Herman and Ronnie J. Skipper for fraud. Agents say the duo
used the personal information of seven deceased individuals to obtain
credit cards in the victims' names.
This causes problems for the estate and additional stress on the
bereaved. The letters we receive from them are painful and their
distress is evident.
Recommendation: ITRC's executive directors are currently working
with Senator Corzine and U.S. House Representative Gutierrez on
legislation to correct this issue. It would make sure that all deaths
are recorded on the death register, forwarded to the repositories that
will then mark all of those SSNs as ``Deceased, do not issue credit.''
This list must be designated as not to be sold, distributed or used for
any purpose other than the one itemized above.
3. Identity Theft of Children
Finding: There are several types of child identity theft scenarios
that ITRC typically sees:
It's a split family. One of the parents finds out that
the other parent (or the ``friend'' of the parent) has begun to use the
child's identity to gain credit or a driver's license. This is usually
because they have already ruined their own credit or driving record.
They plan on ``fixing'' everything before that child reaches 18. They
even swear they were planning on paying all the bills accrued under the
child's SSN. The reality is that they eventually will ruin the child's
credit just as they ruined their own.
Upon reaching 16, the child applies for a driver's
license. They are denied because someone already has a driver's license
using that SSN.
Upon reaching 17 and applying for a college loan, the
teen finds out he or she cannot qualify due to a poor credit rating.
This has sometimes resulted in a one-year delay in starting college.
Upon reaching 18, the now adult child is denied credit,
unable to gain employment or rent an apartment due to a poor credit
rating. They find out that someone has used their info for the past 10
years and they are $15,000 in debt. Before their true adult life has
begun, it is tainted and may take years to clear up.
Now an adult and in the workplace, the victim finds it
difficult but not impossible to get credit. Perhaps they think it is
because of their youth and that the first card they did get they
mishandled and perhaps had to pay off over time. They have never
checked their credit reports until one day a collection notice reaches
them--perhaps at the age of 25 or even 30. Once checking their credit
reports, they find out that for the last 15 years someone else has been
opening up accounts in their name.
Their imposters often are family members, parents or guardians, or
may be illegal aliens who purchased the information from traffickers
who purposely sell information that belongs to children due to the
lengthy time prior to crime discovery.
Recommendation: Elderly and children are deserving of additional
protection under the law. No one disagrees with that. We must assume
the role of caregivers and make sure that those individuals are not
abused--physically or financially. ITRC's recommendation is that the
SSA creates a list using birth records of all SSN and birthdates. This
list would be given to the repositories that may not sell, distribute
or use it for other than the intended purpose. Should a credit
application be submitted with the SSN of an individual (child) on the
list, then that application must be further investigated and such
investigation well documented. When a child reaches the age of
majority, their information would be deleted from the list. ITRC would
also like to see any person who commits child identity theft receive an
enhanced penalty for this crime.
4. The need to find alternate ways to protect identifying numbers used
by the government: military ID number, Medicare/MediCal number, etc.
Finding: On July 6, 2003, Parade Magazine's (in the Sunday paper)
centerpiece discussed identity theft. More than 70% of the emails ITRC
received were from people either concerned about lost and stolen wallet
issues or from people who are angry at either governmental agencies
(SSA, military) or health providers that place the SSN on a card they
must carry on a daily basis. Those many concerns must not go unheard.
Lost and stolen wallets are a prime way for thieves to gather
information. Unfortunately, the federal government as well as state
governments (and health providers) also use SSN as employee or member
numbers: military, elders and Medicare, etc. These numbers are seen by
dozens of people through the course of daily activities. Colleges and
universities must also be included in this list since NY is the only
state that prohibits the use of the SSN as the student identifier and
almost all college students we have spoken with have told us that it is
being used as their student ID number--often written down on rosters,
papers passed around classrooms, posted on bulletin boards, placed on
college transcripts, etc.
Recommendation: If the SSN must be in the database, then we must
find a way to assign a random number that will be on the card that is
carried and put on the multiple forms that are filled out by the
individual. Right now, college students, seniors and military are our
most vulnerable population groups due to the fact that their SSN is so
widely known and used. That number can be linked in a database if
necessary, at a high level of security. If the federal government
expects the business community to change systems, it must lead by
example.
5. Overuse of the SSN
Findings: The following categories demonstrate the problem of the
overuse of the SSN.
Employer use of SSN as individual employee (private or
governmental) ID number, including public display of such, e.g.,
timecards, timesheets, cash register use number, badges, etc.
The use of the SSN as an identifier by a business group,
printed on a card carried by the person on a regular basis.
Mail theft--where the SSN is printed unnecessarily on the
document being mailed and is intercepted by another person.
Theft of SSN given in good faith to a business who
required the information to complete a transaction or activity--e.g.,
get health care benefits.
Domestic abuse, harassment of an ex--due to extensive use
of the SSN as an identifier. Most of us know the SSN of our spouses,
ex-lovers, etc. This crime is a perfect tool to harm another.
Recommendations: Private entities may not use the SSN other than
for tax purposes or other purposes so designated by either state or
federal governmental agencies. They may not publicly display, use, sell
or share the information. Language for a bill may be found in
California's SSN Confidentiality bills, many written by CA Senator
Debra Bowen.
6. SSN Protection
Findings: It is critical that any entity, whether private or
governmental, safeguard identifying information properly. The following
categories are just some of the areas that must be included in any
legislation considered.
Need to render all sensitive information unreadable prior
to disposal, electronic or in paper format
Restrict collection of information not needed for the
necessary task or program
Need to require adequate database and paper information
storage
Need to require notification of any database or
information breach
Recommendations: It is critical that minimum standards be set for
acquiring, access, disposal, storage and breach of information fields
that include the SSN as well as other sensitive information. This
includes what information may be requested by a company and when. For
example, no one is hired on the basis of a job application. That is a
screening device and hundreds may be collected for a single job. Yet
each one asks for your SSN. Why? All they need to do at that stage is
ask if you have a SSN and would be willing to provide it upon request.
That information can be exchanged when an employer is narrowed the
field and is serious about a new hire. This protects consumers from
overextension and viewing of the SSN (think of the many applications a
job seeker fills out) and limits the company's liability in terms of
acquiring and storage of sensitive information. Language for some of
these bills can be found in some new California laws as well as in some
of the bills now under consideration at the federal level.
7. Restrictions on sale of SSN and credit info
Finding: The less people with access to SSNs, the less opportunity
there is for leakage to identity thieves.
Recommendation: Federal restrictions on the sale, exchange or
transfer of SSN and credit info to third parties by governmental
agencies or private entities.
8. Restriction on public posting of SSN
Finding: This problem falls into two categories: websites and
public records. Both allow unlimited viewing by both criminals and
people with legitimate purposes.
Recommendations:
Federal restrictions regarding the publication of SSNs of
individuals, alive or dead, on web sites, e.g., Ancestry.com.
Federal requirements to truncate parts of SSN and other
sensitive information (to be decided by committee) on documents
available to the public, e.g., electronic court records, birth and
death certificates, etc., unless the requesting party has a legitimate
reason for such information.
IN CONCLUSION:
The crime of identity theft, like any other thing in our society
grows, evolves and constantly changes along with the changes in our
society. In 1970, the writers of the FCRA could not have predicted the
credit trends and practices of the year 2003. They created the FCRA
when all business was conducted in person, in communities where people
were known and applications could be verified.
When FDR expanded the use of the SSN as an identifier, he could not
have anticipated the Pandora's box that he would open. It was
impossible to predict the impact of the information age and how
computer technology would allow a crime like identity theft to
flourish.
In 2000, the FTC held a hearing on ID theft in which ITRC
participated. The FTC has continued to monitor this crime through its
databases and through victim panels. The information has not changed,
nor have the laws. In fact, members of ITRC's staff has attended
hearings and provided information for years now to federal legislators
and governmental agencies about changes that need to be made, but few
if any bills have been passed. The most recent was passed because of
its link to Homeland Security. It imposes higher penalties for all
those criminals who are not caught in the first place.
Now it has come down to the final question. Can you meet the
challenge to create and pass the much-needed bills in a timely manner,
prior to the end of this year? If you cannot, then all this action and
activity is nothing more than talk. If you are serious about identity
theft and feel you can address it sufficiently on a national basis,
this is your opportunity to prove it. But keep in mind--we (consumer,
victims, advocates and the business community who care about combating
this crime) have high standards for the laws that you pass. We will not
accept weak laws that either do little to help the situation or weaken
existing laws that have a proven track history. State legislators will
take action where the Federal government fails to.
ITRC's sole purpose is to combat this crime and to help victims.
Its fear is that the public will be promised strong laws that allow for
expansion and redirection as this crime evolves, but such laws will
never materialize.
ITRC believes it is the time for some action. We need the subjects
covered by this testimony to be addressed and signed into law. The
greatest leaders throughout history have led by example. They never
asked of others what they were not willing to do themselves. The
federal government must also change their practices by protecting SSNs
for military personnel, our seniors and governmental employees.
Otherwise, they do not have the right to ask the business community to
comply. This administration and this Congress must take the lead and
set the standard for the rest of the country. It is up to you to show
us that this crime is being taken seriously by one and all.
Thank you for your time and consideration.
Chairman SHAW. Mr. Hoofnagle.
STATEMENT OF CHRIS JAY HOOFNAGLE, DEPUTY COUNSEL, ELECTRONIC
PRIVACY INFORMATION CENTER
Mr. HOOFNAGLE. Thank you, Chairman Shaw, and Members of the
Subcommittee. My name is Chris Hoofnagle, and I am Deputy
Counsel with the Electronic Privacy Information Center. We
appreciate the opportunity to testify on this very important
matter today. In our written testimony, we detailed the
development of the SSN and historical attempts to regulate the
identifier. As you are well aware, today the SSN plays an
unparalleled role in the identification, authentication and
tracking of Americans, but I would like to focus my comments
today on several recent developments--developments that include
large-scale theft of identity cases, the continued use of a SSN
by private sector actors, including colleges and universities
and the role of States in passing Social Security legislation.
I believe these developments continue to institute more
evidence that a national framework for privacy protection for
the SSN is necessary. Accordingly, I am here to make only one
recommendation today, and that is to ask the Committee to
reintroduce H.R. 2036 from the 107th Congress. That is an
excellent measure. Many of its provisions will allow us to put
the SSN genie back into the bottle. Often in the privacy
debate, people say it is too late, that your privacy is already
gone, but as we have seen with telemarketing, it is possible to
assign rights and responsibilities and personal data and help
put our private information back into the bottle and safeguard
individual rights.
Again, I think there are three recent trends that are worth
highlighting. The first, of course, is that the SSN continues
to be the key to identity theft, as Mr. Wern testified. In our
written testimony, we identify several cases where identity
thieves or computer crackers have targeted databases that
contain the SSN. In a New York case SSNs were stolen from a
State insurance fund, a college and several private businesses.
Another involved a computer help desk employee who using access
codes for Ford Motor Credit was able to obtain tens of
thousands of credit card reports with SSNs from Experian. Yet
another involved employees who took advantage of a patient
identification system that used the SSN to commit identity
theft. Researchers at Michigan State University recently
studied over 1,000 identity theft cases and found that victims
in 50 percent of the cases specifically reported that the theft
was committed by an employee of the company that maintained
their personal information. There is very little an individual
can do about these identity theft cases that are insider jobs
or cases where personal information is stolen from a database,
and this is one of the reasons why we think we need to get the
SSN out of circulation, to stop reliance on the identifier,
because in most cases, you can't prevent its theft.
Another trend illustrated in our written testimony is that
many public and private sector entities continue to use the SSN
for identification. As we have testified before, in most cases,
it is wholly unnecessary for a business to collect your SSN.
The Blue Cross/Blue Shield insurance cards that Representative
Cardin and Mr. Wern held up contain their SSN, and there is
absolutely no reason for them to do that. They could assign a
random identifier, and the only case where they actually need
to collect the SSN is when your health costs actually have a
tax consequence. Nevertheless, recent news reports indicate
that major companies, including Blockbuster Video, Sam's Club,
and Costco continue to demand a SSN for membership. A related
problem is that many colleges and universities in the country
continue to use a SSN as the primary student identifier. In a
recent study done by the American Association of Collegiate
Registrars of 1,300 institutions, half of those polled claim
that they still use a SSN as a primary identifier. It is
actually on the card, the student identity card, or in the
record database.
These trends involving use and misuse of the SSN and
identity theft have actuated State leaders to create new
protections for personal information. In the college and
university context, about six States have passed laws saying
that schools can't use the SSN as the identifier. In Florida,
there was a special grand jury report that recommended that
SSNs be scrubbed from public records and from private
institutions. They noted specifically that one of the major
problems about the SSN was that local governments were asking
for it, and then the local government would place it in the
public record. In California, Senate bill S. 1386 went into
effect just a couple weeks ago, and that legislation requires
people who maintain databases that have SSNs in it, to give
notice to individuals if their SSN is stolen out of the
database. So, assigning a responsibility to people who actually
collect the SSN or maintain it can often create new
protections. I see that my red light is on, so let me just come
to our recommendation, and that is that we do hope that
Chairman and other Members will reintroduce H.R. 2036, and we
have ideas for substantive improvements to it that we are happy
to share with you, many of which are included in our written
testimony. Thank you for the opportunity to testify today.
[The prepared statement of Mr. Hoofnagle follows:]
Statement of Chris Jay Hoofnagle, Deputy Counsel, Electronic Privacy
Information Center
Chairman Shaw, Ranking Member Matsui, and Members of the
Subcommittee, thank you for extending the opportunity to testify on use
and misuse of Social Security Numbers.
My name is Chris Hoofnagle and I am deputy counsel with the
Electronic Privacy Information Center (EPIC), a not-for-profit research
organization based in Washington, D.C. Founded in 1994, EPIC has
participated in cases involving the privacy of the Social Security
Number (SSN) before federal courts and, most recently, before the
Supreme Court of New Hampshire.\1\ EPIC has also taken a leading role
in campaigns against the use of globally unique identifiers (GUIDs)
involving the Intel Processor Serial Number and the Microsoft
Corporation's Passport identification and authentication system. EPIC
maintains an archive of information about the SSN online at http://
www.epic.org/privacy/ssn/.
---------------------------------------------------------------------------
\1\ Estate of Helen Remsburg v. Docusearch, Inc., et al, C-00-211-B
(N.H. 2002). In Remsburg, the ``Amy Boyer'' case, Liam Youens was able
to locate and eventually murder Amy Boyer through hiring private
investigators who tracked her by her date of birth, Social Security
Number, and by pretexting. EPIC maintains information about the Amy
Boyer case online at
http://www.epic.org/privacy/boyer/.
---------------------------------------------------------------------------
I appreciate the opportunity to testify today. In the testimony
below, we will first review historical and recent attempts to regulate
the use of the SSN. This section demonstrates that there is ample
legislative and judicial support for limitations on the collection and
use of the SSN.
The second section describes trends involving the SSN. These
include:
A statistical rise in identity theft complaints to
federal authorities.
The occurrence of several large-scale identity theft
cases, many of which involved ``insiders'' or other trusted persons who
had access to SSNs.
Colleges, universities, and other schools continue to
identify students by the SSN.
Health providers and insurance companies continue to
identify individuals by the SSN.
Companies continue to condition access to products and
services on disclosure of the SSN.
Litigation has provided more privacy for SSNs in some
cases.
Privacy advocates and other activists have posted public
officials' SSNs to protest government activity.
A number of states are innovating solutions to the SSN
problem.
Finally, in the last section we recommend that the Committee
revisit 107 H.R. 2036, The Social Security Number Privacy and Identity
Theft Protection Act of 2001. That bill, which enjoyed wide bipartisan
support in the last Congress, should be reintroduced and passed by this
Congress. Alternatively, we recommend that the Committee consider 108
H.R. 1931, the Personal Information Privacy Act of 2003. That bill
would establish important protections for the SSN, including moving the
SSN ``below the line'' on the credit report.
I. Historical Regulation of the Collection and Use of the SSN
The Social Security Number (SSN) was created in 1936 as a nine-
digit account number assigned by the Secretary of Health and Human
Services for the purpose of administering the Social Security laws.
SSNs were first intended for use exclusively by the federal government
as a means of tracking earnings to determine the amount of Social
Security taxes to credit to each worker's account. Over time, however,
SSNs were permitted to be used for purposes unrelated to the
administration of the Social Security system. For example, in 1961
Congress authorized the Internal Revenue Service to use SSNs as
taxpayer identification numbers.
A major government report on privacy in 1973 outlined many of the
risks with the use and misuse of the Social Security Number. Although
the term ``identify theft'' was not yet in use, Records Computers and
the Rights of Citizens described the risks of a ``Standard Universal
Identifier,'' how the number was promoting invasive profiling, and that
many of the uses were clearly inconsistent with the original purpose of
the 1936 Act. The report recommended several limitations on the use of
the SSN and specifically said that legislation should be adopted
``prohibiting use of an SSN, or any number represented as an SSN for
promotional or commercial purposes.'' \2\
---------------------------------------------------------------------------
\2\ Department of Health, Education, and Welfare, Records,
Computers, and the Rights of Citizens 108-35 (MIT 1973) (Social
Security Number as a Standard Universal Identifier and Recommendations
Regarding Use of Social Security Number).
---------------------------------------------------------------------------
In response to growing risks over the accumulation of massive
amounts of personal information and the recommendations contained in
the 1973 report, Congress passed the Privacy Act of 1974.\3\ Among
other things, this Act makes it unlawful for a governmental agency to
deny a right, benefit, or privilege merely because the individual
refuses to disclose his SSN. This is a critical principle to keep in
mind today because consumers in the commercial sphere often face the
choice of giving up their privacy, their SSN, to obtain a service or
product. The drafters of the 1974 law tried to prevent citizens from
facing such unfair choices, particularly in the context of government
services. But there is no reason that this principle could not apply
equally to the private sector, and that was clearly the intent of the
authors of the 1973 report.
---------------------------------------------------------------------------
\3\ 5 U.S.C. 552a.
---------------------------------------------------------------------------
Section 7 of the Privacy Act further provides that any agency
requesting an individual to disclose his SSN must ``inform that
individual whether that disclosure is mandatory or voluntary, by what
statutory authority such number is solicited, and what uses will be
made of it.'' At the time of its enactment, Congress recognized the
dangers of widespread use of SSNs as universal identifiers. In its
report supporting the adoption of this provision, the Senate Committee
stated that the widespread use of SSNs as universal identifiers in the
public and private sectors is ``one of the most serious manifestations
of privacy concerns in the Nation.'' Short of prohibiting the use of
the SSN outright, the provision in the Privacy Act attempts to limit
the use of the number to only those purposes where there is clear legal
authority to collect the SSN. It was hoped that citizens, fully
informed where the disclosure was not required by law and facing no
loss of opportunity in failing to provide the SSN, would be unlikely to
provide an SSN and institutions would not pursue the SSN as a form of
identification.
It is certainly true that the use of the SSN has expanded
significantly since the provision was adopted in 1974. This is
particularly clear in the financial services sector. In an effort to
learn and share financial information about Americans, companies
trading in financial information are the largest private-sector users
of SSNs, and it is these companies that are among the strongest
opponents of SSN restrictions.
Outside the financial services sector, many companies require the
SSN instead of assigning an alternative identifier. These requirements
appear in a myriad of commercial interchanges, many of which absolutely
do not require the SSN. For instance, Golden Tee, a popular golf video
game, requires players to enter their SSN in order to engage in
``tournament play.'' \4\ The company could assign its own identifier
for players, but instead relies upon the SSN, which puts players at
risk by requiring them to further circulate personal information.
---------------------------------------------------------------------------
\4\ Official ITS Rules, at http://www.itsgames.com/ITS/
its_rules.htm.
---------------------------------------------------------------------------
It is critical to understand that the legal protection to limit the
collection and use of the SSN is still present in the Privacy Act and
can be found also in recent court decisions that recognize that there
is a constitutional basis to limit the collection and use of the SSN.
When a Federal Appeals court was asked to consider whether the state of
Virginia could compel a voter to disclose an SSN that would
subsequently be published in the public voting rolls, the Court noted
the growing concern about the use and misuse of the SSN, particularly
with regard to financial services.\5\ The Fourth Circuit said:
---------------------------------------------------------------------------
\5\ Greidinger v. Davis, 988 F.2d 1344 (4th Cir. 1993).
Since the passage of the Privacy Act, an individual's concern
over his SSN's confidentiality and misuse has become
significantly more compelling. For example, armed with one's
SSN, an unscrupulous individual could obtain a person's welfare
benefits or Social Security benefits, order new checks at a new
address on that person's checking account, obtain credit cards,
or even obtain the person's paycheck. . . . Succinctly stated,
the harm that can be inflicted from the disclosure of a SSN to
an unscrupulous individual is alarming and potentially
financially ruinous.\6\
---------------------------------------------------------------------------
\6\ Id.
---------------------------------------------------------------------------
The Court said that:
The statutes at issue compel a would-be voter in Virginia to
consent to the possibility of a profound invasion of privacy
when exercising the fundamental right to vote. As illustrated
by the examples of the potential harm that the dissemination of
an individual's SSN can inflict, Greidinger's decision not to
provide his SSN is eminently reasonable. In other words,
Greidinger's fundamental right to vote is substantially
burdened to the extent the statutes at issue permit the public
disclosure of his SSN.\7\
---------------------------------------------------------------------------
\7\ Id.
The Court concluded that to the extent the Virginia voting laws,
``permit the public disclosure of Greidinger's SSN as a condition of
his right to vote, it creates an intolerable burden on that right as
protected by the First and Fourteenth Amendments.'' \8\
---------------------------------------------------------------------------
\8\ Id.
---------------------------------------------------------------------------
In a second case, testing whether a state could be required to
disclose the SSNs of state employees under a state open record law
where there was a strong presumption in favor of disclosure, the Ohio
Supreme Court held that there were privacy limitations in the federal
Constitution that weighed against disclosure of the SSN.\9\ The court
concluded that:
---------------------------------------------------------------------------
\9\ Beacon Journal v. City of Akron, 70 Ohio St. 3d 605 (Ohio
1994).
---------------------------------------------------------------------------
We find today that the high potential for fraud and victimization
caused by the unchecked release of city employee SSNs outweighs the
minimal information about governmental processes gained through the
release of the SSNs. Our holding is not intended to interfere with
meritorious investigations conducted by the press, but instead is
intended to preserve one of the fundamental principles of American
constitutional law--ours is a government of limited power. We conclude
that the United States Constitution forbids disclosure under the
circumstances of this case. Therefore, reconciling federal
constitutional law with Ohio's Public Records Act, we conclude that
[the provision] does not mandate that the city of Akron discloses the
SSNs of all of its employees upon demand.\10\
---------------------------------------------------------------------------
\10\ Id.
---------------------------------------------------------------------------
In an important recent case from the U.S. Court of Appeals for the
D.C. Circuit, a Court upheld the Federal Trade Commission's
determination that SSNs are nonpublic personal information under the
Gramm-Leach-Bliley Act.\11\ The Court rejected First and Fifth
Amendment challenges to regulations that restricted the use of the SSN
without giving the individual notice and opportunity to opt-out.
Additionally, the Court upheld regulations that prohibited the reuse of
SSNs that are furnished to credit reporting agencies.\12\
---------------------------------------------------------------------------
\11\ Trans Union L.L.C. v. Fed. Trade Comm'n, No. 01-5202, 295 F.3d
42 (D.C. Cir. 2002), at http://pacer.cadc.uscourts.gov/common/opinions/
200207/01-5202a.txt.
\12\ Id. In another recent case, the D.C. Circuit rejected a First
Amendment challenge to the use of credit reports for marketing
purposes. Trans Union v. FTC, 245 F.3d 809 (D.C. Cir. 2001), cert.
denied, 536 U.S. 915 (2002).
---------------------------------------------------------------------------
While it is true that many companies and government agencies today
use the Social Security Number indiscriminately as a form of
identification and authentication, it is also clear from the 1936 Act,
the 1974 Privacy Act, and these three cases--Greidinger v. Davis,
Beacon Journal v. City of Akron, and Trans Union v. FTC--that there is
plenty of legislative and judicial support for limitations on the
collection and use of the SSN. The question is therefore squarely
presented whether the Congress will at this point in time follow in
this tradition, respond to growing public concern, and establish the
safeguards that are necessary to ensure that the problems associated
with the use of the SSN do not increase.
II. Recent SSN Trends
Just in the last eighteen months, there have been a number of
important SSN developments. These developments, which range from large-
scale incidents of identity theft to continued reliance on the SSN in
the private sector, underscore the continued need for a national
framework of protections for the SSN.
Identity Theft Complaints Increase
The FTC reported on January 22, 2003 a large increase in the number
of fraud complaints and a doubling of the dollar loss attributable to
fraudulent activities directed at US Consumers.\13\ The agency noted
that the number of fraud complaints rose from 220,000 in 2001 to
380,000 in 2002 and the loss to consumers grew from $160 million in
2001 to $343 million in 2002. The report revealed that identity theft
topped the list, accounting for 43% of the complaints lodged in the
Consumer Sentinel database.
---------------------------------------------------------------------------
\13\ Fraud Charges Jump in 2002 on Consumer Complaints, ID Thefts,
Electronic Commerce & Law Report, Vol 8(4), Jan. 29, 2003, 88.
---------------------------------------------------------------------------
The SSN Continues to be the Key to Identity Theft
On January 10, 2002, a special Florida grand jury commissioned to
investigate identity theft recommended stronger legal protections for
personal data, including SSNs, held by business and State agencies.\14\
It called for laws that would prohibit the credit industry from selling
personal data without consumer consent, and would stop State agencies
from disseminating personal information under the open records law
without individual consent, court order, or the articulation of a
compelling need. The panel charged 33 individuals with criminal use of
personal identifying information, fraud, grand theft, and money
laundering. The grand jury estimated that the current $2.5 billion
nationwide cost of identity theft is expected to grow to $8 billion by
2005. It cited health clubs and video rental stores requiring SSNs on
applications and local governments asking for SSNs on routine
transactions.
---------------------------------------------------------------------------
\14\ Identity Theft in Florida, Sixteenth Statewide Grand Jury
Report, SC 01-1095, Supreme Court of Florida, Jan. 10, 2002, at http://
www.idtheftcenter.org/attach/FL_idtheft_gj.pdf;see also Florida ID
Theft Panel Backs More Safeguards for Government and Corporate Data,
Privacy Times, Vol 22(3), Jan. 30, 2002, 3-4.
---------------------------------------------------------------------------
In August 2002, New York Attorney General Eliot Spitzer reported
that law enforcement authorities had broken ``a massive identity theft
ring.'' \15\ The information involved included SSNs, credit card
numbers, and bank account information stolen from the NY State
Insurance Fund, Social Security Administration, Empire State College,
WNYC radio, Hollywood video, Worldcom Wireless, and American Express.
The indictment alleges that this personal information was stolen
between 1998 and 2002, and used to purchase computer equipment, cell
phones, and other merchandise.
---------------------------------------------------------------------------
\15\ New York Authorities Say They've Cracked `Massive' Identity
Theft Ring, Four Indicted, Electronic Commerce & Law Report, Vol 7(31),
Aug. 7, 2002, p. 794.
---------------------------------------------------------------------------
In November 2002, it was discovered that a former computer help
desk employee had obtained 30,000 credit reports directly from a credit
reporting agency. The former employee sold the reports to others for
between $30-60 each.\16\ The information was used for credit fraud.
---------------------------------------------------------------------------
\16\ Huge ID-theft ring broken; 30,000 consumers at risk, Seattle
Times, Nov. 26, 2002.
---------------------------------------------------------------------------
In December 2002, personal health care information, including SSNs,
of more than 500,000 military personnel, retirees and family members in
16 Midwestern and western States were stolen from a military
contractor. Also stolen were some active-duty service members' claims
processing information, which include their names, SSN, and list of
medical procedures and diagnosis codes for medical care already
performed.\17\ TriWest stated that it attempted to notify beneficiaries
by sending them letters and by posting notices on its web site. The
database was not encrypted and TriWest relied on the SSN as an
identifier.
---------------------------------------------------------------------------
\17\ Patient Data, 500,000 SSNs Stolen From DOD System, Privacy
Times, Vol 23(1), Jan. 2, 2003, 2.
---------------------------------------------------------------------------
In February 2003, two former employees of health facilities and six
others were charged with stealing patient SSNs that were used to open
fraudulent credit card and phone accounts.\18\ The suspects stole
$78,000 in goods and services. One of the facilities involved has now
implemented a new patient information system that doesn't label
patients by the SSN.
---------------------------------------------------------------------------
\18\ Margaret Zack, Eight charged with stealing patient IDs for
credit cards, Star Tribune, Feb. 21, 2003, p. 1B.
---------------------------------------------------------------------------
Because of these and other developments, the Wall Street Journal,
in its 2003 ``to not do list,'' advised individuals not to give out
their SSN: ``Don't give out your Social Security number unless you have
to: With identity theft a growing problem, you should be extremely
cautious about giving out that information. Many organizations ask for
it, from volunteer groups to retail stores to Web sites, but not all of
them require you to provide it.'' \19\
---------------------------------------------------------------------------
\19\ A To-Don't List For the New Year, Hot to Fix Your Life in
2003, Wall Street Journal, Dec. 31, 2002.
---------------------------------------------------------------------------
But as the cases listed above illustrate, many identity theft cases
are ``insider jobs,'' committed by employees who obtain access and
misuse individuals' personal information stored in their employers'
databanks. Researchers at Michigan State University recently studied
over 1000 identity theft cases and found that victims in 50% of the
cases specifically reported that the theft was committed by an employee
of a company compiling personal information on individuals.\20\ There
is very little that an individual can do to prevent insider jobs, or
cases where the SSN is stolen from a database.
---------------------------------------------------------------------------
\20\ Study forthcoming; results provided in email from Judith M.
Collins, Ph.D., Associate Professor, Leadership and Management Program
in Security School of Criminal Justice, Michigan State University to
EPIC (Apr. 22, 2003, 18:13:35 EST) (on file with EPIC).
---------------------------------------------------------------------------
The SSN is Still Being Used as a Student Identifier
Although privacy protections are important to students, student
development, and to principles of academic freedom, schools have not
always been sensitive to student informational privacy issues. A
handful of states, including Arizona,\21\ New York,\22\ Rhode
Island,\23\ and Wisconsin \24\ have enacted laws to regulate college
and university use of the SSN. Nevertheless, in a survey of 1,300
institutions polled by the American Association of Collegiate
Registrars and Admissions Offers, half reported that they use the SSN
as the primary student identifier.\25\
---------------------------------------------------------------------------
\21\ Ariz. Rev. Stat. 15-1823.
\22\ N.Y. Educ. Code 52-b.
\23\ 42-72.5-2(6); 16-38-5.1.
\24\ Wisc. Stat. Ann. 118.169.
\25\ Kristen Gerencher, Social Security numbers up for grabs.
Companies, government lax in preventing identity theft, CBS
MarketWatch, May 7, 2002, at http://cbs.marketwatch.com/news/
story.asp?guid=%7B9A569387%2DE7FD%2D44AB%2D8F5F%2D112D25915DA5%
7D&siteid=mktw
---------------------------------------------------------------------------
In August 2002, it was revealed that a Princeton admissions officer
used the SSNs of applicants to his school to view the Yale University's
web site for admissions. The unauthorized entry allowed Princeton to
learn whether Yale had accepted students who had applied to both
schools. Cracking the system was easy: Anyone who knew an applicant's
birth date and SSN could log on.\26\
---------------------------------------------------------------------------
\26\ John Schwartz, Privacy vs. Security on Campus, The New York
Times, Aug. 4, 2002, p. 3.
---------------------------------------------------------------------------
In March 2003, federal prosecutors charged a University of Texas
student with breaking into a school database and stealing more than
55,000 student, faculty, and staff names and SSNs. The student was
charged with violating the Computer Fraud and Abuse Act of 1986 and the
Identity Theft and Assumption Deterrence Act of 1998. This occurrence
led to a new Texas law protecting against identity theft.\27\
---------------------------------------------------------------------------
\27\ Univ. of Texas SSN, Privacy Times, Vol 23(6), Mar. 17, 2003,
11.
---------------------------------------------------------------------------
Also in March 2003, it was reported that the California State
University's $662 million computer system contains a security flaw that
gives users access to student and employee SSNs and other confidential
data. The problem was known for years, and university officials had
told state auditors they were not going to fix the vulnerability,
citing cost and time concerns.\28\
---------------------------------------------------------------------------
\28\ Terri Hardy, CSU computer flaw allows access to confidential
data, The San Diego Union Tribune, Mar. 22, 2003, p. A-13.
---------------------------------------------------------------------------
In May 2003, a 17-year-old student of a Chino, CA high school
allegedly cracked the school's computer system, changing his and a
classmate's grades and also tapping into confidential student
information, including the SSN.\29\ Apparently, 1,744 students had
their SSNs in the database.
---------------------------------------------------------------------------
\29\ Kristina Sauerweine, Youth Hacked Into Database, Los Angeles
Times, May 21, 2003, p. 5.
---------------------------------------------------------------------------
For model approaches to the transition to an alternative student
identifier, I would look to the leadership of Virginia Rezmierski,
Professor at the Gerald R. Ford School of Public Policy at the
University of Michigan.\30\ Additionally, officials at the University
of Illinois have established a procedure to reduce reliance on the
SSN.\31\ The University of Pennsylvania is addressing the issue as
well. That institution appointed Lauren Steinfeld, a former privacy
expert at the Office of Management and Budget, to address SSN issues.
---------------------------------------------------------------------------
\30\ See also Privacy and the Handling of Student Information in
the Electronic Networked Environments of Colleges and Universities,
EDUCAUSE White Paper, Apr. 1997, at http://www.educause.edu/ir/library/
pdf/pub3102.pdf.
\31\ Carol Livingstone, Mike Corn & Lisa Huson, University of
Illinois Social Security Number Policy Implementation, Jan. 10, 2001,
at http://www.ssn.uillinois.edu/assets/applets/
UIUC_SSN_Presentation_1_10_2002.pdf; Andrea L. Foster, U. of Illinois
May Be a Model in Protecting Privacy, Chronicle of Higher Education,
Aug. 2, 2002.
---------------------------------------------------------------------------
The SSN Has Become a Default Health Identifier
Many medical providers are using the SSN as a patient identifier.
As David Miller noted in testimony before the National Committee on
Vital Health Statistics:
``It should be noted that the 1993 WEDI [Workgroup for Electronic
Data Interchange] Report, Appendix 4, Unique Identifiers for the Health
Care Industry, Addendum 4 indicated 71% of the payers responding to the
survey based the individual identifier on the Member's Social Security
Number. However 89% requested the insured's Social Security Number for
application of insurance. Clearly the Social Security Number is the
current de facto identifier. . . .'' \32\
---------------------------------------------------------------------------
\32\ Testimony of David S. Miller, Director, Health System
Services, UHC, on the Unique Patient Identification Number at the
National Committee on Vital Health Statistics hearing in Chicago, Jul.
21, 1998, at http://www.cchconline.org/privacy/uhc.php3.
---------------------------------------------------------------------------
But individuals and companies are resisting such use of the SSN.
Acting on employees' suggestions, I.B.M. has requested that health
companies stop using the SSN on insurance cards. According to IBM,
fifteen insurers, which cover about 30,000 of the company's 500,000
employees worldwide have either not responded or indicated that they
will not comply with the request.\33\
---------------------------------------------------------------------------
\33\ Marc Ferris, IBM asks providers to drop SSNs, New York Times,
Feb. 23, 2003, p. 3.
---------------------------------------------------------------------------
SSN Required for Access to Products, Services
Major companies, including Blockbuster, Sam's Club and Costco
continue to demand the SSN and other unnecessary information on their
applications for access to products and services.\34\
---------------------------------------------------------------------------
\34\ A dubious privilege, Chicago Tribune, Feb. 23, 2003, p. 2.
---------------------------------------------------------------------------
SSN Litigation Has Yielded Mixed Results for Privacy Protection
In February 2002, the New Hampshire Supreme Court ruled for the
first time that New Hampshire State residents can sue companies that
sell their personal data or SSN, or obtain their work address through
the use of pretextual phone calls.\35\ The Court found that the sale of
such data was actionable if it subjected a person to foreseeable harm.
It also ruled that people have a reasonable expectation of privacy in
their SSNs, even though SSNs must be disclosed in certain
circumstances. The ruling clears the way for a trial against
Docusearch, the information broker who sold the SSN, home and work
address of Amy Boyer to the man who stalked and murdered her.
---------------------------------------------------------------------------
\35\ Helen Remsburg, Admin of the Estate of Amy Boyer v.
DocuSearch, Inc., et al 2002 U.S. Dist. LEXIS 7952, NH Supreme Court
No. 2002-255, Feb. 18, 2002; N.H. Supreme Court Backs Privacy for SSNs,
Personal Data, Privacy Times, Vol 23(4), Feb. 18, 2003, 3-4.
---------------------------------------------------------------------------
In September 2002, the Fourth Circuit held that individuals cannot
recover damages under the Privacy Act without a showing of actual
harm.\36\ This ruling is in conflict with the law in several other
circuits, and the Supreme Court has granted certiorari in the case. In
Doe v. Chao, the Department of Labor used individuals' SSNs to identify
their compensation claims. As a result, the SSNs were cited in public
records and are now widely available. Although the plaintiff was
embarrassed and placed at risk as a result of the disclosure, the
Fourth Circuit held that one needs other manifestations of emotional
distress in order to prove that harm occurred. We believe that the
Fourth Circuit improperly interpreted the damages section of the
Privacy Act, and we plan to file an amicus brief with the Supreme Court
in support of the plaintiff.
---------------------------------------------------------------------------
\36\ Doe v. Chao, 306 F.3d 170 (4th Cir. 2002).
---------------------------------------------------------------------------
In June 2003, a federal judge in Detroit ruled that the Privacy Act
creates a private right of action for violating procedural rules
relating to SSNs, but only as they apply to federal agencies, not
states or municipalities.\37\ Judge Anna Taylor dismissed a suit
seeking Privacy Act damages from the City of Detroit after its
contractor mailed tax forms to residents with their SSNs printed on the
mailing label. The Judge stated that plaintiff Daniel Schmitt failed to
show that he was adversely affected or that Detroit acted willfully or
intentionally because like the IRS, most local and State tax
authorities request SSN for taxpayer identification purposes. The City
vowed to keep SSNs off labels and attach a disclosure statement to the
tax forms about SSNs, as required by the Privacy Act.\38\
---------------------------------------------------------------------------
\37\ Schmitt v. City of Detroit, et al. 2003 U.S. Dist. LEXIS
10246, (E.D. Mich. 2003).
\38\ Privacy Act Permits Suits Over SSNs, but Not Against Cities,
Privacy Times, Vol 23(13), Jul. 1, 2003, 6.
---------------------------------------------------------------------------
SSNs Are Being Used for Political Protest
California-based Foundation for Taxpayer and Consumer Rights posted
partial SSNs of state legislators who voted in opposition of privacy
legislation.\39\ The group purchased the SSNs online for $26,
demonstrating that access to sensitive information is convenient and
inexpensive.
---------------------------------------------------------------------------
\39\ Christian Berthelsen, Extreme lobbying upsets Assembly,
Lawmakers mad at response to killing privacy bill, San Francisco
Chronicle, Jun. 19, 2003, at http://www.sfgate.com/cgi-bin/
article.cgi?file=/c/a/2003/06/19/ MN127207.DTL.
---------------------------------------------------------------------------
In June 2003, the Attorney General of Washington State decided not
to defend a law designed to prohibit a web site that posts the names,
addresses and home-phone numbers of police in Western Washington. As a
result, Bill Sheehan III of Mill Creek is free to continue publishing
his web site, www.justicefiles.org, which includes names and salaries
of many Western Washington police officers and in some cases their
SSNs, birth dates, home addresses and phone numbers. Sheehan claims
that publishing such information is the best way to hold law-
enforcement officers accountable to the public.\40\
---------------------------------------------------------------------------
\40\ State won't defend law to shut down Web site that publishes
police data, Seattle Times, Jun. 24, 2003, p. B3.
---------------------------------------------------------------------------
States Innovating Solutions
California's Senate Bill 1386 went into effect on July 1, 2003.\41\
That legislation requires companies that maintain SSNs and other
personal information to notify individuals when they experience a
security breach. The bill came in response to an April 2002 incident in
which the records of over 200,000 state employees were accessed by a
computer cracker. The California legislation exceeds federal
protections, as there is no national requirement for notice to
individuals when personal information is accessed without
authorization.
---------------------------------------------------------------------------
\41\ http://www.leginfo.ca.gov/cgi-bin/
postquery?bill_number=sb_1386&sess=PREV&house= B&author=peace
---------------------------------------------------------------------------
More specifically, the legislation creates a notice requirement
where there has been an unauthorized acquisition of an individual's
name along with a Social Security Number, a driver's license number, or
an account number and corresponding access code. The notice requirement
is also triggered when there is a reasonable belief that a security
breach occurred. Notice must be given ``in the most expedient time,''
but may be delayed where it would impede a criminal investigation.
Although this state law does not directly regulate collection or
use of the SSN, it is likely to provide more privacy for Californians.
The legislation places new responsibilities on those who collect the
SSN, as a result, businesses are more likely to avoid collecting the
SSN.
III. Recommendations
107 H.R. 2036, The Social Security Number Privacy and Identity
Theft Protection Act of 2001, was a good proposal. This Congress should
revisit and pass this important bill.
We recommend that the Committee visit the Social Security Number
Privacy and Identity Theft Protection Act of 2001, 107 H.R. 2036, as a
guide to limiting the use of the SSN. The measure was sponsored by
Representative Clay Shaw (R-FL). In the 107th Congress, the bill
enjoyed bi-partisan sponsorship of over 70 Members. The measure
contained a comprehensive set of rights to protect individuals from
identity theft.
Title I of the bill would have established important protections
against public-sector sale or display of SSNs. These provisions will
prohibit the display of the SSN on checks and government-issued
employment cards. The bill would have prohibited disclosure of the SSN
to inmates, and appearance of the SSN in public records. Increasingly,
public records are a source for the collection of personal identifiers
that then can be reused for any purpose.
The bill would have also prohibited ``coercive disclosure'' of the
SSN--the practice of denying a product or service when an individual
refuses to give a SSN. Additionally, Section 203 of that bill would
have placed the SSN ``below the line'' on credit reports. This is an
important and much needed protection that would stem trafficking in
SSNs.
Alternatively, we recommend that the Committee consider 108 H.R.
1931, the Personal Information Privacy Act of 2003. That bill was
introduced by Representative Kleczka (D-WI) in May and referred to the
Committee on Ways and Means. H.R. 1931 would establish important
protections for the SSN, including moving the SSN ``below the line'' on
the credit report. The bill would also limit the use of ``transaction
and experience'' information, and require opt-in consent before credit
or insurance prescreening letters are sent. Such letters are a major
source of the identity theft problem. Under the bill, aggrieved
individuals have a private right of action against violators.
IV. Conclusion
Without a framework of restrictions on the collection and use of
the SSN and other personal identifiers, identity theft will continue to
increase, endangering individuals' privacy and perhaps the security of
the nation. The best legislative strategy is one that discourages the
collection and dissemination of the SSN and that encourages
organizations to develop alternative systems of record identification
and verification. It is particularly important that such legislation
not force consumers to make unfair or unreasonable choices that
essentially require trading the privacy interest in the SSN for some
benefit or opportunity.
It is important to emphasize the unique status of the SSN in the
world of privacy. There is no other form of individual identification
that plays a more significant role in record-linkage and no other form
of personal identification that poses a greater risk to personal
privacy. Given the unique status of the SSN, its entirely inappropriate
use as a national identifier for which it is also inherently
unsuitable, and the clear history in federal statute and case law
supporting restrictions, it is fully appropriate for Congress to pass
legislation.
I am grateful for the opportunity to testify this afternoon and
would be pleased to answer your questions.
Chairman SHAW. We have your written testimony. It will be
made part of the record, and it will be examined closely. Mr.
Collins, will you introduce Mr. Edwards, please.
Mr. COLLINS. It is my pleasure, Mr. Chairman, to introduce
to you a fellow Georgian, Mr. Steve Edwards. Mr. Edwards joined
the Georgia Bureau of Investigation in 1973. For the last 15
years, his work has focused specifically on financial
investigations, health care fraud, and computer crime
investigations. He has been on the National White Collar Crime
Center Board since 1997, and now he is Vice Chairman, which
represents southeast region States--West Virginia, Virginia,
Kentucky, Tennessee, North and South Carolina, Georgia, and
Florida, as well as Puerto Rico and the Virgin Islands. For his
next trip to the Virgin Islands, he plans to take one of the
Congressman from Georgia. He also served as a negotiator for
Georgia Special Weapons and Tactics (SWAT) team. He is a
coordinator of the U.S. Department of the Treasury's Financial
Crimes Enforcement Network, and he has just done a super job
for Georgia, working in the Georgia Bureau of Investigation.
Welcome, Mr. Edwards.
STATEMENT OF STEVE EDWARDS, STATE COORDINATOR, FINANCIAL CRIMES
ENFORCEMENT NETWORK, VICE CHAIRMAN, BOARD OF DIRECTORS,
NATIONAL WHITE COLLAR CRIME CENTER, RICHMOND, VIRGINIA, MEMBER,
GEORGIA'S STOP IDENTITY THEFT NETWORK, CHAIR, INFRAGARD ATLANTA
CHAPTER WATCH AND WARN COMMITTEE, AND SPECIAL AGENT IN CHARGE,
FINANCIAL INVESTIGATIONS UNIT, GEORGIA BUREAU OF
INVESTIGATIONS, DECATUR, GEORGIA
Mr. EDWARDS. Thank you, Mr. Collins. It is a pleasure to be
here, and I am a little overwhelmed by that introduction. I
don't deserve that, but thank you very much. Thank you, too,
Chairman Shaw, for the opportunity to address the Subcommittee
concerning identity theft. What I would like to talk about or
take the opportunity to discuss is the Georgia Stop Identity
Theft Network, and some of the reasons that we formed that
network. A primary complaint of victims of identity theft is
that they are unable to get satisfaction. They are often unable
to find an agency or an organization that is willing to assume
responsibility for helping them to deal with the crime they
have experienced. Victims of identity theft also have
difficulties with legal jurisdiction. For example, if a victim
who resides in Georgia is confronted with identity theft that
occurred in California, local law enforcement in Georgia may
tell them that they do not have jurisdiction or they are not a
victim. To address this problem, Georgia and some other States,
a few other States, require that a police report be generated
for all reported cases of identity theft. This police report is
a useful tool for the victim when reporting a violation to
other organizations. In essence, a primary need for victims of
identity theft is a one-stop shop, whether physical or online.
The Stop Identity Theft Network in October 2002 actually
developed and created and put online a complaint program. Since
that program has been in existence, we have had 233 complaints
processed through it.
The way it works is after the victim files a complaint, the
network submits the complaint to the cities, counties, and
State law enforcement having jurisdiction or venue. Not only in
the State of Georgia, but across the country. Along with the
complaint is a letter explaining to the agency what it means
and the other agencies that have received the same complaints
so they can coordinate their efforts. In the past 30 years, I
have been a Georgia Bureau of Investigation agent. I have seen
no other crime directly affect more friends, associates, and
family members than identity theft. Since 2000, when I became
actively involved in the development of the Stop Identity Theft
Network, I have received an average of two or three telephone
calls per month from someone I know who has been a victim of
identity theft. The illegal use of SSNs is key to laying the
groundwork to take over someone's identity. Containment of
widespread use of SSNs could have a substantial impact in the
prevention of identity theft. This containment is important not
only in areas of government, but the use of SSNs as individual
identifiers within the private sector as well. Examples of
current broad use of SSNs--and this has already been discussed,
but I will say it again--driver's license, student records,
bank accounts, utility services, insurance policies, credit
bureau records, cash checking services, medical services,
apartment rental, employment, membership, and even in some
areas library access.
While it may not be feasible to restrict the use of SSNs to
administer Social Security taxation, it is recommended that
SSNs be restricted for other uses. The development of these
restrictions is appropriately the responsibility of Congress
and consistent with other privacy measures, particularly in the
absence of uniform aggressive action among State and local
governments, as well as the private industry, to reduce
opportunities for identity theft. In those instances where SSNs
are deemed suitable for recording their existent need to create
statutory incentives for organizations to safeguard this
information. While few States have some form of accountability
already on the books, there is no uniformity. In addition,
creating a statutory category of liability would serve both to
increase the victim's chances in civil court and to put the
organizations on notice to change their behavior. It has been
recognized that no Federal law currently limits use or
disclosure of SSNs among private entities. The SSA cannot
control how private entities keep use or distribute SSNs. Thus
leaving the burden on the consumers who have no real power.
Many bills responding to the problem of identity theft have
been introduced in recent Congresses, and several are again
pending. These bills, such as H.R. 2036 which you sponsored in
the 107th Congress, Mr. Chairman, would enhance privacy
protection and otherwise help prevent fraudulent misuse of
SSNs. As you know, other measures are pending in the Congress
to protect personal identifiers. While we are not necessarily
endorsing every aspect of these various measures, we certainly
commend them to your careful consideration as Congress acts
along with the States to better enable effective responses and
efforts to prevent identity theft. Thank you, and thank you Mr.
Collins, for the opportunity to testify before you today; I am
eager to answer any questions you or other Members of the
Subcommittee have. Thank you all.
[The prepared statement of Mr. Edwards follows:]
Statement of Steve Edwards, State Coordinator, Financial Crimes
Enforcement Network, Vice Chairman, Board of Directors, National White
Collar Crime Center, Richmond, Virginia, Member, Georgia's Stop
Identity Theft Network, Chair, Infragard Atlanta Chapter Watch and Warn
Committee, and Special Agent in Charge, Financial Investigations Unit,
Georgia Bureau of Investigations, Decatur, Georgia
Chairman Shaw and members of the subcommittee, thank you for this
opportunity to address this subcommittee concerning the subject of
identity theft.
Introduction
My name is Steve Edwards, and I am Special Agent in Charge of the
Financial Investigations Unit of the Georgia Bureau of Investigations
(GBI), State Coordinator to the U.S. Treasury's Financial Crimes
Enforcement Network (FinCEN), and Vice Chairman on the Board of
Directors of the National White Collar Crime Center (NW3C). In
addition, I am a committee member on the State of Georgia's STOP
IDENTITY THEFT Network and serve as chair on the FBI's InfraGard
Atlanta Chapter Watch and Warn Committee.
GBI is an independent, state-wide agency that provides assistance
to Georgia's criminal justice system in the areas of criminal
investigations, forensic laboratory services and computerized criminal
justice information.
NW3C is a non-profit corporation that provides a national support
network for law enforcement agencies, state regulatory bodies, state
and local prosecution offices, and other organizations involved in the
prevention, investigation, and prosecution of high-tech and economic
crime.
Overview of the Problem: On-the-ground Perspective
I would like to take this opportunity to briefly discuss Georgia's
STOP IDENTITY THEFT (STOP I.T.) Network and some of the reasons for its
formation. A primary complaint of victims of identity theft is, in my
experience, that they are unable to ``get satisfaction.'' By this I
mean that they are often unable to find an agency or organization that
is willing to assume responsibility for helping them to deal with the
crime they have experienced. As a result, victims needlessly contact
one organization after another in an effort to handle the violation,
and may, in the end, receive no assistance at all. In many cases, for
example, local law enforcement tell victims of identity theft, ``you
are not a victim''--particularly if the victim has suffered no direct
financial loss. Their advice is often that the victim should contact
the organization that was used for the perpetration. The organization
involved, in turn, refers the victim to local law enforcement.
Victims of identity theft also have difficulties with the matter of
legal jurisdiction. For example, if a victim who resides in Georgia is
confronted with identity theft that has resulted in a violation in
California, local law enforcement in Georgia may state that they do not
have jurisdiction. To address this problem, Georgia, and other states,
require that a police report be generated for all reported cases of
identity theft. This police report is a useful tool for the victim when
reporting the violation to other organizations, such as a credit
bureau. Unfortunately, other factors--including lack of resources--
often prevent local law enforcement from taking action beyond the
generation of a report.
In essence, a primary need for victims of identity theft is a
``one-stop-shop,'' or a single ``location''--whether physical or
online--where victims can receive information about identity fraud
prevention, file a complaint, and receive guidance concerning recovery
from identity theft violations. In 2000, Georgia's STOP I.T. Network
was conceived as such a location. In October 2002, STOP I.T. went
online for the first time, and since then 233 complaints have been
received and processed.
After receiving a complaint from a victim, STOP I.T. serves as an
intermediary between the victim and a number of agencies. For example,
a complaint from a victim in Georgia is forwarded by STOP I.T. to city,
county and state law enforcement appropriate to the complaint; to local
and state law enforcement in any state where the victim identifies
activity associated with the identity theft; to the FTC; and to the
Internet Fraud Complaint Center. In addition, STOP I.T. sends to each
organization a letter of explanation that includes a list of every
other organization that has received the complaint. Finally, victims
receive information to assist them in protecting against the continued
fraudulent use of their personal information and in recovering
financial and other losses that have resulted from the violation.
In the 30 years that I have been involved in financial crime, I
have seen no other crime directly affect more friends, associates, and
family members than identity theft. Since 2000, when I became actively
involved in the development of STOP I.T., I have received an average of
2 or 3 telephone calls per month from someone I know who has been a
victim of identity theft. Data collected across the nation--to the
extent that data on identity theft exist--also indicate that identity
theft is a crime that is pervasive and expanding rapidly.
Overview of the Problem: Broad Perspective
Identity theft--or the use of ``another person's personal
information in some way that involves fraud or deception'' \1\--is
currently one of the fastest growing crimes in the United States.\2\
Two of the most common forms of identity theft include ``true name
fraud'' and ``account takeover fraud.'' \3\ True name fraud occurs when
someone uses an individual's personal information to open a new
account, and account takeover involves illegal access to an
individual's existing account for the purpose of making fraudulent
charges against the account. Identity theft is also used to facilitate
other crimes--including money laundering, bankruptcy fraud, computer
crimes, and acts of terrorism--by providing a means of concealing the
identity of the criminal and accessing funds or privileges available to
the victim. It is important to note, however, that financial loss is
not a necessary component of identity theft. ``Criminal identity
theft,'' for example, occurs when a victim's personal information is
used by a criminal and subsequently associated with records of criminal
violations, outstanding arrest warrants, or other public information
without the knowledge of the victim.
The Federal Bureau of Investigation (FBI) and other law enforcement
agencies have estimated that between 700,000 and 1.8 million Americans
are victimized by identity theft each year--a figure that has increased
substantially in recent years. In addition, recent surveys (conducted
by Star Systems, a national electronic payments network) indicate that
about 1 in 20 adults in the United States, or about 12 million
Americans, have been victimized by identity theft at least once.\4\
In 2002, the number of identity theft cases reported to the Federal
Trade Commission (FTC) rose to 161,819--almost twice the number
reported in 2001.\5\ Other cases were reported directly to local law
enforcement; reported to other federal agencies, including the FBI,
Secret Service, Internal Revenue Service, and Postal Inspection
Service; or never reported at all.
The cost of identity theft to businesses has been estimated to be
more than $11.9 billion each year.\6\ The costs to victims of this
crime include loss of credit, harm to reputation, and loss of wages, in
addition to the direct loss of money, attorney fees and other recovery
expenses. Despite these losses, and the considerable attention that has
been paid to the problem in recent years, the average arrest rate for
all identity theft cases reported by victims remains around 5
percent.\7\
Identity Theft and the Use of Social Security Numbers
Since the illegal use of social security numbers (SSNs) ``is key to
laying the groundwork to take over someone's identity,'' \7\
containment of the wide-spread use of SSNs could have a substantial
impact on the prevalence of identity theft in the future. This
containment is important not only in areas of government that use SSNs
as individual identifiers, but also in private organizations, which are
increasingly including SSNs on personal records and distributing this
information for a variety of purposes. Examples of the current broad
use of SSNs include
Driver's Licenses: As many as eleven states and the
District of Columbia currently display the SSN on the face of their
drivers' licenses. Several other states require a SSN for the issuance
of a driver's license but do not display the number on its face.
Student Records: Half of colleges and universities use
SSNs to identify students, and 79% include them in official
transcripts, according to a March 2002 survey by the American
Association of Collegiate Registrars and Admissions Officers.
Other Records: A SSN is often required or requested for
services such as bank accounts, utility services, insurance policies,
check cashing services, medical services, apartment rental, extension
of credit, employment, memberships, and library access. SSNs are also
used as reference numbers for credit bureau reports, which are widely
distributed, often without the knowledge of the credit holder.
While it may not be feasible to restrict the use of SSNs to the
administration of Social Security taxation, for which it was originally
designed, it may be feasible to restrict the use of SSNs to a set of
identified purposes for which there is a legitimate legal reason to
collect a SSN. In addition, government agencies and businesses that
collect SSNs can be required to restrict access to SSNs--by employees
and other organizations--and to dispose of records that include SSNs
using specified procedures, e.g., encrypting personal information on
databases and shredding paper documents containing personal
information.
The development of these restrictions is appropriately the
responsibility of Congress, and consistent with other privacy measures
recently passed, particularly in the absence of uniform, aggressive
action among state governments, local governments, and private industry
to reduce opportunities for identity theft. In addition, the increasing
number of cases being pursued by law enforcement throughout the country
evidence the immediate importance of developing these restrictions. For
example,
July 1 and 2, 2003, Consuelo Onate-Banzon and Rony Razon,
and four other individuals, were arrested on charges of identification
and social security fraud. According to the FBI, Onate-Banzon and Razon
worked for the Virginia Department of Motor Vehicles (DMV) and
allegedly produced and sold as many as 1,000 fraudulent Virginia
driver's licenses, with the help of co-conspirators.\8\
On May 8, 2003, Dorian Thomas, age 27, was indicted on
charges of conspiracy, bank fraud, and identity theft. Thomas, an
employee of a financial institution in California, had ``obtained the
confidential member profile information of account holders through
financial institution computers and provided it to others,'' \9\ who
then completed more than $100,000 in fraudulent bank transactions.\10\
Charmaine Northern, age 23, ``pled guilty on March 10,
2003, to obtaining confidential customer account information from the
computer at the financial institution where she was working and using
it to open credit card accounts and incur unauthorized charges
estimated to be approximately $50,000.'' \13\
Kimberly Smart, age 27, was sentenced on December 5,
2002, ``in connection with using her financial institution position to
obtain customer account information from the financial institution
computer and provide it to others.'' \11\ The losses incurred in this
case were approximately $121,146.63.
Philip Cummings, a 33-year-old former ``help desk''
employee of Teledata Communications, Inc., faced charges on November
26, 2002, of accessing credit bureau databases, selling confidential
information, and participating in a fraud scheme that resulted in a
loss of more than $2.7 million to 30,000 victims.\12\
Ivy Johnson, a former employee of H & R Block in White
Plains, New York, was charged in January 2003, for obtaining customers'
personal information, and using the information to divert tax checks,
open new credit card accounts, and making ATM withdrawals in victims'
names.\13\
All of these cases involved access to and use of SSNs. Future cases
of similar violations may be reduced if requirements for specific
safeguards are mandated and enforced by federal statute. In addition to
legislative restrictions, education and training is also important for
the reduction of identity fraud in the future. This education and
training should include
Educating individuals to take active steps to protect
their personal information;
Training state and local law enforcement to identify and
effectively handle identity theft cases, since these cases are often
first reported to state and local rather than federal law enforcement
agencies; and
Educating businesses, including banks and credit bureaus,
to guard against and detect identity theft.
``Best Practices'' to Combat Identity Theft
The following is an analysis of best practices either currently in
place in the states or needed to fulfill assistance functions for
victims of identity theft. These conclusions were generated through a
synthesis of published commentaries and critiques of existing
legislation, peer-reviewed academic articles, and analysis of pending
legislation.
First, it is important to use a broad definition that explains the
substance of the sort of information that should be considered
``identifying information.'' This definition should be broad enough to
include account numbers, scanned or re-encoded credit or account access
cards, and SSNs. Following the establishment of a working definition of
the problem, the research of NW3C has indicated that there are numerous
opportunities to help victims of identity theft.
Practice 1: Explicit recognition of identity theft as a crime committed
against the
individual.
States have taken a variety of approaches to dealing with identity
theft victims. Chief among the issues that create inconsistencies among
states is the nature of victimization in identity theft cases. For
example, victims in states that do not recognize identity theft as a
crime must often seek assistance through civil suits or ancillary
charges. While the place of the civil suit is to rectify injustices
that escape the criminal justice system, it is an arduous task least
likely to be pursued by most people. Such circumstances exemplify a
need for legislation that explicitly criminalizes the dissemination and
misuse of identifying information such as SSNs rather than just the
theft facilitated by information misuse. Specifically, statutory
frameworks should explicitly criminalize identity theft in a manner
that clearly underscores the method of information obtainment, as well
as monetary damages.
Practice 2: Eligibility of identity theft victims for victims' rights
assistance.
The foremost need expressed by victims in recent NW3C research is
for notification of victimization. Indeed, the most comprehensive
framework for protecting the rights of victims and restoring them to
their pre-victimized state is of little use if victims do not know that
a crime has been committed. This is especially true in the instance of
a SSN that is stolen from medical or business documents without the
knowledge of the victim.
In states that do recognize the individual whose identity has been
stolen as an injured party, the degree of victimization is often deemed
to be trivial in comparison to other offences, especially violent ones.
In some states, victims' assistance and, in some cases basic
notification and participation rights, are denied to victims of
property crime and only afforded to those who can demonstrate some form
of physical injury. In other states, victims of non-violent crimes are
only given full protection if the predation is judged to be a felony
offence. It is therefore of great importance that those statutes that
exist to aid crime victims recognize the victims of identity theft as
targets of a serious crime who may require assistance in pulling their
lives back together.
Practice 3: Phasing out use of private identifying information on non-
secure
documents.
While many states no longer use SSNs as identifiers on drivers'
licenses, these numbers are still widely used on non-secure public
documents. For example, many schools that use SSNs as student
identification numbers include these numbers on a variety of forms and
correspondence, and order forms and applications often solicit personal
information. Consequently, a Nexis public records search can reveal
SSNs and dates of birth in seconds. Additionally, organizations that
accumulate personal information apply varying levels of security.
Ultimately, it is unhelpful for a dozen organizations to strictly
protect personal information if only one organization makes that
information publicly available. This issue is associated with the idea
of liability for breaching a duty of confidentiality, but it is also a
change in focus that requires unique legislative attention. In other
words, it is important not only to protect personal information but
also to establish safeguards for handling those forms that document
personal information. What is required is legislation that mandates
strict controls on the circumstances under which the recording of
personal information is justified.
Practice 4: Eligibility for compensation and financial assistance.
Financial assistance is typically reserved for victims of violent
crimes where the perpetrator has not been ordered to provide
restitution or does not have the means to provide effective
restitution. Such practices can also be helpful in identity theft cases
that result from privacy breaches. Financial assistance, unlike
restitution, is able to provide for and compensate immediate financial
outlays without concern for the offender's ability to pay. As the
Privacy Rights Clearinghouse has demonstrated, a victim of identity
theft typically spends as much as $1,200 out-of-pocket to correct the
damage caused by the crime. Thus, just as victims of violent crimes
have a need for funds to cover immediate emergency expenses, so do
victims of identity theft. Therefore, legislation may be needed to
assure that victims of identity theft can qualify for federal victim
assistance funds.
Practice 5: Aid to identity theft victims in clearing their names.
Regardless of the efficiency of the legal system in prosecuting
identity theft cases, victims often face many difficulties in removing
fraudulent information that is associated with their names.
Consequently, victims of identity theft remain vulnerable to future
victimization through the continued use of their SSN on government
documents, most of which require the use of the SSN as a personal
identifier. A great need exists for aid in purging erroneous records
maintained by credit bureaus, police departments, and other
organizations that result from the crime of identity theft. Often, the
mechanism for such corrections is complex, creating barriers for
citizens of limited means or comprehension. Therefore, legislative
guidance for aid to victims of identity theft would be helpful.
Examples of policies that have been enacted by statute (nearly all from
California) to address this problem are
Providing public agency aides to assist victims by making
phone calls, preparing forms, or taking other steps on behalf of the
victims;
Requiring that court records reflect that the person
whose identity was falsely used to commit a crime did not commit that
crime (Cal. Penal Code 530.5(c)); and
Allowing the victim to petition the court for an
expedited determination of factual innocence (Cal. Penal Code 530.6).
Legislative Treatment of Social Security Information
In those instances when SSNs are deemed suitable for recording,
there exists a need to create statutory incentives for companies
(especially, but not limited to, credit card companies) to safeguard
this information. While a few states have some form of accountability
already on the books (California's Information Practices Act and
Delaware's concept of reckless disclosure of information stand out),
none have gone so far as to explicitly create an actionable duty of
care for all entities that collect private identifying information to
protect said information to at least the level to which a reasonable
person would have protected it. Delaware is the only state to even
mention the reckless or negligent disclosure of personal information in
their identity theft legislation.
While civil actions are always available to punish such
disclosures, they do not possess the desired deterrent effect unless
they are easily factored into a rational analysis of policy options. As
it stands, one can only assume that the current rate of identity theft
and credit card fraud are an acceptable cost of business for the
corporations that currently treat with social security numbers and
other private identifying information in an unsafe way. Creating a
statutory category of liability would serve both to increase the
victim's chances in court and to alter the equation for those
corporations, putting them on notice to change their behavior lest it
eat into their profit margin.
California is one state that has imposed liability on entities that
handle personal data. Cal Civ Code 1798.29 (2003), for example,
requires any agency that ``owns or licenses computerized data that
includes personal information'' to report security breaches to the
people whose personal information may have been compromised. Cal Civ
Code 1798.82 (2003) extends similar requirements to people and
businesses doing business in California. This approach is proposed for
Federal law in S. 1350, the Notification of Risk to Personal Data Act,
recently filed by Senator Feinstein.
Of course, regardless of how rigorously SSNs are protected, there
will be instances in which they are abused. On this matter, the
following recommendations are proposed:
Make possession of fraudulent social documents either
illegal in and of itself or allow it to create a permissible inference
of forgery. There is already a provision in many forgery and credit
card fraud statutes that states that the ownership of some small number
of forged or unauthorized instruments is enough to create an inference
of a guilty motive without the necessity of proving a definite intent.
Additional measures can be taken to address unauthorized possession of
identifying documents or information. Some states have already adopted
various measures of this type. Alabama and Kentucky lead the way in
this regard, and set the required number of identity documents (a term
that would include social security cards) in one's possession that are
not one's own to create an inference of identity trafficking at five.
When SSNs are abused, they are often abused for long
periods of time. While a victim of a burglary may change their locks, a
victim who was targeted through their SSN has little ability to prevent
this means of victimization in the future. Unless SSNs are easily
changed, the victims of these crimes have little protection against
repeat predation, especially as the SSN is passed to other unscrupulous
types. To address this problem, some sort of repository for compromised
SSNs, which could flag SSNs that have been the target criminal abuse,
could be established.
Current Legislative Issues
It has been recognized that no federal law currently limits use or
disclosure of SSNs among private entities, leaving them free to deny
credit or services without SSNs; and that the Social Security
Administration (SSA) cannot control how private entities keep, use or
distribute SSNs, thus leaving the burden on consumers who have no real
power.\14\
Many bills, taking a variety of approaches to preventing or
enhancing responses to identity theft, have been introduced in recent
Congresses, and several are again pending in this, the 108th Congress.
Some of these legislative measures propose enhancements in the
penalties under the federal ID Theft statute in the interest of
increasing the deterrent effects, or would make modifications aimed at
facilitating investigations or prosecutions. Others go more directly to
the topic at hand today: augmenting the protections against disclosure
and misuse of certain information, including SSNs.
These bills, such as H.R. 2036 which you sponsored in the 107th
Congress, Mr. Chairman, would enhance privacy protections and otherwise
help prevent ``fraudulent misuse'' of SSNs by restricting display or
use of SSNs, restricting dissemination of SSNs or any derivative or
their use as PINs without an individual's consent, and providing for
regulation and criminal punishment of sales and purchases of SSNs. As
you know, measures are also pending to protect other personal
identifying information by, for example, prohibiting sale and
disclosure of personally identifiable information by commercial
entities to non-affiliated third parties absent prescribed procedures
for notice and opportunity to restrict such disclosures.
Specifically,
H.R. 70, the Social Security On-line Privacy Protection
Act, would prohibit an interactive computer service from disclosing to
a third party an individual's SSN or related personally identifiable
information without the individual's prior informed written consent.
H.R. 220, the Identity Theft Prevention Act of 2003
pending before this subcommittee, would, among other things, amend the
Social Security Act and Internal Revenue Code to protect the integrity
and confidentiality of SSNs, prohibiting their use or disclosure except
for specified social security and tax purposes.
H.R. 637, the Social Security Number Misuse Prevention
Act, and the companion bill, S. 228, would, among other things,
prohibit display, sale, or purchase of SSNs without affirmative,
express consent of the persons to whom they belong; prohibit use of
SSNs on government-issued checks, the appearance of SSNs on driver's
licenses or motor vehicle registrations, and inmate access to SSNs;
prohibit commercial entities from requiring individuals to provide SSNs
when making purchases or from denying such purchases if the persons
refuse to provide such numbers; and establish civil and criminal
penalties for misuse of SSNs. (Similar provisions are included within
other, broader bills, including but not limited to S. 745, the Privacy
Act of 2003.)
H.R. 1931, the Personal Information Privacy Act of 2003,
would, in part, prohibit commercial acquisition or distribution of
SSNs, or derivatives, as well as their use as personal identification
numbers, without written consent.
Two other bills very recently filed in the House of Representatives
and pending before the Ways and Means Committee, H.R. 2617, the
Consumer Identity and Information Security Act of 2003, and H.R. 2633,
the Identity Theft Protection and Information Blackout Act of 2003,
include (but are not limited to) provisions that would similarly place
prohibitions or restrictions on certain uses of SSNs.
While we are not necessarily endorsing every aspect of these
various measures, we certainly commend them to your careful
consideration as Congress acts, along with the states, to better enable
effective responses and efforts to prevent identity theft.
Conclusion
Thank you for the opportunity to testify before you today. Mr.
Chairman, I am eager to answer any questions you or other members of
the subcommittee may wish to direct to me.
References
1. U.S. Department of Justice. (2003, July 27). Fraud. Retrieved
July 7, 2003, from http://www.usdoj.gov/fraud.htm
2. U.S. Department of Justice. (n.d.). Identity theft: Prosecution
and protection. Retrieved July 2, 2003, from http://www.usdoj.gov/usao/
txs/releases/May%202002/020502-identitysheet.htm
3. Benner, J., Givens, B. & Mierzwinski, E. (2000). Nowhere to
Turn: Victims speak out on identity theft: A CALPIRG/Privacy Rights
Clearinghouse report. Privacy Rights Clearinghouse. Retrieved June 13,
2002, from http://www.privacyrights.org/ar/idtheft2000.htm
4. Star Systems (STARsm). (2003, April 16). Americans want action
on identity theft. [Press Release]. Retrieved July 7, 2003, from http:/
/www.star-systems.com/cfm/news-press.cfm?id=81
5. Federal Trade Commission. (2003, January 22). National and
state trends in fraud and identity theft: January-December 2002.
Retrieved July 1, 2003, from http://www.consumer.gov/sentinel/pubs/
Top10Fraud_2002.pdf
6. Identity Theft Resource Center. (2003, February). Facts and
statistics. Retrieved July 2, 2002, from http://www.idtheftcenter.org/
facts.shtml
7. Identity Theft Resource Center. (2003, February). Facts and
statistics. Retrieved July 2, 2002, from http://www.idtheftcenter.org/
facts.shtml
8. Federal Bureau of Investigation. (2003, July 7). Operation easy
rider: FBI puts stop to driver's license fraud. Retrieved July 7, 2003,
from http://www.fbi.gov/homepage.htm
9. U.S. Department of Justice. (2003, May 12). Three indicted on
conspiracy to commit bank fraud and identity theft. [Press Release].
Retrieved July 3, 2003, from http://www.cybercrime.gov/thomasIndict.htm
10. Sanchez, E. (2003, May 13). Scam alert: Insider help giving a
new look to bank robberies. The Sacramento Bee. Retrieved July 3, 2003,
from http://www.sacbee.com/content/news/scam_alert/v-print/story/
6657347p-7609218c.html
11. U.S. Department of Justice. (2003, May 12). Three indicted on
conspiracy to commit bank fraud and identity theft. [Press Release].
Retrieved July 3, 2003, from http://www.cybercrime.gov/thomasIndict.htm
12. Masters, B.A. (2002, November 26). Huge ID-theft ring broken;
30,000 customers at risk. The Washington Post. Retrieved July 3, 2003,
from http://seattletimes.nwsource.com/html/consumeraffairs/
134584039_idtheft26.html
13. O'Connor, T. (2003, January 2). Four charged in ID-theft scam.
The Journal News. Retrieved July 3, 2003, from http://
www.nyjournalnews.com/newsroom/010203/A102idtheft.html
14. Harry A. Valetk, Identity Theft: What It Is and How to Protect
Against It, originally published on GigaLaw.com and found November 22,
2002, at http://www.wiredpatrol.org/idtheft/whatisit.html
Chairman SHAW. Mr. Collins.
Mr. COLLINS. Thank you. Mr. Edwards, there has been talk
about the Inspector General, the SSA having statutory authority
to share information with law enforcement. How often have you
requested information from SSA to pursue a criminal?
Mr. EDWARDS. On several occasions, Mr. Collins, but in each
case it was denied to me.
Mr. COLLINS. What was the reason given?
Mr. EDWARDS. At the time, and this is not in the most
recent past, but at the time I was told that they could not
provide that information. Basically, the information I have
been able to obtain from Social Security over the years is, I
can give them a number and they will tell me if it is a valid
number or not. They will not tell me who the number belongs to
or whether it is being used by the correct person.
Mr. COLLINS. How long ago has it been since your last
request? Do you know?
Mr. EDWARDS. Within the last couple of years? Yes, sir. It
has not been in the recent past; quite frankly, because of the
frustration, unless I just need a verification of a SSN, I
rarely call them.
Mr. COLLINS. The Inspector General stated in its testimony
that we need criminal penalties for Social Security misuse
itself, as well as civil monetaries. You mentioned that
possession of fraudulent documents should be illegal in and of
itself. Describe some cases where such law would have been
helpful in investigating or prosecuting an identity theft.
Mr. EDWARDS. Identity theft covers a lot of different
crimes, and there is a lot of crimes that are predicate acts to
identity theft. So, we have used all kinds of charges,
including false writings to the State for driver's license. We
have used it in cases where an individual has actually
falsified a signature to obtain a credit card or some kind of
bank loan or something along that line. So, all of these
different tools that exist out there are very useful to us. We
have an identity theft statute in the State of Georgia, and
where it has helped our victims, and that is who it really
helps, is giving them a vehicle for when. Particularly, like
the scenario I gave where the identity was compromised in
California, under Georgia law we can indict that individual and
extradite them back, and there doesn't have to be a financial
loss, just the virtue that an individual went around portraying
that they were someone else using that individual's identifiers
in the State of Georgia is a crime now and it is a felony. It
carries 5 years, and we are just starting to test that. It went
into law a year ago, July, and we are just now starting to test
that law in the courts. We have had a couple of cases that have
been successful.
Mr. COLLINS. How many other States have that?
Mr. EDWARDS. I am not familiar, Mr. Collins. Quite frankly,
maybe two or three. If that many.
Mr. COLLINS. Thank you, Mr. Edwards.
Mr. EDWARDS. Thank you, sir.
Chairman SHAW. If I could direct a question to Mr. Wern and
Mr. Hoofnagle with regard to, we have been hearing today a lot,
people have been referring to the identifier as putting the
genie back into the bottle. Obviously, the numbers are out
there now, and they will remain out there no matter what we do.
We can certainly stop the distribution, or certainly retard the
distribution through criminal statutes, but a lot of that
information is already in the public domain. I know in Florida,
with the total access that everybody has to public records, it
is going to be very difficult to go back and take those numbers
off of the public records. Whether you are talking about death
certificates or probate files or it goes on and on, probably
divorce files, I would assume they are probably in there
somewhere, it is going to be very, very difficult. It occurs to
me that if you simply prohibit the use of SSN as an
identification for nongovernmental purposes, that it would make
that number somewhat useless for other purposes. Now, quite
obviously if we were looking at this as an identifier, we would
require very stringent requirements as to photographs or
counterfeit proofing. You would have an address and date of
birth and other pertinent information on the card itself, you
would be sure to keep absolutely current with all of that, all
of that information, and you would have had tremendous
safeguards around it and everything else, which obviously the
crooks have picked this up as something that was never
anticipated by those who wrote the statutes.
I understand, Mr. Edwards, that we are looking into the
area that you and Mr. Collins were just discussing with regard
to the access law enforcement has, at least to the name, they
are governed under the Internal Revenue Code, there are
restrictions on giving any information, but I think it is more
based toward wages and things of this nature. We are going to
look into it and see if it prohibits their giving the name of
whomever, whatever number you have; or at least you should be
able to say, I have got John Doe and he has got X-Y-Z number,
is this his number? They should be able to say yes or no to
that. So, we need to work on that. We use that number for so
many number purposes. Tracking deadbeat dads. That was
something I had a lot to do with in welfare reform when we
reformed the welfare system in this country. We don't want to
make it more difficult to track deadbeat dads so they can
fulfill their parental responsibilities. We do need, we
desperately need to stop the distribution of these numbers as
an identifier and as the golden, I think you, Mr. Hoofnagle,
referred to it as the golden key or something of that nature,
to stealing identification. Mr. Wern, you mentioned that you
were victimized and you went through this for about 3 years. I
understand from people who have been in your place, that they
are being warned that it may not be over, that this nightmare
may recur. You have recurring nightmares in this area. How did
they get your number, and was it the SSN that was the key to
the identity theft that you suffered?
Mr. WERN. We don't know for absolute sure how the
perpetrator got the number. He was caught and interrogated, but
his story just didn't make a whole lot of sense. My best guess,
probably 80 percent sure, is that it was on a dental record
that was stolen from my mail. I had some mail stolen, and one
of the things that I know for a fact was stolen was a dental
report or a bill that I know also had that SSN on it. My SSN
was the key to that crime simply because it was sort of the
final piece of information he needed. It was easy enough to get
my address. He knew where I lived, he took my mail. It was easy
enough to get my name and date of birth as well from other
public records. Once he had the SSN, he used it and damaged to
the point, to the point where I actually had to change the SSN,
which is an extreme measure that we don't recommend people
doing. It carries a lot of problems with it, but when you get
to a situation where another person is essentially cloning you,
you don't have a choice.
Chairman SHAW. Several things in the law that I want this
Committee--that we will be looking at, is use of a counterfeit
SSN. You have an illegal alien who is in this country, working.
He gets a counterfeit Social Security card and number, the
identification, and he can go to work. Then it is under a false
number. Later he is legally admitted into the United States and
gets a green card and gets a work permit. He can actually go
back and claim the money that was paid into Social Security
under that false number on his behalf, which to me is somewhat
bizarre that somebody can go back and claim the fruits of their
crime after they are entitled to work under the laws that we
have. These are there are so many things that just don't make a
whole lot of sense, and the more you look into this whole use
of SSNs and how they are used and abused, it becomes more and
more apparent that we definitely need to at least neuter the
use of this number as an identifier so that if somebody does
get hold of it, it will be sort of a, ``so what.'' One of the
ways to do it is to just stop the nongovernment use of this
number, period. Mr. Cardin, do you have any questions for these
witnesses?
Mr. CARDIN. First, let me thank you all for being here. I
apologize I was not here during your entire testimony. As more
and more we talk about this, I am wondering, Mr. Chairman, how
difficult would it be to restrict the use of SSNs to
governmental purposes and not in the private sector. It would
require a lot of changes, the habits of the private sector. So,
your comment was that the missing ingredient, that was the one
bit of information that allowed the identity theft to be
effective obtaining your SSN probably from a medical record
that there was no need for it to be on. So, there is clearly an
abuse in the private sector on the use of SSNs. It is
convenient for them, it is a reliable number, it is set up by
their government. I understand all those arguments as to why it
is convenient to use the SSN for identification by the private
sector, but that is not its intent. The other question about
trying to verify who you are. The fact that you know someone's
SSN is no guarantee at all that that is who you are. So, I am
just wondering, Mr. Chairman, what is the trade-off here, how
difficult it would be for the private sector if we in fact
restricted those numbers? I don't have any specific questions
for any of the witnesses. Again, I thank them for being here.
Chairman SHAW. Well, I thank all of you for being here
today. The first panel as well, which I neglected to thank as
we ran out the door to make the last vote. I think it has been
a very interesting discussion here, and the three of you
certainly have added considerably to the store of knowledge
that we are trying to build up. I am very hopeful that we will
not only be able to get a bill out of this Committee, which I
don't think is going to be a great deal of trouble, I think we
can do it, we have done it before but that we can work with the
other committees to see that they move it. I think it is the
Committee on the Judiciary and the Committee on Financial
Services that have a piece of this legislation. There may be
another jurisdiction involved, but everybody guards their turf
up here on Capitol Hill, particularly this Committee. We really
guard ours. We want to be sure that the other committees either
waive jurisdiction or that they pass on the provisions of the
bill within their jurisdiction. It is the fastest growing type
of white collar crime that we have, and it may be the fastest
growing crime, period. We know the conditions are getting worse
and worse. Mr. Wern, we don't want to see more people go
through the agony that you went through. Credit is so important
in this country. We certainly appreciate the three of you
coming forward. We are about ready to adjourn. Did you have
anything?
Ms. TUBBS JONES. Thank you gentlemen for coming. I am sorry
I couldn't be here, but you know what life is like on the Hill.
Thank you, Mr. Chairman.
Chairman SHAW. I was a judge too, Ms. Tubbs Jones. One time
I came in late, in fact I came late a lot of times, and the
bailiff looked over and he said, judge, you are late. I said,
oh, did you start without me? So, I think once you have been a
judge, you kind of get used to your own time clock, and you do
what you have to do. Well, thank you all very much. It has been
a very beneficial hearing. We are now adjourned.
[Whereupon, at 3:43 p.m., the hearing was adjourned.]
[Submissions for the record follow:]
July 24, 2003
The Honorable E. Clay Shaw, Jr.
Chairman
Subcommittee on Social Security
B-316 Rayburn House Office Bldg.
Washington, DC 20515
The Honorable Robert Matsui
Ranking Democratic Member
Subcommittee on Social Security
1106 Longworth House Office Bldg.
Washington, DC 20515
Dear Chairman Shaw and Ranking Member Matsui:
The undersigned organizations applaud your efforts over the past
several years to craft legislation that will ensure the integrity of
the social security number (SSN) in the years ahead. We are extremely
concerned about the proliferation of identity theft and other financial
crimes that exploit individual SSNs, and believe strong legislation
should be enacted to combat such nefarious acts. We eagerly await your
introduction of legislation to address these issues during this session
of the 108th Congress.
As public and private employee benefit plan sponsors, however, we
are concerned that such legislation could unintentionally hinder the
delivery of benefits from, and the efficient administration of, public
and private employee benefit plans.
In your bipartisan legislation introduced during the 107th
Congress, the ``Social Security Number Privacy and Identity Theft
Prevention Act of 2001,'' (H.R. 2036), the definitions and provisions
relating to the ``sale,'' ``purchase'' or ``display'' of a person's SSN
could make it more difficult to deliver comprehensive health and
retirement benefits to public and private employees alike. Indeed, the
language could place plan administrators in jeopardy of, on the one
hand, violating the strict fiduciary requirements applicable to
retirement plans and, on the other hand, exposing themselves to
criminal penalties under the bill. It is unreasonable to put plan
administrators of a voluntary employee benefit system in this position.
In general, public and private employee benefit plans use SSNs
because they enable the accurate and timely administration of benefits
for a highly mobile workforce, and because use of the number is
mandated for tax reporting requirements. Plan administrators take
seriously the responsibility that the use of SSNs requires, and they
use the utmost caution and security when SSNs are used in plan
administration and communications.
Public and private sector defined benefit and defined contribution
pension and savings plans, like 401(k), 403(b), and 457 plans, use SSNs
to identify plan participants, account for employee contributions,
implement the employee's investment directions, track ``rollovers''
from other plans, and allow employees to view their account activity or
benefit accrual online (typically in conjunction with a secure
``PIN''). The broad prohibitions of H.R. 2036 could impede, for
example, an individual's ability to stay current on the accumulation of
benefits for his or her retirement.
SSNs are also used as the primary identifier in many medical and
health benefit and prescription drug plans to coordinate communications
between the doctor, the medical service provider, and the plan. H.R.
2036's broad prohibitions could, for example, hinder the delivery of
medications to the individual.
H.R. 2036 allowed the nonabusive legitimate uses of social security
numbers for national security, law enforcement, public health and
advancing public knowledge purposes in proposed new section 208A(c)
(section 201(a) of H.R. 2036). An ``Employment Exception'' could be
included as well. It would be substantially similar to that in S. 228,
which exempts any interaction between businesses, governments, or
business and government. The exemption appears in Section 3(a) of S.
228, creating Section 1028A in Chapter 47, Title 18, United States
Code. Senators Feinstein, Gregg, and Leahy introduced S. 228 on January
28, 2003.
We firmly believe your legislation should permit the use of an
individual's SSN for any employment or employment-related purpose (such
as the administration of an employee benefit plan) and for any
recordkeeping purpose related to an investment made by the individual.
In H.R. 2036, you recognized the importance of this issue by
specifically excluding application for government benefits or programs
from the definition of ``sale'' or ``purchase.'' We believe our
proposed ``Employment Exception'' would follow your intent to not
hinder the administration of employee programs and delivery of benefits
in the public and private sector employment arena as well.
An ``Employment Exception'' could be included in the new section
208A(c) of the bill. Alternatively, the definitions of ``sale,''
``purchase'' and ``display'' as drafted in new section 208A(a) (section
201(a) of H.R. 2036) could be modified and text in Section 202(b) of
the bill could be slightly revised. We have attached proposed
legislative language that is designed to enable the bill to achieve
your objective of limiting the misuse of social security numbers
without interfering with the efficient and effective administration of
public and private employee compensation and benefit plans.
We look forward to continuing to work with staff and with the
Committee to effectively address the problem of identity theft without
creating unintentional barriers to the provision of public and private
pension, health and other benefits to employees. Please do not hesitate
to contact us should you require additional information or wish to
discuss this issue in more detail.
Sincerely,
American Benefits Council
American Society of Pension Actuaries
College and University Professional Association for Human Resources
ERISA Industry Committee
Financial Executives International's Committee on Benefits Finance
National Association of State Retirement Administrators
National Council on Teacher Retirement
National Rural Electric Cooperative Association
Profit Sharing/401(k) Council of America
__________
Proposed Amendments
The undersigned organizations propose the following be included in
the upcoming legislation to be introduced by House Ways and Means
Social Security Subcommittee Chairman E. Clay Shaw, Jr., and Ranking
Member Robert T. Matsui, which is designed to ensure the integrity of
the social security number (SSN) in the years ahead. Our proposed
amendments, which are based on the ``Social Security Number Privacy and
Identity Theft Prevention Act of 2001,'' (H.R. 2036) introduced in the
107th Congress, are designed to enable the bill to achieve its
sponsors' objective of limiting the misuse of SSNs without interfering
with the efficient and effective administration of public and private
employee compensation and benefit plans. In each instance, new text is
underscored, and deletions are [bracketed].
Option 1--Employment Exception
Strike ``and'' after ``;'' on Page 18, line 25.
Replace ``.'' with ``; and,'' on page 19, line 8.
Insert at page 19, line 9:
`(8) if the display, sale, or purchase of such a number is for a
use occurring as a result of an employment-related interaction between
employers and employees of businesses or government (regardless of
which party initiates the interaction), for any purpose mandated or
permissible under Title 26 or Title 29 on the United States Code;'
Option 2--Clarify Language to Prevent Unfair Treatment of
Employee Benefit Plans
PROPOSED AMENDMENTS TO SECTION 201: These amendments clarify that
the prohibitions contained in Section 201 of the bill will not apply to
public and private employer-sponsored plan uses of SSNs. These
amendments also clarify that ``government benefit or program'' includes
benefits related to employment with such governments.
1. AMENDMENT DEFINING ``SALE'': This amendment clarifies that an
SSN is not sold when it is provided in connection with an employment-
related transaction that has a bona fide purpose unrelated to the use
of the SSN, such as the administration of an employee benefit or
compensation plan.
Amend Section 208A(a)(2) (section 201(a) of H.R. 2036 defining
``sale'') to read as follows:
``(2) SALE--The term `sell' in connection with a social security
account number means to obtain, directly or indirectly, anything of
value in exchange for such number. Such term does not include the
submission of such number as part of the process for applying for any
type of Government benefits or programs (such as grants or loans or
welfare or other public assistance programs) or any activity necessary
to effect an employment-related transaction that has a bona fide
purpose unrelated to the use of the social security number.''
2. AMENDMENT DEFINING ``PURCHASE'': This amendment clarifies that
an SSN is not purchased when it is obtained in connection with an
employment-related transaction that has a bona fide purpose unrelated
to the use of the SSN, such as the administration of an employee
benefit or compensation plan.
Amend section 208A(a)(3) (section 201(a) of H.R. 2036 defining
``purchase'') to read as follows:
``(3) PURCHASE--The term `purchase' in connection with a social
security account number means to provide, directly or indirectly,
anything of value in exchange for such number. Such term does not
include the submission of such number as part of the process for
applying for any type of Government benefit or programs (such as grant
or loan applications or welfare or other public assistance programs),
or any activity necessary to effect an employment-related transaction
that has a bona fide purpose unrelated to the use of the social
security number.''
3. AMENDMENT DEFINING ``DISPLAY'': This amendment clarifies that
an SSN is not displayed to the general public when it is placed in a
viewable manner in connection with an employment-related transaction
that has a bona fide purpose unrelated to the use of the SSN, such as
the administration of an employee benefit or compensation plan.
Amend section 208A(a)(4) (section 201(a) of H.R. 2036 defining
``display'') to read as follows:
``(4) DISPLAY--The term `display' means, in connection with a
social security account number, the intentional placing of such number,
or a derivative thereof, in a viewable manner on an Internet site that
is available to the general public or in any other manner intended to
provide access to such number or derivative by the general public. As
used in this section, the term `general public' does not mean any
person connected with any activity that is necessary to effect
employment-related transactions that has a bona fide purpose unrelated
to the use of the social security number.
PROPOSED AMENDMENTS TO SECTION 202: This amendment clarifies that
an employee is not considered a consumer for purposes of this section
and that section 202 of H.R. 2036 would not apply in the context of the
employer-employee relationship, such as the administration of an
employee compensation or benefit plan.
Amend section 202(b) as follows:
``(b) EXCEPTION--Subsection (a) shall not apply to any person in
any case in which such person is required under Federal law, in
connection with doing business with an individual, to submit to the
Federal Government such individual's Social Security account number;
or, in connection with employment of the individual, including the
provision of compensation or benefits thereof.''
Rationale for Specific Changes in Option 2
Section 201(c) unwisely subjects public and private employee
benefit plans to regulations promulgated by a federal agency with no
expertise in employee benefit plans. Section 201(c) grants the Attorney
General authority to promulgate regulations to carry out the
prohibitions against sale, purchase, and display of SSNs, and provides
the Attorney General complete discretion over whether or not to consult
with an agency that has expertise over employee benefit plans.
Regulations that require the amendment of hundreds of thousands of
public and private employee benefit plans should not be promulgated by
an agency with no expertise or jurisdiction over the laws governing
those plans.
Section 202 could unintentionally restrict access to employee
benefit plans. Section 202 prevents any ``individual, partnership,
corporation, trust, estate, cooperative, association, or any other
entity'' from refusing to ``do business'' with an individual who does
not provide them with an SSN. Without clarifying that section 202(a)
does not apply to public and private employee benefit plans, plan
sponsors might be prevented from obtaining an individual's SSN for plan
enrollment, benefit payments, and other legally mandated and routine
plan administrative functions. The exemption in section 202(b) to this
prohibition, while helpful, does not go far enough.
Statement of Stuart K. Pratt, Consumer Data Industry Association
The Consumer Data Industry Association (CDIA) is pleased to submit
written testimony in connection with a hearing on the misuse of Social
Security numbers and we thank Chairman Shaw for holding this hearing.
CDIA has appeared in person before this subcommittee before and we hope
our testimony will be helpful to you.\1\
---------------------------------------------------------------------------
\1\ Preventing Identity Theft by Terrorists: Hearing before the
House Comm. on Financial Services Subcomm. on Oversight and
Investigations and the House Comm. on Ways and Means Subcomm. on Social
Security, 107th Cong. (Nov. 8, 2001) (testimony of Stuart K. Pratt,
Vice President, Vice President, Associated Credit Bureaus); Use and
Misuse of Social Security Numbers: Hearing before the House Comm. on
Ways and Means Subcomm. on Social Security, 106th Cong. (May 11, 2000)
(testimony of Stuart K. Pratt, Vice President, Vice President,
Associated Credit Bureaus).
---------------------------------------------------------------------------
Founded in 1906, the Consumer Data Industry Association (CDIA),
formerly known as Associated Credit Bureaus, is the international trade
association that represents more than 500 consumer data companies. CDIA
members represent the nation's leading institutions in credit
reporting, mortgage reporting, check verification, fraud prevention,
risk management, employment reporting, tenant screening and collection
services.
Consumer reporting agencies are careful stewards of personal
information and they adhere to strict procedures outlined in federal
and state laws.\2\ The information infrastructure of the consumer
reporting system is the backbone of the consumer credit economy.\3\
---------------------------------------------------------------------------
\2\ All consumer reporting agencies are bound by the Fair Credit
Reporting Act (FCRA), 15 U.S.C. 1681 et seq. and numerous state
credit reporting laws. Among other things, the FCRA requires consumer
reporting agencies to maintain reasonable procedures to assure maximum
possible accuracy, 15 U.S.C. 1681e(b) and prohibits data furnishers
from furnishing data to consumer reporting agencies if they know the
information has an error, 1681s-2(a). In addition, a consumer
reporting agency is prohibited from furnishing a consumer report to
anyone without a ``permissible purpose''--a narrow and statutorily
limited list of permitted uses. 1681b.
\3\ For example, it was recently noted that
Maintaining a reliable and robust national credit reporting
system is essential to ensure the continued availability of consumer
credit at reasonable costs * * * The ready availability of accurate,
up-to-date credit information from consumer reporting agencies benefits
both creditors and consumers. Information from consumer reports gives
creditors the ability to make credit decisions quickly and in a fair,
safe and sound, and cost-effective manner. Consumers benefit from
access to credit information from different sources, vigorous
competition among creditors, quick decisions on credit applications,
and reasonable costs for credit.
Fair Credit Reporting Act: How it Functions for Consumers and the
Economy: Hearing before the House Comm. on Financial Services Subcomm.
on Financial Institutions and Consumer Credit, 108th Cong. (June 4,
2003) (statement of Dolores S. Smith, Director, Division of Consumer
and Community Affairs, Board of Governors of the Federal Reserve
System).
---------------------------------------------------------------------------
Our members have a strong interest in the legitimate and lawful use
of all information, including Social Security numbers. Used properly,
SSNs play a substantial role in reducing fraud, enhancing workplace
security, promoting public safety, supporting homeland defense,
reducing state and federal entitlement fraud, enhancing child support
enforcement, and facilitating commerce to a diverse, mobile electronic
society.
Before I specifically address how the SSN is used by our industry
and the importance of this number, I have found it helpful to provide a
short review of what a consumer reporting agency is, what is contained
in a consumer report, and the law that governs our industry.
CONSUMER REPORTING AGENCIES AND CONSUMER REPORTS
Consumer reporting agencies maintain information on individual
consumer payment patterns associated with various types of credit
obligations on approximately 190 million Americans. The data compiled
by these agencies is used by creditors and others permitted under the
strict prescriptions of the FCRA.
Consumer credit histories are derived from, among other sources,
the voluntary provision of information about consumer payments on
various types of credit accounts or other debts from thousands of data
furnishers such as credit grantors, student loan guarantee and child
support enforcement agencies. A consumer's file may also include public
record items such as a bankruptcy filing, judgment or lien. Note that
these types of data sources often contain SSNs, as well.
For purposes of data accuracy and proper identification, generally
our members maintain information such as a consumer's full name,
current and previous addresses, Social Security Number (when
voluntarily provided by consumers) and places of employment. This data
is loaded into the system on a regular basis to ensure the completeness
and accuracy of data.\4\
---------------------------------------------------------------------------
\4\ Note that there are in fact a number of major credit reporting
systems in this country. Within CDIA's membership the three most often
recognized systems would be Equifax, Atlanta, Georgia; Experian, Costa
Mesa, California; and TransUnion, Chicago, Illinois. These systems not
only manage their own data, but provide data processing services for
the hundreds of local independently-owned automated credit bureaus in
the Association's membership.
---------------------------------------------------------------------------
It is interesting to note that the vast majority of data in our
members' systems simply confirms what most of you would expect; that
consumers pay their bills on time and are responsible, good credit
risks. This contrasts with the majority of systems maintained in other
countries, such as Japan or Italy, which store only negative data and
do not give consumers recognition for the responsible management of
their finances.
As important as knowing what we have in our files is also knowing
what types of information our members do not maintain in files used to
produce consumer reports. Our members do not know what consumers have
purchased using credit (e.g., a refrigerator, clothing, etc.) or where
they used a particular bank card (e.g., which stores a consumer
frequents). They also don't have a record of when consumers have been
declined for credit or another benefit based on the use of a consumer
report. Medical treatment data isn't a part of the databases and no
bank account information is available in a consumer report.
THE FAIR CREDIT REPORTING ACT (FCRA)
In addition to our general discussion of the industry, we believe
it is important for your Subcommittee to have a baseline understanding
of the law which regulates our industry.
Enacted in 1970, the Fair Credit Reporting Act was significantly
amended in the 104th Congress with the passage of the Credit Reporting
Reform Act.
Congress, our Association's members, creditors and consumer groups
spent over six years working through the modernization of what was the
first privacy law enacted in this country (1970). This amendatory
process resulted in a complete, current and forwarding-looking statute.
The FCRA serves as an example of successfully balancing the rights of
the individual with the economic benefits of maintaining a competitive
consumer reporting system so necessary to a market-oriented economy.
The FCRA is an effective privacy statute, which protects the
consumer by narrowly limiting the appropriate uses of a consumer report
(often we call this a credit report) under Section 604 (15 U.S.C.
1681b), entitled ``Permissible Purposes of Reports.''
Some of the more common uses of a consumer's file are in the
issuance of credit, subsequent account review and collection processes.
Reports are also, for example, permitted to be used by child support
enforcement agencies when establishing levels of support.
Beyond protecting the privacy of the information contained in
consumer reports, the FCRA also provides consumers with certain rights
such as the right of access; the right to dispute any inaccurate
information and have it corrected or removed; and the right to
prosecute any person who accesses their information for an
impermissible purpose. The law also includes a shared liability for
data accuracy between consumer reporting agencies and furnishers of
information to the system.
SOCIAL SECURITY NUMBER USES
Let me now turn to the question of how our industry uses the SSN.
Under the Fair Credit Reporting Act, our industry has a duty to ``.
. . employ reasonable procedures to ensure the maximum possible
accuracy . . .'' of the consumer report. Further, we must design
systems that accurately allow our customers to extract only the data
requested on a specific individual.
We must accomplish this dual mission of accuracy both in terms of
building databases, but also properly identifying files in our systems
in the context of a highly mobile society. Consider the following:
Approximately 16% of the nation's population moves each
year according to the U.S. Census Bureau, which means many addresses
change each year. (This equates to approximately 42 million Americans)
Based on National Center for Health Statistics, it is
estimated that there are 2.4 million marriages and 1.2 million divorces
annually. This event frequently triggers changes in addresses as well
as last names.
In 1998 there were 6 million homes in the U.S. that are
considered vacation or second homes. Consumers often switch billing
addresses if they stay at such residences for long periods of time and
in some cases maintain billing addresses for both residences with
various creditors. (Source: U.S. Census Bureau House Vacancy Survey as
extrapolated by the National Association of Realtors)
These data clearly speak to the challenge our members face where
identifying data often changes.
In light of the mobility of our society, the Social Security Number
plays a very significant role in ensuring data quality. Our members
process 2 billion data elements a month. These elements are a
combination of credit history data and identifying information.
Consider the following very real example.
Where a consumer has changed a last name due to marriage or divorce
and has moved to a new address, which is common in either case, the SSN
is the most stable identifying element in the file. First, it helps us
to identify the consumer's file with precision during this life
transition where he or she is likely applying for new credit, seeking
approval for utilities, and seeking to rent or purchase a new
residence. The consumer expects that the consumer report will be
available for all of these necessary transactions and the SSN helps our
members to meet this expectation. Second, the consumer expect his or
her file to be accurate and the SSN helps us to maintain the file
accurately even when the consumer is in the midst of updating creditors
with changes in name and address.
The SSN is also a critical element in producing information
products, which are commonly called locator services. These services
are made available, for example, to child support enforcement agencies
for purposes of locating non-custodial parents;\5\ to pension funds
which must locate beneficiaries; to law enforcement for locating
criminals or witnesses; \6\ to healthcare providers that must locate
individuals who have chosen not to pay their bills, to state benefits
agencies to reduce public assistance fraud,\7\ and for other similar
uses.
---------------------------------------------------------------------------
\5\ The U.S. Department of Health and Human Services noted that
``[r]outine transfer of child support payment information to credit
bureaus . . . is essential because these obligations may constitute a
superior lean on a creditor's income.'' A Guide About Child Support
Enforcement for Credit Grantors, U.S. Department of Health and Human
Services, Family Support Administration. November 1988. In addition The
Association for Children for Enforcement of Support reports that public
record information provided through commercial vendors helped locate
over 75 percent of the ``deadbeat parents'' they sought. Information
Privacy Act, Hearings before the Comm. on Banking and Financial
Services, House of Representatives, 105th Cong., 2d Sess. (July 28,
1998) (statement of Robert Glass).
\6\ Then-FBI Director Louis Freeh testified before Congress in 1999
and noted that in 1998, his agency made more than 53,000 inquiries to
commercial on-line databases ``to obtain public source information
regarding individuals, businesses, and organizations that are subjects
of investigations.'' This information, according to Director Freeh,
``assisted in the arrests of 393 fugitives, the identification of more
than $37 million in seizable assets, the locating of 1,966 individuals
wanted by law enforcement, and the locating of 3,209 witnesses wanted
for questioning.'' Hearing before the Senate Comm. on Appropriations
Subcomm. for the Departments of Commerce, Justice, and State, and the
Judiciary and Related Agencies, March 24, 1999 (Statement of Louis J.
Freeh, Director of the Federal Bureau of Investigation).
\7\ Consider the following examples:
``Individuals confined to a correction facility for at
least 1 full month are ineligible to continue receiving federal
Supplemental Security Insurance (SSI) program benefits. . . . Between
January and August 1996, the sharing of prisoner data between SSA and
state and local correction facilities helped SSA identify about $151
million overpayments already made and prevented about $173 million in
additional overpayments to ineligible prisoners.'' General Accounting
Office, Social Security Numbers: Government Benefits from SSN Use but
Could Provide Better Safeguards, GAO-02-352 (May 2002), 15, citing
General Accounting Office, Supplemental Security Income: Incentive
Payments Have Reduced Benefit Overpayments to Prisoners, GAO/HEHS-00-02
(Nov. 22, 1999).
``Applicants for Temporary Assistance for Needy Families
(TANF), a program designed to help low-income families, are required to
provide their SSNs. Some agencies share SSN information to verify
eligibility and identity. Between January and September 1999, New York
State estimated that SSN verification saved about $72 million.''
General Accounting Office, Social Security Numbers, Government Benefits
from SSN Use but Could Provide Better Safeguards, GAO-02-352 (May
2002), 15, citing General Accounting Office, Benefit and Loan Programs:
Improved Data Sharing Could Enhance Program Integrity, GAO-HEHS-00-119
(Sept. 13, 2000).
``The Department of Education uses SSNs to match data on
defaulted education loans with the National Directory of New Hires
(NDNH). . . . As a result of this matching . . . the department
reported collecting $130 million from defaulted student loan borrowers
in 2001.'' General Accounting Office, Social Security Numbers,
Government Benefits from SSN Use but Could Provide Better Safeguards,
GAO-02-352 (May 2002), 16.
Federal agencies that are owned money share that
information with the Treasury Department which matches the debtors'
SSNs with those taxpayers that are owed tax refunds and reduces the
refund by the amount owed. In 2001, the Treasury Department offset tax
refunds by $1 billion. Id.
---------------------------------------------------------------------------
Further, the SSN plays a role in fraud prevention products. Where a
consumer makes application for a product or service, information
products that help the business to ensure that they are doing business
with the right consumer use information products to authenticate or
verify the application information. This is true in both for bricks-
and-mortar business and in e-Commerce.
If applicant data does not match, then the business can take
additional steps to verify the consumer's identity and thus prevent
fraud.
FRAUD PREVENTION AND IDENTITY THEFT
In your press release announcing this hearing, you mention the
potential for misuse of the SSN. Our industry has a history of bringing
forward initiatives to address fraud. These efforts focus on the use of
new technologies, and better procedures and education. CDIA and its
members have a long history of being leading innovators of identity
fraud solutions. The attachment provides a short thumbnail of our
involvement in identity fraud remediation since 1993.\8\
---------------------------------------------------------------------------
\8\ While we agree that identity fraud is a significant problem, we
also hope the committee will consider any legislation in the context of
the most accurate and reliable data on the scope of the problem. One
witness has suggested that the number of identity fraud victims could
be between 700,000-1.8 million per year. Misuse of Social Security
Numbers: Hearing before the House Comm. on Ways and Means Subcomm. on
Social Security, 108th Cong. (July 10, 2003) (statement of Steve
Edwards, Special Agent in Charge, Financial Investigations Unit,
Georgia Bureau of Investigations; State Coordinator, U.S. Department of
the Treasury, Financial Crimes Enforcement Network; and Vice Chairman
of the Board of Directors, National White Collar Crime Center). CDIA
feels that the best review of the level of identity fraud victimization
is closer to 60,000 to 92,000 per year, General Accounting Office,
Identity Theft: Prevalence and Cost Appear to be Growing, GAO-02-363
(March 2002), 4, or 162,000 per year. FTC Reports: Figures and Trends
on Identity Theft, January 2002-December 2002. The GAO figures were
developed based on interviews with three national consumer reporting
agencies. Consumer reporting agencies are probably the best source
understanding the scope of identity fraud victimization as victims are
mostly likely to contact consumer reporting agencies as a first
response.
---------------------------------------------------------------------------
CONCLUSION
In conclusion, you can see by our actions that in large part our
uses of the SSN are governed under the Fair Credit Reporting Act, one
of the most extensive privacy laws in the country. Beyond law, our
members have a history of proactively limiting how SSNs are used
outside of the FCRA. No one particular element of information is the
key to identity theft. The underlying theme in all of this is balance.
Laws that overreach in attempting to limit use of the SSN are
likely to merely take fraud prevention tools out of the hands of
legitimate businesses at the expense of consumers. Ironically, to
prevent fraud you must be able to crosscheck information. To maintain
accurate databases, you must be able to maintain a range of identifying
elements. Absent the availability of the SSN, we will be less able to
build accurate data bases, to accurately identify records and to help
prevent the very crime through the development of fraud prevention and
authentication tools.
Thank you for this opportunity to offer testimony. CDIA is
available to assist your and your committee at any time.
__________
Consumer Reporting Agency Responses to Identity Fraud
1993. Consumer Data Industry Association, then known as
Associated Credit Bureaus, formed a Fraud and Security Task Force.
1998. Creation of True Name Fraud Task Force led by
former Vermont Attorney General M. Jerome Diamond. The work of the task
force included meetings with law enforcement, consumer organizations,
privacy advocates, legislators and staff, victims, and others.
The capstone of the True Name Fraud Task Force was a
series of initiatives announced in March 2000. These initiatives meant
the consumer reporting industry was the first industry to step forward
and not only educate its members about the problems consumers
experienced, but to seek specific changes in business practices. The
initiatives are to:
Advocate the use and improve the effectiveness
of security alerts through the use of codes transmitted to creditors.
These alerts and codes can help creditors avoid opening additional
fraudulent accounts.
Implement victim-assistance best practices to
provide a more uniform experience for victims when working with
personnel from multiple fraud units.
Assist identity theft victims by sending a
notice to creditors and other report users when the victim does not
recognize a recent inquiry on the victim's file.
Execute a three-step uniform response for
victims who call automated telephone systems: automatically adding
security alerts to files, opting the victim out of prescreened credit
offers, and sending a copy of his or her file within three business
days.
Launch new software systems that will monitor
the victim's corrected file for 3 months, notify the consumer of any
activity, and provide fraud unit contact information.
Fund, through CDIA, the development of a series
of consumer education initiatives through CDIA to help consumers
understand how to prevent identity theft and also what steps to take if
they are victims.
2001. CDIA announced a police report initiative so that
when a police report is provided as part of the process of disputing
fraudulent data, Equifax, Experian and TransUnion will block these
disputed items from appearing on subsequent consumer reports regarding
that individual.
``Another collaborative effort with tremendous
promise is your new police report initiative. . . . I appreciate that
certain consumer-based initiatives require you to balance accuracy
issues--knowing that the consumer's report contains all relevant credit
information, including derogatory reports--against customer service.
From my perspective, your police report initiative strikes just the
right balance.'' J. Howard Beales, III, Director of the FTC's Bureau of
Consumer Protection, before the Consumer Data Industry Association.
Jan. 17, 2002.
2002-03. ID Fraud Victim Data Exchange. CDIA and its
members committed in 2002 to start a pilot test in early-2003 so that
when an ID fraud victim calls any one of the participating credit
reporting agencies, the victim will be notified that his or her
identifying information will be shared by the receiving credit
reporting agency with the other two participating credit reporting
agencies and that the following steps will be taken by each recipient
of the victim's information:
A temporary security alert will be added to the
victim's file. This security alert will be transmitted to all
subsequent users (e.g., creditors) which request a copy of the file for
a permissible purpose under the Fair Credit Reporting Act.
The victim will be opted out of all non-
initiated offers of credit or insurance.
The CRA will ensure that a copy of the victim's
file is in the mail within three business days of the victim's request.
Our efforts are paying off.
Most calls are prevention related. CDIA members
report a majority of consumers who contact fraud units are taking
preventative steps and are not reporting a crime.
Victims are learning of the fraud earlier.
According to an FTC report in June 2001, 42% of victims learn about the
crime within 30 days or less, a full 10% less than in the prior report.
CDIA estimates another 35% learn of the crime within one to six months
and 7% learn of the crime in six months to a year.
Victimization of the elderly is dropping. In
2001, the FTC estimated that 6.3% of identity fraud victims were over
65, a 5% decrease from 2000.
About CDIA
Founded in 1906, the Consumer Data Industry Association (CDIA),
formerly known as Associated Credit Bureaus (ACB), is the international
trade association that represents more than 400 consumer data
companies. CDIA members represent the nation's leading institutions in
credit reporting, mortgage reporting, check verification, fraud
prevention, risk management, employment reporting, tenant screening and
collection services.
For more information about CDIA, its members, or identity fraud or
other issues, please visit us at www.cdiaonline.org or contact us at
202-371-0910.
Statement of the Honorable Darlene Hooley, a Representative in Congress
from the State of Oregon
Just last week this very committee heard testimony on the many
problems caused by the misuse of Social Security numbers and the ever
increasing problem of identity theft.
I have become increasingly concerned about the vast quantities of
sensitive, personal information that is now vulnerable to criminal
interception and misuse. Currently, the ease of obtaining the Social
Security number of an individual is shocking. Numbers are sold,
exchanged and printed with an alarming carelessness. With a Social
Security number and a few pieces of other easily obtainable personal
information, fraudulent accounts can be opened and lives can be ruined.
Many individuals work their entire life to build a spotless credit
record, only to have it destroyed by a criminal armed merely with a
Social Security number. The protection of Social Security numbers is a
vital step to slowing the growth of identity theft and protecting
people's lives.
I've been active in trying to prevent further horror stories of
misused Social Security numbers. Two and a half years ago, a young boy
in Salem named Tyler Bales lost his battle with a rare genetic disease
called Hurler syndrome. As if it were not hard enough to lose your
sixteen month old child, Tyler's parents later learned--courtesy of the
IRS--that someone was claiming Tyler as a dependent on their 2000
income tax return.
Because of disclosure issues, the IRS could not give out the
identity of this thief to local law enforcement, even though ID theft
is a felony offense in the state of Oregon. To date, two and one half
years later, the Bales still do not know the identity of this thief.
For this reason, I request that the House Committee on Ways and
Means consider the ``ID Theft Loophole Closure Bill'' as the committee
seeks legislation to prevent the misuse of Social Security numbers.
This legislation simply changes the law to allow the IRS to furnish the
name, Social Security number and address of a suspected identity thief
to state and local law enforcement agencies for the exclusive purpose
of locating the individual.
Identity theft is not a victimless crime. We must cut the red tape
that is preventing thieves from being prosecuted for their crimes, and
I believe this legislation is the right tool for the job.
Statement of the Honorable Max Sandlin, a Representative in Congress
from the State of Texas
Thank you Mr. Chairman and Ranking Member Matsui, for the
opportunity to testify today on the impact of the use and misuse of
Social Security numbers.
I am pleased that my colleagues on the Ways and Means committee
have convened a hearing on how the growing use of Social Security
numbers as a national identifier has resulted in the mounting problem
of identity theft. As you know, while our Social Security numbers were
expressly created to catalogue workers' earnings for benefit purposes,
nearly every branch of our society has co-opted Social Security numbers
as an identification method. Our Social Security numbers can be found
on records kept by schools, banks, businesses, and many states even
list them on people's drivers licenses.
While the use of Social Security numbers is very convenient and
facilitates commerce through easy credit checks, we need to be
cognizant of how the over exposure of Social Security numbers also
easily enables criminals to commit identity theft. Simply by stealing
an individual's purse, a thief may have immediate access to an
individual's name and social security number and use that information
to open new credit cards, establish new bank accounts, and even
initiate new cell phone service, all to ring up charges that their
victims will be left to contest. In the mean time, innocent, hard
working, victims may find their credit destroyed, and may not even know
about the theft until they are turned down for a mortgage or car loan.
Once this occurs they are then forced to embark on an arduous process
to restore their financial standing, while their dreams for a new home
or needed vehicle remain on hold.
The Federal Trade Commission noted that identity theft has
increased over 88% just in the last year, with nationwide complaints
totaling 162,000. In my home state, over 14,000 Texans filed victim
complaint statements last year with the Federal Trade Commission. Their
tragic experiences provided the impetus for our state legislature's
enactment of a law to combat identity theft last month. While we were
only the second state in the nation to do so, seven other states are
actively considering similar legislation.
We must continue to find ways to protect the citizens of this
country from fraud and abuse caused by criminals committing identity
theft. The Social Security Administration, credit bureaus, businesses,
individuals and other federal, state and local government agencies must
all coordinate resources to offer a comprehensive plan of action and
protection. On the federal level, I am pleased to be a co-sponsor of
H.R. 2035. This bill requires consumer reporting agencies to provide
free credit reports annually upon the request of a consumer, as well as
require the truncation of credit card numbers on printed receipts. By
enacting common sense legislation like this, individuals will be able
to detect identity theft at an early stage, before their credit reports
are permanently damaged.
Congress has a responsibility to help the American people, and our
National economy, prosper. Strengthening financial privacy laws and
protecting Social Security numbers will help to achieve these goals.
Thank you for your time.