theft victim's bill of rights today's hearing will examine identity theft and its impact on victims on our first panel we will hear from government witnesses who will testify about how the federal government addresses identity that our second panel comes from outside the government and they will tell us about their experience with and research on identity that both panels was a recommendation that they believe will improve current assistance programs to victims and discourage identity  theft and without objection the chair and ranking member will have five minutes to make opening statements followed by opening statements not to exceed three minute by any other member who seeks recognition without objection members and witnesses may have five legislative days to submit a written statement or extraneous material for the record the purpose of today's hearing is to examine the actions of the federal government has taken to address the problem of identity theft and how to provide protection to victim we will consider many important topics today including current and emerging issues on identity that how to improve both public and private assistance efforts to victims of identity theft and how to increase prosecution and terrorists of identity thieves according to recent studies identity theft affected nearly ten million americans in two thousand and eight an increase of twenty two percent from two thousand and seven it is estimated that the average cost to consumers and business top forty nine billion dollars identity theft is now the number one consumer complaint we see about a federal trade commission accounting for twenty six percent of all complaints received from consumers in two thousand and eight identity theft is not a victimless crime there are many victims of identity theft  commonly the same victim is targeted over and over again the victims include eighteen month old children dc's loved ones banks insurance companies small businesses and the federal government women hispanic americans military personnel and medicare recipients are most likely to be victims of identity theft secondary  tertiary victims of identity theft include family employers and financial institutions identity that bad cell includes not only financial losses but also nonfinancial medical services many times it is difficult for the victim to expunge their criminal and medical records from incorrect information leading to fall so arrest wrong diagnosis experts agree that identity theft prevention and assistance apheresis are lagging far behind the needs of the victims all identity crime victims today right into a vast number of problems when trying to restore their identity and identity quick to overcome any obstacles set in place by legislation today the committe will focus on these concerns voiced by the public in a collaboration to combat and prevent identity theft i thank god of our witnesses for appearing today and look forward to their testimony assistant attorney general and in the department of criminal division prior to working at the department of justice he was an assistant u s attorney in the southern district of new york where he prosecuted criminal cases involving violent crime gangs public corruption and financial crimes and welcome to you our last witness on the first panel is mr dan burton director  almost two million consumers have turned to the federal trade commission after they discovered that someone else has used their name to open up credit accounts get a job or you know a pain health care among these victims a soldier returning from afghanistan a mother calling on behalf of her disabled child whose identity was stolen and people whose government benefits were terminated because someone else is working in their name the f t c is the nation's one stop shop for identity theft victims we have a toll free hotline t callers with trained counselors who in english or spanish can walk the consumer through the steps of recovery online resources at f t c dot gov slash i d theft provide the same types of assistance explaining how to set fraud alerts with the credit reporting agencies how to dispute fraudulent charges or accounts and how to handle debt collectors last year alone we helped more than three hundred thousand consumers who were victims of identity theft in turn their complaints are entered into our consumer sentinel network which is an online resource for law enforcers with direct access to these two million complaints and other useful investigative resources other organizations including i tak that you'll be hearing from later also contribute data to consumer sentiment this robust database is the nation's clearinghouse of identity theft complaints in its an essential tool for all investigative agencies that are investigating or prosecuting identity crimes the f t c also has responded to new challenges with more refined tools for victims for example victims often need police reports in order to vindicate their good name but many law enforcement agencies are overtaxed they don't have sufficient resources to develop the kind of detailed police report that's necessary for recovery the f t c identified this issue as a priority so now when consumers file complaints with the f t c law enforcers over seven hundred agencies who have access to consumer sentinel can pull up that consumer's complaint validated as an identity theft report and a police report so now the consumer has their police report the police agency is able to scrape lee simplify this task for all involved we've also work closely with the i which has recently set up a dedicated helpline for victims of tax related identity theft we're launching a system to get callers connected to the specialized office of the i r s to resolve what are often very complex issues dealing with tax refunds or outstanding liability resulting from identity theft and commission staff coordinate with other organizations that can provide more individualized help when that's what's needed for example the identity theft resource center which also is testifying today is the recipient of the department of justice grant to establish a model nationwide victim assistance program our call center has implemented implemented a system to direct people to that office the f t c also is collaborating with the american bar association to establish a program to provide pro bono assistance to victims of identity theft next i'd like to briefly discuss some new remedies for identity theft victims the fact act which was passed in two thousand and three provided important tools for victims of identity theft we're now all entitled to a free copy of our credit report every twelve months from each of the credit reporting agencies credit report can offer an early warning sign of identity theft or that fraud is afoot the fact act also allows identity theft victims to block fraudulent items and trade lines on their credit reports they can place fraud alerts on their credit reports and obtain documents relating to the fraud such as a fraudulent application this last right is particularly important because many victims used to find themselves in a catch twenty two where they would be receiving dunning notices for these fraudulent lee opened accounts but were denied access to the forged application because it was submitted by another person this provision of the fact addresses the frustrating scenario credit freezes identity theft passports and other tools also help prevent identity thieves from exploiting consumers good names finally now i'd like to mention the f t c is legislative recommendations that address identity theft we have come a long way in building systems and processes to help identity theft victims but clearly more needs to be done the f t c is not a criminal enforcement agency so we cannot prosecute the crime our partners of the department of justice are working aggressively on that front strong data security locking down the data that identity thieves target is essential if we're to reduce the overall incidence of the crime that is where we can exert our law enforcement muscle in areas that have direct impact on identity theft although the f t c is maintain a vigorous presence bringing cases against companies that failed to use reasonable procedures to protect sensitive consumer information we could have an even greater impact if the commission could assess civil penalties for such violations the commission also has called for nationwide data security standards for those entities that are not already subject to such laws as well as a national breach notification law and finally the commission has recommended improved consumer authentication as well as restrictions on the display and transmission of social security numbers as part of a comprehensive approach to reducing the use of social security numbers in the commission of identity theft chairman claim members of the committee victims of identity theft often suffer harms that can endure for years although there now are more effective tools to respond to this crime victims still face challenges and address the subcommittee this afternoon as you know identity theft affects millions of americans every year and inflicts significant monetary and other harms upon its victims identity theft is by no means a new problem but the methods used to commit this crime are evolving while many criminals continue to use a variety of low tech means to unlawfully acquire the personal information of others in recent years identity thieves have begun to use a variety of new technologies and new methods to access and exploit such information as both individuals and businesses increasingly rely on computers and information technology to store process and share confidential personal information opportunities have increased for criminals to exploit advances in information technology to hack into the computers that store this information cybercrime once the province of the lone hacker is now big business and a growing number of potential victims are vulnerable but as criminals have adapted to take advantage of new opportunities and data made available through networks and the internet law enforcement has adapted as well the department of justice along with our law enforcement partners has been aggressively investigating and prosecuting crimes that facilitate or constitute identity theft with tremendous success our benchmark prosecutions of large scale data breaches in the identity theft that results from those breaches highlight the range of our efforts to address this growing problem for example most recently in late two thousand and eight the f b i i announced the results of a two year undercover operation targeting members of the online carding forum known as dark market at its peak the dark market web site had over twenty five hundred registered members around the world the operation resulted in nearly sixty arrests worldwide and prevented an estimated seventy million dollars in economic loss in august of two thousand and eight the department of the u s secret service announced the largest hacking and identity theft case ever prosecuted in which charges were brought in three districts against eleven members of an international hacking ring the defendants who hailed from the united states dystonia ukraine the people's republic of china and belarus were charged with among other things the theft and sale of more than forty million credit and debit card numbers obtained from various retailers in two thousand for an operation firewall the u s secret service and several components of the department of justice coordinated the search and arrest of more than twenty eight members of the shadow crew criminal organizations who are located in eight states here in the u s and in six foreign countries members of that group were later charged in a sixty two kind of diamond with trafficking in at least one point five million stolen bank in credit card numbers that resulted in losses in excess of four million dollars as a result of that case the shadow crew website was disabled which we believe prevented hundreds of millions of dollars in addition losses and to date with the exception of two fugitives all of the domestic shadow crew defendants have pleaded guilty and received sentences of up to nine months in prison and operation firewall was one of our early efforts to pave the way for some of the more recent successes i mentioned and there are outlined in my written testimony in these cases that i've discussed and the others discussed in the written testimony illustrate the scope of the department's efforts to combat the growing identity theft problem but notably they also revealed the global reach that cyber criminals can have the identity thieves in the cyber criminals responsible for many of these and other large scale data breaches live in and operate from foreign jurisdictions because of the global nature of the internet and the identity theft related crimes that it can facilitate continued close coordination and cooperation with foreign law enforcement is critical to the success of our identity theft investigations and prosecutions here at home in addition to our efforts to investigate and prosecute identity theft we are also committed to continuing to work in coordination with other agencies to aid the victims of this serious crime through grants such as grants the identity theft resource center and other agencies training and other victim assistance programs while the department is proud of these cases and of all of our efforts to tackle the growing and evolving identity theft problem we recognize that there is much more to be done and we will continue to work with our law enforcement and private sector partners to meet that challenge our continued success is dependent on our ability to number one build upon the united states existing relationships with international partners to strengthen law enforcement cooperation channels internationally and number two to explore legislation that would strengthen the penalties for stealing identity information and other related cyber crimes and that would require security breach reports to federal law enforcement so that we may pursue the criminals responsible for these acts as quickly and vigorously as possible this of course is just a brief overview of the department's role in combating these crimes and the primary issues we must focus on as we press ahead we're very glad to have the opportunity this afternoon to discuss these issues with you further and at the appropriate time of the please answer theft such information including one's name date of birth an s s n is key to carrying out so many activities of daily life however this information is also valuable to a person seeking to commit fraud or identity the advances in information technology have made it easier to collect and share sensitive information that also resulted in more incidents of loss in an authorised to use my remarks today focus on three areas why we should be concerned about identity theft actions taken at the federal state and local levels the continuing challenges to protecting sensitive information in summary identity theft affect ten million persons annually translating into reported losses of fifty billion dollars victims are often on aware that the crime has taken place and so much harm has been done to their credit rating and could face substantial cost and inconvenience repairing the damage others have lost jobs been refused loans or even arrested for crimes they didn't commit during the course of our work we have documented real life examples of identity theft both domestic and international including a two thousand and six case of an ohio woman who led a group of identity thieves and stealing information from public record keeper websites resulting in four hundred fifty million dollars in losses in a two thousand seven case of an individual who partnered with the u s from russia and romania in an online phishing scam you can compromise a report thousand credit card accounts you know taint full identity information for over six hundred victims various laws and actions at the federal state and local level aimed to deter identity theft at the federal level the privacy act of one nine hundred seventy four and the government act of two thousand to define agencies responsibilities for protecting personal information moreover the federal information security management act of two thousand and two requires agencies to develop programs for securing sensitive data information systems over the last several years the op's the management and budget has also issued numerous directives requiring agencies to have put in addition steps for safeguarding personal information including establishing senior privacy officers developing data breach notification plans states and localities have also acted to prevent identity theft and assist victims more states now recognize identity theft and related activities as crime when many others have incorporated victim assistance provisions into their laws such as credit or security freezes and some county governments have also begun removing or  displayed in their public records despite these actions vulnerabilities persist in three critical areas first issues related to display and use of the s s n have not been sufficiently addressed because of its unique nature and broad applicability  assent is become the identifier of choice for both the public and private sectors and fortunately unfortunately millions of electronic public records contain s a sense that can be easily compromised due to the absence of a national standard for s a central cation that is the practice of blocking you the first five or last four digits of the number to illustrate within a matter of minutes we easily reconstructed full nine to git us a sense another identity information for individuals in ten states by combining various electronic records that use disparate truncation methods we've recommended that the congress establish a national truncation standard second federal law does not cover all data or services provided by information resellers in other industries today data resellers in their contractors electronically amass and share a large amounts of personal information however no federal law explicitly requires them to safeguard all personal data even one of the sensitive subject to misuse by identity thieves and we've recommended that the congress strengthen requirements for information resellers in other industries similar to those imposed on financial institutions and lastly federal agencies continue to experience security instances that may expose sensitive information to identity thieves fairlane she's ally heavily on automated systems and electronic data which must be protected against unauthorized use we've made numerous recommendations to broadly strengthen the integrity of federal information systems and ultimately reduce breaches and other security incidents however continued breaches at various federal agencies and facilities such as the national archives underscore the importance of vigilance in this area we've noted that data breach notifications to affected can have clear benefits in terms of mitigating the impacts of identity theft and enhancing public accountability and i've recommended the o m b develop guidance to help agencies make risk based decisions as to what services to offer individual personal information has been but you know it's obvious there is an identity theft challenge that we're facing as a country and congress in the house we've got largely divided jurisdictions and so we have a jurisdictional committee issue on this issue as well in terms of really acting to preclude some of the issues that you brought up today on financial services we certainly have a substantial amount of concern there with identity theft and how that as ramifications for people's credit ratings and and access to credit generally mr bertone you reference a  standard now you're talking about to truncate someone's social security number correct would that is that difficult to do because what the federal government said with security number is it  use of user social security number is basically your identifier what we have to change existing law there in order to acknowledge that it is in fact an identification number that we take in questions  the fact is that the as is and has been become the unique national identifier as to say we'll say that it is not to be used for identification purposes but let's face it that's where we're at you can't rent a movie from blockbuster or get satellite television without providing your your s s n and that's being bumped against other data elements to confirm the identity and in our view the so syria number is probably the most critical piece of information evident at the end dennehy thiis would want in terms of the personal identifying information that they can get their hands on without the s s n the other elements are much more difficult to do anything with i don't believe you have to do of taking some next steps to broaden that testing make some other industries as far as truncation goes it's not difficult it's a matter of getting out a national level the standard to be consistent because if you're truncating on the front half and an and speaking of social security numbers and your you mentioned the national archives the loss of information or theft of information we're not certain of even now what exactly  happened the hard drive disappearance of the national archives included one hundred thousand social security numbers including apparently al gore's daughter's social security numbers is in this information and contact information including addresses for various high ranking clinton administration officials secret service law as well as secret service and and number of other personnel that are included this is highly sensitive so you know i'm not asking you to testify about the procedures at the national archives but what can the government do to mitigate the damage or potential damage of this loss of information i think right up front some thought to encryption should have been at in play if you have encrypted data you leave it somewhere where it shouldn't be it's going to be much more difficult for an identity t something with specially if it's up it's encrypted in accordance with new standards so on the front end i don't know what that data look like but i would hope i don't know if it had some type of an encrypted technology after the fact we now have to assessment assessing what's the likelihood that this is out there and being used and then beyond that you have to think about what services you're going to you can offer passive monitoring or active alerts on credit records or you know even credit freezes so there yes briefly the social security security number is indeed a very sensitive and valuable piece of identity for identity thieves partly the because it's not only as an identifier to link you with your information but also as an authentic number is not the defacto key to the kingdom but the more robust systems are in place to prevent that type of fraud from happening and of course other recommendations certainly locking down social security numbers having appropriate data security are important front but we can't civil penalties those laws do not give us the authority to impose civil penalties against those companies so while we can get injunctive relief that requires them to subject themselves to audit that requires them to take certain steps to improve their data security program at this present time we cannot assess civil penalties that is one of the legislative recommendations the commission has made because we identity theft that can provide greater assistance more individualized care for people more engaged problems what we find at the of the three hundred thousand people who contacted us last year seeking assistance many of them are able to  themselves to restore their credit history to dispute fraudulent accounts there are tools in place and many consumers are able to exercise them in more complex problems or with consumers who are not able to exercise those rights we find those organizations often can provide additional assistance doing a lot of work every day twenty thousand contacts every week from consumers asking for information or seeking advice on identity but there are some cases the rise what are some of the new or emerging forms of the  private the crime varies from low tech to high tech there are still plenty of idea identity thieves who use low tech means to get personal identifying information and exploited using the telephone  d and their own personal skill of dealing with people but the high tech trend i think the most troubling is the carving form and according forum is an online active marketplace for the nationwide have been prosecuting prosecuted been the most challenging have involved carting forms and they're challenging on a number of levels first they have numerous members of the dark market when i mention the twenty five hundred active members at one time second those members  worldwide and so they present a lot of the challenges that any international case presents but those what makes those such disturbing trends in identity theft is that they are so sophisticated they're so organized  as i said in my statement identity thieves used to be so actors now identities are often linked with organized crime and we find that organized crime especially international organized criminal organizations are capitalizing on the value of personal identifying information and exploiting that to make lots of money very quickly if you go on one of these carding forms if you are about four and you're able to get access to it or as we do if an undercover officers able to get access your mind will be blown by what is going on on the sites stolen credit card a t m information that has been obtained through computer intrusions is there for sale people who can commit hacking and other types of intrusions are offering their services for  massive amounts of money to steal massive amounts of money in a short time so that i think is the most difficult trend in high tech identity theft and that's the one that we're most concerned about what what type of legislation could we in that prosecutors anywhere in pursuing this type of crime this type of crime and we try to keep pace with and anticipate what the cyber criminals will do next but there are two areas in the law that i think even after the identity theft enforcement restoration of two thousand and eight that that are areas where we can still improve our efforts number one legislation that will enable us to better coordinate and cooperate with our international partners as the examples i gave in my statement and the others that are mentioned in the written testimony indicate this is increasingly an international crime a transnational crime and as i indicated a moment ago because this crime is increasingly committed by or participated in by international criminal organizations it is absolutely essential that we be able to with foreign law enforcement and cooperate foreign law enforcement is a two way street every day we ask foreign governments and foreign law to help us in prosecutions that we're engaging in over here but they need our help as  well and so legislation that clarifies the authority of u s courts to compel the production of evidence that can be used in a foreign criminal investigation something by the way that was one of the recommendations in the identity theft task force a few years ago but that has been made into law yet would be a very effective tool because the more we can offer help to our foreign partners who are fully engaged on this issue the more we can expect them to help us that's number number one number two closer to home and that's sensing the congress  intensive and it's much more dangerous because using high technology identity thieves can get more people's information and more and more money in a short period of time the guidelines to punish that kind of identity theft involving that kind of technology and those kinds of means much more for eight years we often wrestle with the issue of identity theft and i recall one of my colleagues in the legislature calling me one time and reciting to me my social security number that he found on a local government website because i had gotten a traffic ticket and the clerk of courts in his infinite wisdom decided that all records not only are public but should be published on the internet and so we worked to modify that in the state of ohio but i gotta tell you it long time to make that happen so i'm interested in the perspective and all of you really all three of you as to what we can do at the congressional level to this always happens when i'm i'm asking questions but to what we might be able to do to provide guidance the state and local governments because they continue to have this problem this quandary between making information available to the public and protecting the privacy of the citizens of their various jurisdictions and you find that the policies are all over the place and the case of hamilton county where i am in cincinnati the clerk of courts was simply taking documents scanning documents and putting them directly onto the internet despite just fight the fact that they had they had information about people's bank accounts they had social security numbers they had private information they weren't redacting the information his excuse was that they couldn't redact the information because it was documents being scanned which i found to be kind of lame but but i would like your input as  to how we might do a better job in informing policy at the state and local level so that those local entities aren't making this information available because we see this happen all the time i could take a shot at that before you came and i had a lot to say about public record keepers i think one thing we have here you know issues of federalism stin state rights certainly but i do believe through the years the opportunity that we've had to look at this that states are becoming more aware of the value of s s n and other personally identifiable information in public records so we see we do see movement in many cases of states trying to at least sense florida wholesale has redacted as a sense from their records but there is variability one thing that we've tried to do or perhaps suggest is perhaps the association of governors can come together and talk about best practices for reduction in truncation but you know that's going to take some some cooperation across states as far as guidance i think there is there are good things happening out there that states are doing it's a matter of love raising up the level of a national level we're going to have a form and we've done that in various forms of testifying but what states are doing but given the number of entities a state local governments that are out there there there doesn't tend to be any uniformity and  i guess that's what i'm trying to get at how do we bring uniformity to the practices at the local level and terms of the availability of documents you know they're dealing with their own state's sunshine laws and what records need to be made available but how do we get to a point where there's uniformity at the state and local government level in terms of the information being made available i don't you know if we're going to be able to be able to direct states to either include or or or not include information you know i'm not getting we're getting into issues of federalism state rights but we believe there is an opportunity to establish at the congressional level a national standard for truncation so at least what's in there will be consistent in terms of how  issue about public access to data and social security numbers and it is a challenging one as mr bertone set out there are some models going forward certainly the federal court system and the bankruptcy court system have undertaken a system to truncate from their records social security number and other personally identifying information for which there is no public value in revealing of course we have a public interest in making transparency to process but there's a point at which this information does not serve that purpose and so in the federal court electronic system none of this data is readily available but there are many people who say that with respect to for example the social security number the cost associated with doing this process retroactively is overwhelming going through all of the records all of the housing records and anything else that may now be available electronically is very costly undertaking in other words maybe the feathers are already out of the pillow can't put them back in and then i would return to the issue of authentication if companies took better care and making sure that they were dealing with right person rather than just seeing a social security number and assuming that was adequate for opening an account then the availability of this information would be much less of a threat i'm not saying that it shouldn't be protected but this is all part of a comprehensive program to protect the data make it less available but also less useful for identity thieves if i could add to that  you're right i think in the case of ohio they sell public records to involve to various vendors so even if you were to start redacting or removing or truncating today those records have been sold and resold and resold already many many times so going forward you could you could sort of stop this flow of us a sense in the public records but keep in mind this information is already been sold to many vendors and that's where we get at the other piece of of our other recommendations that regardless of industry you have to look at the sensitivity of the information in and and mandate that that information be controlled we got a list of who you are and what what you're using it for information tax preparations telecommunications all those right now are held to a lower bar in terms of information disclosure and protection government system i don't think any widely plausible alternative currently exists but again this started in one nine hundred thirty five with an executive order that all federal agencies are going to use iesous for internal and external management of the program so this is a longstanding ingrained use usage i do know that there are alternatives being considered at least on a case by case basis the health and stree is starting to move away from the so security  your identifier and signing alternative patient numbers the office of management and budget in two thousand and seven directed agencies to look for alternatives to the s s and assigning numbers to personnel for either travel management or from day one think about how we would protect any single federal agency have the authority to regulate the use of the social security number in federal information systems not that i'm aware  dismiss this as a parable and then go into rees as for two votes on the floor when we come back swear in the second panel and members are reminded that you have up to five legislative days opening statements or any of the materials for the record and mr may had radio statement will be included without objection we stand in recess of the santa fe group a strategic consulting company based in santa fe and in new mexico the santa fe group specializes in briefings to c level executives  and boards of directors and financial institutions and other critical infrastructure companies and provides management for strategic industry and in dust and institutional projects and welcome to the subcommittee and next we will hear from mr mark bird the executive director of the electronic privacy information center in washington d c he teaches information privacy law at george down university law center and has testified before congress on many issues including access to information encryption policy consumer protection computer security and communication privacy and welcome to you mr roddenberry witnesses mr donald j rebel vich executive director of utica college's center for identity management information protection and executive director of the college's economic crime and justice studies program his background includes research in identity theft economic crime victimization white collar crime prosecution and multi task force development thank you for being here next we'll hear from ms and was president of the identity theft assistance corporation a nonprofit corporation that operates i tak the identity theft assistance center ms while it is a nationally recognized expert on privacy and financial services allowance she works to protect all consumers through consumer education and partners with allow enforcement to combat identity theft the vital witness is mr eric handy a representative for the identity of resource center mr handy is an i security and privacy specialist with the with fifteen years of information technology consulting experience he specializes in privacy and information security program implementation and program management oversight  thank you all for appearing before the subcommittee today and it is the policy of the subcommittee to swear in all witnesses what they testify i'd like to ask you to stand and raise your right hand most of my career in the financial services industry most recently as the founding c e o a c e o driven nonprofit financial services consortium i also grew up in a small town in missouri and my dad was a banker  bank for a while today i'm involved in efforts to examine the way of the financial services industry is regulated in the impact of policy on consumers in this area of identity theft i believe we are just at the tip of the iceberg because of the growing cyber security threats we face and it's why we think that a victim's bill of rights is necessary the victims voice is seldom heard in the debate this testimony reflects the work of the santa fe group vendor council which was formed in two thousand and six to bring together leaders at service provider organizations the vendor council promotes the development of secure best in class technology solutions standards and best practices related to fraud payments cyber security data protection identity crime last fall the vendor council formed an identity management working group to develop an inventory of best practices for assisting victims of identity crime and suggesting improvements in law and corporate practice to make it easier for victims to dispute false claims and reclaim their identity my testimony today will speak to some the victim's bill of rights and the written testimony has many other background much other background information identity crime victims deserve the same rights as other crime victims identity crimes can be physical emotional and financial and have those impacts compared to other crimes today most identity crimes will be treated as missed the mean misdemeanors are very low level felonies and the majority prosecutions will be civil as opposed to criminal actions we need better coordination awareness of the victim experience in concrete steps for correcting identity records for the benefits of individuals business and society we propose the following bill of rights for identity crime victims the right to assessment the right to restoration the right to freedom from harassment the right to potential prosecution of the offenders and the right to restitution anarchs plainly a little bit on each in the right to assessment consumers who suspect that they have become a victim of identity theft should have the right to assess the nature and extent of damage to their identity identity factor are already grants many of these rights but there are sometimes procedural catch twenty two all businesses and government agencies should be required to provide notice to consumers when they suffer a da breach involving loss of sensitive personal information but the present patchwork of state laws and government policy needs to be replaced with a uniform federal statute spelling out notification requirements the right to restoration is ideally victims should be able to restore their identities to their previous priests after state however this is not always possible especially with the complexity of the crime in actually with financial identity theft whether or not they can fully recover it's imperative that victims be able to establish correct records and access all of those records in all kinds of institutions relevant privacy laws need to be reviewed and amended giving victims the power to access and correct their own record the right to freedom from harassment comes because sometimes collections agencies and others during and after the identity restoration process harass the individuals that can the harassment happens because business and law enforcement have no way to distinguish victims from the thieves to go back to some states have issued identity theft passports to verify that the carrier has been a victim of identity theft and help the person prove his or her identity however these can be easily forged so however effective the documents are it remains to be seen with some system for identifying and verifying victims is needed the right to potential prosecution of offenders one of the great frustrations to identity crime victims is the lack of business and law enforcement resources to prosecute identity theft and again there's always a need to balance priorities and budgets but these organizations need to take the long view in the impact of identity crimes first that identity crime continues precisely because pays second the f b i and secret service have found that where there is one victim there are usually more and need to look at th aggregate and thirdly not all of the costs of identity crime are immediately visible or measurable the right to restitution is where identity crime victims can spend hundreds of dollars and they deserve restitution the same as victims of any other crime yet studies show that the defendants were ordered to pay and only about a third of the cases restitution will help make victims whole send a message to the end identity crime is real crime and helps ensure that when perpetrators are caught identity crime does not pay to further help victims the definition of comprehensible crime compensable crime under federal and state statutes should be expanded to include identity crimes in summary i'm recommending three things in terms of possible legislative actions and then for other things first to enact a uniform scheme across industry and government to identify dentity theft to assist identity theft victims and that's to include the five items included in the identity theft victims bill of rights secondly to create a national standard of identity identification one that cannot be forged by a dentist the thieves that victims can use to distinguish themselves third is to expand the definition of compensable kept say it's crime under federal and state law include identity of crime for other things or to invest in independent research on the effects of identity crime we need to get beyond the antics anecdotes to understand the actual relationship between data breaches in identity theft and to be able to understand what policies and law enforcement procedures are effective secondly there need to be standard dispute procedures in industry and law enforcement whereupon resolution victims could receive standardized verifiable letters proving the issues have been resolved third is the f t c does a terrific job in overseeing victims rights but it could be expanded and perhaps the role to make sure that there's cohesiveness across national laws to be more effective and to also make sure that law enforcement is investigating identity crime in a consistent way lastly there is much discussion  especially have today's announcement on a consumer financial protection agency in that dialogue the idea of identity theft policies and education should be concluded we thank you for this opportunity and again if there's any consumers my organization the electronic privacy information center has been working on the issue of identity theft almost since our founding fifteen years ago in fact i was going to mention to mr driehaus that one of our first case concerning the privacy of the social security numbers of employees in the state of ohio and we succeeded in that case they limited the use of the publication the but as you know that continues to be a very serious problem my comments today are directed toward what we see as the root cause of the first panel you heard from the f t c they talked about how they're assisting the victims of identity theft after they run into problems the department of justice is prosecuting the crime after the crime occurs but in our opinion not enough is being done to address the root causes of the identity theft problem and so and my statement which i will briefly summarize now i'm going to try to speak to that issue and suggest specifically for this committee some steps that you might take to reduce the problem of identity theft in this country because as you know not only is it a significant problem in fact the number one concern of american consumers according to the federal trade commission it's a growing problem that numbers been increasing since the f t c has been keeping track of it and it's  evolving problem which is to say i think we're about to experience new forms of identity theft the wall street journal for example reported just this week about an identity theft investigation in los angeles involving improper use of medical record information and we're going to be hearing a lot more about that as more of our personal medical information is digitized and made available online and so in just a few minutes i'd like to address what i see as at least five steps i believe the committee could take to try to reduce the problem out of its source one of the concerns today i believe should be the increasing transfer of information within the government to the internet you've already heard about people getting access to  public record information that contain social security numbers and bank account numbers well there's a big push right now in the federal government to take advantage of some of the new web two point zero services and we certainly support the president's call to make public information more widely accessible to the public but we think that privacy protection has to be part of that process privacy issues have not been given enough attention so far in this new push to make federal information available online we hope more can be done we think there are similar concerns with respect to the outsourcing of government services a lot of personal data is moved from government agencies to private contractors and it's not always clear  those contractors are subject to privacy act obligations or other contractual obligations to protect the personal information of the u s citizens that they now have obtained and you may recall in fact mr chairman last year in the run up to the presidential election there was the case over the state department involving the passport records of then senator obama and senator clinton and senator mccain that were all improperly  contractors that is closely tied to the problem of identity theft and we believe it's an issue that this committee could look at privacy legislation is a very important part of the way to get to the root cause of the problem it is simply too easy today for companies to collect a lot of detailed information about americans they have too few responsibilities and it's too difficult i believe for americans to protect their information once they've turned it over  to a bank or to some other firm what privacy legislation will do is put some obligations on those companies to ensure better security better safeguards will also i hope get some of those companies to think about whether it's such a good idea for example to collect social security numbers which we know will be the target for identity thieves who are trying to get access to that information if you are organizations in this country we're collecting the social security number and using the social security number we think the problem of identity theft would go down we'd also like to see more emphasis on privacy protection in the administration's focus on cyber security there's a lot of talk right now about strengthening the nation's infrastructure part of that has to be about the protection of personal information that's being stored on computers and servers in the united states and finally mr chairman i'd like to raise one issue it's a little bit futuristic but at the same time we believe it goes to the heart of the problem and it's going to be with us for some time we think americans need better tools for identity management and by that i mean we need better ways for people to interact with government for people to interact with businesses without being required to disclose so much personal information or to give up a number that links together all their personal information that's the essential problem with the social security number it links together too much data we think new subcommittee i appreciate the opportunity to appear before you to discuss serious crime identity the impact it has on its victims and what can be learned from chronological research in this area the research center i direct center for identity management and information protection you the college in central new york as a research collaborative dedicated to the prevention and containment of identity theft while the term identity thefts familiar to many questions still remain regarding what the term really represents what type of person is most likely to commit this offense what criminal methods are most commonly used thank you and who is in most jeopardy to be victimized as a criminologist i believe that answering these questions brings us many steps closer to help to lower the incidence of this insidious crime protect the interest of those youth who fall victim to it now my center undertook a challenging research endeavor with over five hundred u s secret service identity theft cases and we studied it for a period of it's covered over a period of six years when the results were released they were met with an interesting mix of curiosity and surprise contrary to some earlier victim surveys this study found that many victims did not know their offenders the median loss for a case was found to be over thirty thousand dollars much more than the average estimates drawn from victim services a full one third of the offenders were found to have committed their crimes at their place of employment spotlighting a special problems of unscrupulous insiders who would use personal information for criminal purposes individuals were not the only victims the financial services industry was victimized in thirty seven percent of the cases in twenty one percent of the cases the victims were retail businesses the financial services industry was most frequently victimized by offenders using  identifying information to obtain new credit card accounts to apply for entertain fraudulent loans past checks and to transfer funds the retail industry was victimized by the use of stolen identity information to open store  by purchasing merchandise with fraudulent credit cards as a criminologist the study's findings impressed upon you stark realities of identity theft in our modern society many of the crimes were carried carried out easily and it really didn't take in many cases us analyzing that because some of the offenders in case notes indicated and bragged about how easy it was a common characteristics of this of these offenses is that these criminals are criminal opportuni they look for the path of least resistance and they find it and there are many compromise points in our system that they can use to commit these offenses in the final analysis the identity theft would take the path of least resistance toward the ultimate goal of using someone's identity to commit fraud and someone else's name but there are a series of vulnerabilities system vulnerabilities that we can address to try to cut off the blood flow to these offenders for instance merchant recognition of counterfeit carts time and again the actual cases indicated a failure of merchants to detect that credit cards were not authentic bank oversight of new account creation the failure of bank personnel to recognize false identification information oversight of employer access to customer client information another failure of the employer to effectively monitor employee use of customer client personal information credit card issuers oversight of adding users to existing accounts a failure of issuers to effectively verify authenticity and victim approval of requests to add offenders offenders to existing accounts as credit card users government recognition of altered forms another failure a failure of government agencies to detect false documentation leading to fraudulent misuse of documents in victims names and finally the oversight of employee access to client customer credit cards ski another failure of employers to effectively monitor employee use of credit cards in the course of legitimate credit card transactions now just to summarize in terms of what we can do with this information to help of victims i have the stilled my recommendations in my testimony the three optimized protections optimized authentication protection optimize protection of personal information and optimize protection by law and law enforcement authentication protection we need to have the best tools possible and standardize them to make sure we can authenticate who these people are whether they are actually the people they say they are or criminal offenders optimize protection of personal information we're talking about all the different agencies private sector and public sector that have access to personal information and how is it it's their responsibility to protect that information and finally optimize protection by law enforcement half of the cases that we looked at that were secret service cases started at the local level with local police officers these were people who were officers who did the right thing the understood what identity theft is and they react other research unfortunately has shown that's not always the case what we need to do is address these authentication optimize protections to try to close the gap tell you about the identity theft assistance center six years ago executives of the largest financial services companies in the country got together and realized that while they were doing a great job helping their customers to find all of the places where the fraud has occurred tell their story again and again and it's a very time consuming and frustrating process this kind of fragmentation also occurs in law enforcement identity crime frequently involves many customers with small dollar losses across jurisdictional lines and this kind of really makes it difficult to investigate and prosecute crimes so in two thousand and three under the leadership of the financial services roundtable and bits of the largest financial services companies came together to form a nonprofit organization committed to helping cover from identity theft partnering with law enforcement to c onvict the criminals and to consumer education since two thousand and four more than fifty five thousand consumers recover from identity theft the services to the consumer and it's paid for by the financial services company very briefly here's how the service works it starts at a member company who helps the victim resolve any of the problems at that company the company then directly transfers the people need that help most of all one quick example one of the people we helped was a seventy one year old man from california he was a tax payer who out of the generous kindness of his heart and apartment in his home to a woman and her daughters treated her like a daughter computer stole his financial information he didn't find out about it until he got a bill in the mail for a credit card that he had never applied for when big problem because a lot of cases the predator or the person offering the opening the credit account does not know the age of the person number because of numbers associated by date of issue not birthday so there's an issue there way to create a larger database it makes it more attractive and the thieves are going to be interested in it because they don't have insurance and want to have insurance to cover some procedure in a hospital it may be that they want to get access to and the technology that will help limit the access to that data that will make sure that those that have that are enablers should be have access to it can have access to it but it's person's medical record has been stolen so that they can get back to it to correct it when the imposter in accordance with now has a right to that medical record that the i responsibility to ensure that it's accurate i don't think they get to say to the actual patient we're terribly sorry there's been some confusion here we're going to have to sort it out it's actually the organization that has the record that has to sort  so i think what you'll need to do is put some new incentives on those organizations that have the record to say listen there's a problem here and you're the ones who are best able to fix any thoughts on  law specifically in the area because one of the things that we've observed over the last several years is that the state legislatures which are close to this problem are coming up with new solutions to try to cover new problems with federal and my feeling is that actually the term identity theft has become sanitized to the point where we're except being it is sort of a part of life well i think we have to change we think we have  to to change our perspective as a system the criminal justice system especially we wouldn't if there was a victim of domestic violence for instance as a society we make sure that that person who's been victimized gets all of the possible help that they can to recover right now we're not doing we're not doing that with identity theft victims i'm not saying that the two crimes on the same level as occurs and any other damage to the financial i'd say the financial harm can be very serious it could also lead to psychological harm and emotional harm and that's something that i think the criminal justice research has not really tracked very effectively what's the long lasting harm that it brings to people who are victimized by this while as identity that systems corporation has unique data sharing agreements with several government agencies and private industries that are used in this mission in the investigation and prosecution of identity crisis can you share this unique resources that are provided by some of the organizations represented on this panel will help consumers but i do mr chairman believe very strongly that in this area there's only so much that consumers can do i really think we need to get to the root of some of these problems about computer security use of the social security number that will have to happen in congress i think that we have to track the problem from several different areas at once and  in terms of education of the average citizen to prevent victimisation we've got to understand we can't forget that cyber security is very important many more people  are on the internet now and ever before but we can't overlook the fact that many of these cases are low tech cases as well people can be victimized from not trading personal material they can be victimized because they don't have a lock box in their mailbox many of these offenders that we researched in our study used very low tech methods they didn't have to go any further the opportunities were there so in terms of educating the average citizen i think we have to educate every citizen on awareness on how to protect themselves on the internet use of computers but also not forget they have to be certain every day and as a government we need to get on top of this and stay on top of it and so i appreciate all of your testimony today and the first moment and i'm sure that this will not be the last