```

[House Hearing, 109 Congress]
[From the U.S. Government Publishing Office]

 
                     FIFTH IN A SERIES OF HEARINGS
               ON SOCIAL SECURITY NUMBER HIGH-RISK ISSUES

=======================================================================

                                HEARING

                               before the

                    SUBCOMMITTEE ON SOCIAL SECURITY

                                 of the

                      COMMITTEE ON WAYS AND MEANS
                     U.S. HOUSE OF REPRESENTATIVES

                       ONE HUNDRED NINTH CONGRESS

                             SECOND SESSION

                               __________

                             MARCH 30, 2006

                               __________

                           Serial No. 109-62

                               __________

         Printed for the use of the Committee on Ways and Means

                    U.S. GOVERNMENT PRINTING OFFICE
30-440                      WASHINGTON : 2006
_____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512�091800  
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�090001

                      COMMITTEE ON WAYS AND MEANS

                   BILL THOMAS, California, Chairman

E. CLAY SHAW, JR., Florida           CHARLES B. RANGEL, New York
NANCY L. JOHNSON, Connecticut        FORTNEY PETE STARK, California
WALLY HERGER, California             SANDER M. LEVIN, Michigan
JIM MCCRERY, Louisiana               BENJAMIN L. CARDIN, Maryland
DAVE CAMP, Michigan                  JIM MCDERMOTT, Washington
JIM RAMSTAD, Minnesota               JOHN LEWIS, Georgia
JIM NUSSLE, Iowa                     RICHARD E. NEAL, Massachusetts
SAM JOHNSON, Texas                   MICHAEL R. MCNULTY, New York
PHIL ENGLISH, Pennsylvania           WILLIAM J. JEFFERSON, Louisiana
J.D. HAYWORTH, Arizona               JOHN S. TANNER, Tennessee
JERRY WELLER, Illinois               XAVIER BECERRA, California
KENNY C. HULSHOF, Missouri           LLOYD DOGGETT, Texas
RON LEWIS, Kentucky                  EARL POMEROY, North Dakota
MARK FOLEY, Florida                  STEPHANIE TUBBS JONES, Ohio
KEVIN BRADY, Texas                   MIKE THOMPSON, California
THOMAS M. REYNOLDS, New York         JOHN B. LARSON, Connecticut
PAUL RYAN, Wisconsin                 RAHM EMANUEL, Illinois
ERIC CANTOR, Virginia
JOHN LINDER, Georgia
BOB BEAUPREZ, Colorado
MELISSA A. HART, Pennsylvania
CHRIS CHOCOLA, Indiana
DEVIN NUNES, California

                    Allison H. Giles, Chief of Staff

                  Janice Mays, Minority Chief Counsel

                                 ______

                    SUBCOMMITTEE ON SOCIAL SECURITY

                    JIM MCCRERY, Louisiana, Chairman

E. CLAY SHAW JR., Florida            SANDER M. LEVIN, Michigan
SAM JOHNSON, Texas                   EARL POMEROY, North Dakota
J.D. HAYWORTH, Arizona               XAVIER BECERRA, California
KENNY C. HULSHOF, Missouri           STEPHANIE TUBBS JONES, Ohio
RON LEWIS, Kentucky                  RICHARD E. NEAL, Massachusetts
KEVIN BRADY, Texas
PAUL RYAN, Wisconsin

Pursuant to clause 2(e)(4) of Rule XI of the Rules of the House, public 
hearing records of the Committee on Ways and Means are also published 
in electronic form. The printed hearing record remains the official 
version. Because electronic submissions are used to prepare both 
printed and electronic versions of the hearing record, the process of 
converting between various electronic formats may introduce 
unintentional errors or omissions. Such occurrences are inherent in the 
current publication process and should diminish as the process is 
further refined.

                            C O N T E N T S

                               __________

                                                                   Page

Advisory of March 23, 2006 announcing the hearing................     2

                               WITNESSES

The Honorable David Dreier, a Representative in Congress from the 
  State of California............................................     5
The Honorable Silvestre Reyes, a Representative in Congress from 
  the State of Texas.............................................     9

                                 ______

Federal Trade Commission, Joel Winston, Associate Director, 
  Division of Privacy and Identity Protection, Bureau of Consumer 
  Protection.....................................................    28
U.S. Government Accountability Office, Cynthia M. Fagnoni, 
  Managing Director, Education, Workforce, and Income Security...    17

                                 ______

BITS Fraud Reduction Steering Committee, Erik Stein..............    60
Consumer Data Industry Association, Stuart K. Pratt..............    68
Council of State Court Administrators, Mary C. McQueen...........    47
Identity Theft Resource Center, Nicole Robinson..................    42
National Council of Investigation and Security Services, Bruce 
  Hulme..........................................................    76

                       SUBMISSIONS FOR THE RECORD

Kenney, John P., Corona Del Mar, CA, letter......................    89
Sybesma, Jamie, Fishers, IN, statement...........................    89

                    FIFTH IN A SERIES OF HEARINGS ON
                SOCIAL SECURITY NUMBER HIGH-RISK ISSUES

                              ----------                              

                        THURSDAY, MARCH 30, 2006

             U.S. House of Representatives,
                       Committee on Ways and Means,
                           Subcommittee on Social Security,
                                                    Washington, DC.

    The Subcommittee met, pursuant to notice, at 2:40 p.m., in 
room B-318, Rayburn House Office Building, Hon. Jim McCrery 
(Chairman of the Subcommittee) presiding.
    [The advisory announcing the hearing follows:]

ADVISORY FROM THE COMMITTEE ON WAYS AND MEANS

                    SUBCOMMITTEE ON SOCIAL SECURITY

                                                CONTACT: (202) 225-9263
FOR IMMEDIATE RELEASE
March 23, 2006
No. SS-14

                       McCrery Announces Fifth in

                   Series of Subcommittee Hearings on

                Social Security Number High-Risk Issues

    Congressman Jim McCrery, (R-LA), Chairman, Subcommittee on Social 
Security of the Committee on Ways and Means, today announced that the 
Subcommittee will hold the fifth in a series of Subcommittee hearings 
on Social Security number (SSN) high-risk issues. The hearing will 
examine the role of SSNs in identity theft and options to enhance SSN 
privacy. The hearing will take place on Thursday, March 30, 2006, in 
room B-318 Rayburn House Office Building, beginning at 2:00 p.m.
      
    In view of the limited time available to hear witnesses, oral 
testimony at this hearing will be from invited witnesses only. However, 
any individual or organization not scheduled for an oral appearance may 
submit a written statement for consideration by the Subcommittee and 
for inclusion in the printed record of the hearing.
      

BACKGROUND:

      
    Identity theft is a serious crime in which a victim's personal 
information may be used to fraudulently obtain credit, goods or 
services, employment, government documents or benefits, or to commit 
other crimes. According to a 2006 survey released by the Council of 
Better Business Bureaus and Javelin Strategy & Research, there are 
almost 9 million adult victims of identity fraud (about 4 percent of 
the U.S. adult population). These victims may spend significant amounts 
of money and time to resolve their problems: on average $422 and 40 
hours per victim. Total identity theft costs exceed $50 billion 
annually.
      
    Although SSNs have many important legitimate uses, the Federal 
Trade Commission (FTC) indicates that they also play a pivotal role in 
identity theft. According to the FTC, the SSN is integral to many 
business transactions, and identity thieves use the SSN as a key to 
unlock access to the financial benefits of their victims. Despite its 
vital role in our financial system, there is no Federal law that 
requires comprehensive confidentiality protection for the SSN. An SSN 
may be on display to the general public on employee badges, in court 
documents, or on the Internet. However, there are laws that provide 
limited SSN confidentiality. For example, the Gramm-Leach-Bliley Act 
(P.L. 106-102) restricts the reuse and redisclosure of certain personal 
information, including SSNs, by financial institutions. Also, many 
States have enacted legislation to restrict the use, disclosure, or 
display of SSNs.
      
    Members of Congress, concerned about the magnitude of the problem 
and its devastating effects on victims, have introduced legislation 
that would place various restrictions and prohibitions on the use, 
sale, purchase, or display of SSNs, as well as create new criminal and 
civil penalties for those who misuse SSNs. Also, legislation has been 
introduced that would require improvements to the process of issuing 
SSNs or the design of the SSN card to prevent individuals from 
fraudulently obtaining an SSN or counterfeiting SSN cards.
      
    In announcing the hearing, Chairman McCrery stated, ``We must 
carefully examine all options to keep Social Security numbers, or SSNs, 
out of the hands of identity thieves. As we do so, we must remember 
that SSNs play a key role in our society, whether in business 
transactions, tax administration, public benefits, or the court 
systems. Through this hearing we will explore how best to achieve the 
appropriate balance between the need for protecting SSN privacy and 
allowing their use for legitimate and necessary purposes.''
      

FOCUS OF THE HEARING:

      
    The Subcommittee will examine the role of SSNs in abetting identity 
theft, and the effects of proposals to prohibit or restrict the use, 
sale, purchase, or display of SSNs by individuals, businesses, or the 
government.
      

DETAILS FOR SUBMISSION OF WRITTEN COMMENTS:

      
    Please Note: Any person(s) and/or organization(s) wishing to submit 
for the hearing record must follow the appropriate link on the hearing 
page of the Committee website and complete the informational forms. 
From the Committee homepage, http://waysandmeans.house.gov, select 
``109th Congress'' from the menu entitled, ``Hearing Archives'' (http:/
/waysandmeans.house.gov/Hearings.asp?congress=17). Select the hearing 
for which you would like to submit, and click on the link entitled, 
``Click here to provide a submission for the record.'' Once you have 
followed the online instructions, completing all informational forms 
and clicking ``submit'' on the final page, an email will be sent to the 
address which you supply confirming your interest in providing a 
submission for the record. You MUST REPLY to the email and ATTACH your 
submission as a Word or WordPerfect document, in compliance with the 
formatting requirements listed below, by close of business Thursday, 
April 13, 2006. Finally, please note that due to the change in House 
mail policy, the U.S. Capitol Police will refuse sealed-package 
deliveries to all House Office Buildings. For questions, or if you 
encounter technical problems, please call (202) 225-1721.
      

FORMATTING REQUIREMENTS:

      
    The Committee relies on electronic submissions for printing the 
official hearing record. As always, submissions will be included in the 
record according to the discretion of the Committee. The Committee will 
not alter the content of your submission, but we reserve the right to 
format it according to our guidelines. Any submission provided to the 
Committee by a witness, any supplementary materials submitted for the 
printed record, and any written comments in response to a request for 
written comments must conform to the guidelines listed below. Any 
submission or supplementary item not in compliance with these 
guidelines will not be printed, but will be maintained in the Committee 
files for review and use by the Committee.
      
    1. All submissions and supplementary materials must be provided in 
Word or WordPerfect format and MUST NOT exceed a total of 10 pages, 
including attachments. Witnesses and submitters are advised that the 
Committee relies on electronic submissions for printing the official 
hearing record.
      
    2. Copies of whole documents submitted as exhibit material will not 
be accepted for printing. Instead, exhibit material should be 
referenced and quoted or paraphrased. All exhibit material not meeting 
these specifications will be maintained in the Committee files for 
review and use by the Committee.
      
    3. All submissions must include a list of all clients, persons, 
and/or organizations on whose behalf the witness appears. A 
supplemental sheet must accompany each submission listing the name, 
company, address, telephone and fax numbers of each witness.
      
    Note: All Committee advisories and news releases are available on 
the World Wide Web at http://waysandmeans.house.gov.
      
    The Committee seeks to make its facilities accessible to persons 
with disabilities. If you are in need of special accommodations, please 
call 202-225-1721 or 202-226-3411 TTD/TTY in advance of the event (four 
business days notice is requested). Questions with regard to special 
accommodation needs in general (including availability of Committee 
materials in alternative formats) may be directed to the Committee as 
noted above.

                                 

    Chairman MCCRERY. The Subcommittee hearing will come to 
order. Good afternoon, everybody. Welcome to our fifth in a 
series of hearings on high-risk issues related to Social 
Security numbers (SSNs). Today, we will examine the use of SSNs 
by government agencies, businesses, and others, as well as 
explore options for improving the confidentiality of SSNs.
    For many years, this Subcommittee has worked to protect SSN 
privacy. For example, the Committee on Ways and Means approved 
bills in the 108th and 106th Congresses that were introduced by 
my predecessor, Subcommittee Chairman Clay Shaw. Some of the 
provisions from Mr. Shaw's bill in the 108th Congress have 
become law, including limits on replacement SSN cards and a 
prohibition on the display of SSNs on drivers' licenses.
    The SSN plays a key role in both our government and in our 
economy. Since the SSN is a unique number for each person and 
is widely used, it helps link records at all levels. This, in 
turn, facilitates administration of government services and 
benefits, business transactions, and fraud prevention. However, 
once this essential piece of information is in the hands of 
identity thieves, it opens a Pandora's box of problems. Stolen 
SSNs can damage lives and businesses' bottom lines.
    Today, we will hear about the current patchwork of Federal 
and State laws that provide limited and inconsistent 
confidentiality protection for SSNs. For example, financial 
institutions are restricted in their ability to release SSN 
information, but SSNs may appear in any number of publicly 
available government records, such as court records or property 
ownership records.
    Computers and the Internet have enabled unprecedented 
information sharing, and anyone who collects, uses, or shares 
SSN information has a responsibility to protect its 
confidentiality. Today, we will hear about some of the 
voluntary steps that government agencies, businesses, and 
others are taking to protect SSNs from unauthorized disclosure. 
We also will have the opportunity to explore options for 
improving SSN protections.
    These options involve complicated trade-offs. In some 
cases, Federal laws and regulations require the collection of 
SSNs to achieve certain goals, such as efficient and accurate 
tax administration, child support enforcement, and 
identification of money launderers and terrorists. As we 
examine alternatives for improving SSN privacy to help prevent 
identity theft, we must consider the potential effect on the 
attainment of those goals. We must also be mindful of the costs 
that individuals, businesses, and government agencies may incur 
as a result.
    By carefully examining all options to keep SSNs out of the 
hands of identity thieves and by listening to as many 
stakeholders as possible, we seek a balance between protecting 
SSN privacy and allowing its use for legitimate and necessary 
purposes. Mr. Levin?
    Mr. LEVIN. Mr. Chairman, since I basically agree with your 
opening statement and since both of our colleagues here, I 
would simply ask that my opening statement be placed in the 
record.
    Chairman MCCRERY. Without objection. Thank you, Mr. Levin.
    [The prepared statement of Mr. Levin follows:]

Opening Statement of The Honorable Sander M. Levin, a Representative in 
                  Congress from the State of Michigan

    The problem of identity theft is serious and growing, claiming 
almost 9 million victims and costing our economy an estimated $50 
billion a year. The issue within our Committee's jurisdiction--
protecting the Social Security Number--is just one piece of a total 
strategy to address identity theft, but it is an important one. 
Government agencies and the private sector must both do their part to 
prevent and detect identity theft.
    When it comes to the Social Security number, the critical issue is 
striking the right balance between allowing beneficial uses of the 
number and protecting privacy for individuals. The rapid advance in 
technology in recent years has greatly aggravated the problem of 
identity theft. Identity thieves no longer have to rifle through 
people's trash in search of private information. They increasingly 
obtain this information by tapping into computer databases and other 
high-tech means.
    Given the evolving nature of the problem, there is a clear need for 
ongoing oversight. I look forward to hearing more about the issues and 
options from our witnesses.
    In the past, our Subcommittee has been able to work to find this 
balance in a genuinely bipartisan way, with Republicans and Democrats 
sitting across the table and coming to agreement on the issues. I hope 
we will be able to continue in that tradition, and work closely 
together to act on the information we receive today.

                                 

    Chairman MCCRERY. Our first panel today is composed of two 
distinguished colleagues, Mr. Dreier and Mr. Reyes, each of 
whom have expressed an interest in the issues that this 
Subcommittee has been exploring for some time now. They were 
supposed to be here last time, but we had a series of votes, 
and in an effort to not prolong the necessity for other 
witnesses to stay, we asked these two colleagues if they could 
come today, and they graciously agreed to do that.
    Welcome, gentlemen. We are interested in your views on this 
subject. We would like for you to try to summarize those views 
in about 5 minutes, and we will start with my colleague from 
California, Mr. Dreier.

 STATEMENT OF DAVID DREIER, A REPRESENTATIVE IN CONGRESS FROM 
                    THE STATE OF CALIFORNIA

    Mr. DREIER. Thank you very much, Mr. Chairman. Let me begin 
by expressing my appreciation to you for the hard work that you 
do in dealing with this issue of Social Security and the 
specific issue you are tackling right now, and to Mr. Levin and 
Mr. Johnson and Mr. Brady, I thank all of you for being here. I 
know we have completed our votes on the floor, but this is a 
very important issue.
    Mr. Reyes and I have come together in a bipartisan way to 
deal with an issue that is getting a great deal of attention. 
The issue is immigration reform and border security. I don't 
know if any of you all recall that we dealt with that back in 
December and our colleagues in the other body are tackling that 
question right now, as to how they move ahead this week and 
next on this issue.
    Virtually everything that we do focuses on the supply side 
of the immigration problem. On border security, what is it that 
we did? Well, we talked about building a 700-mile wall. We 
talked about dramatically increasing the size of the Border 
Patrol, a lot of things that are designed to stem the flow of 
people coming into this country illegally.
    What is it that we really haven't done? We haven't spent 
much time and effort looking at why it is that they come to the 
United States of America. That is why Mr. Reyes and I, with the 
encouragement of T.J. Bonner, who is the President of the 
National Border Patrol Council, which is the union of Border 
Patrol agents, said, let us not just look at the supply side. 
Let us focus on the demand side here.
    Why is it that people come into this country illegally? 
They come here, 98 percent of them, for one reason and one 
reason only. They come here looking for a job. They are looking 
to feed their families. They are looking for economic 
opportunity. We all know that. Of the 12 million people who are 
in this country illegally, we know that nearly all of them are 
here as productive members of society, working, paying taxes, 
doing things that need to be done in this country.
    We know that they are here illegally and there is a strong 
sense that we need to take action. We need to take action to 
deal with it.
    Right now, there are 94 different combinations of 
documents, including that flimsy little Social Security card 
that was first put into place in 1935, that has not been 
updated once since 1935, that are used for a potential employee 
to go to a potential employer and get a job--94 different 
combinations of documents, including a school ID card, a 
library card. What Mr. Reyes and I have come together to do is 
very simply to say, why don't we make an attempt to put into 
place a smart, counterfeit-proof Social Security card with an 
algorithm strip on the back of it, an algorithm strip which 
would simply go in and look at the data that is already there. 
No new data--the government would not get its hands on any new 
data at all.
    This counterfeit-proof card--actually, I carry a 
counterfeit example of my counterfeit-proof card, this is an 
old Union 76 credit card and I have just put the Social 
Security on the top of the card. I used T.J. Bonner's picture, 
since this was his idea, and his photo is here, and you would 
have an algorithm strip on the back.
    Someone is going in, Mr. Chairman, to look for a job. The 
potential employer decides, I might want to hire this person. 
They either swipe this card or call an 800 number. They dial 
the 800 number and it goes into a databank which is simply 
taking the SSN, linking it with the U.S. Department of Homeland 
Security (DHS), and the only information that would go out is 
yea or nay. Is this person a qualified worker or not a 
qualified worker?
    We put on the bottom of this that this is not a national ID 
card. I know that from testimony you all have had in the past, 
from your last hearing, I understood that real concern is 
raised about if it looks like a duck, walks like a duck, acts 
like a duck, talks like a duck, it may be a duck. The fact is, 
this is not a national ID card. Why? The only utilization of 
this card will be for, number one, Social Security purposes, 
which are correct, and number two, applying for a new job.
    Now, as I look around this room, I feel pretty sanguine 
that everybody here, including Xavier Becerra, will be 
reelected as they head toward this November election.
    Mr. BECERRA. Is that an endorsement?
    Mr. DREIER. You don't want my endorsement, Xavier.
    [Laughter.]
    That might jeopardize it, if you had my endorsement. The 
fact is, only people looking, Mr. Chairman, for a new job would 
be required to carry this. A senior citizen would never have to 
have a counterfeit-proof Social Security card. Someone who is a 
small business man or woman would never have to have a 
counterfeit-proof Social Security card.
    What we have got is we have got a situation where the 
magnet that draws people across the border is jobs, and if the 
thumbs-down comes from this card from the databank that is 
already there, we in our legislation increase the penalty 
dramatically and we increase enforcement dramatically. By 400 
percent, we increase the penalty, from $10,000 to $50,000 for 
hiring, and we have a 5 year prison term, and we also increase 
by 10,000 the number of enforcement agents.
    Now, you and I were talking yesterday about this and I know 
that everyone in this room pays their taxes simply because they 
are patriotic Americans, but there may be some people out there 
who realize that the Internal Revenue Service (IRS) is there 
and that may be the reason that as April 15 approaches, they 
will be paying their taxes. I know none of us are among those.
    Similarly, if we were to see four or five high-profile 
arrests due to people who were knowingly hiring those who are 
here illegally, I am convinced that we would see a great 
diminution of the number of hirings taking place. I am 
convinced that we have, if not the panacea, we have the ability 
to look at what deals with 98 percent of the people who come 
here illegally to help us address this issue.
    Mr. Chairman, I think we have got a great opportunity to do 
something here and I am pleased that Members of the Hispanic 
Caucus have joined. Again, it is a very, very bipartisan 
measure. It is my hope that as we look at the issue of 
immigration reform, we will be able to recognize that this is 
better for the employer, easier for the businessman or woman 
who is looking to hire someone, because they don't have to look 
at 94 different combinations of documents and they are free of 
responsibility once they have gotten a yea or nay on it. It is 
going to help us deal with this very serious problem that we 
have of illegal immigration and finally see the Social Security 
Administration (SSA) bring that flimsy little paper to which I 
was referring into the 21st century.
    Thank you very much.
    Chairman MCCRERY. Thank you, Mr. Dreier.
    [The prepared statement of Mr. Dreier follows:]

 Statement of The Honorable David Dreier, a Representative in Congress 
                      from the State of California

    Chairman McCrery, Ranking Member Levin, Members of the 
Subcommittee, thank you for providing this opportunity to appear before 
the Subcommittee's hearing on Social Security high risk issues. 
Specifically, I would like to discuss the merits of legislation I 
authored with my friend from El Paso, Mr. Reyes, H.R. 98, the Illegal 
Immigration Enforcement and Social Security Protection Act, and how it 
would help to crack down on the hiring of illegal immigrants and curb 
abuse of the Social Security number and card. I have submitted 
testimony for the record to two of your previous hearings on this 
matter, so I'll keep my statement somewhat brief. I want to have ample 
time to answer your questions.
    As I mentioned in previous written testimony, there are 94 
different combinations of documents on the current I-9 form that can be 
used to establish identity and employment eligibility. The Social 
Security card is one such document. Because the process by which job 
seekers prove their employment eligibility is so unwieldy and 
complicated, it plays right into the hands of illegal immigrants who 
can obtain or copy Social Security numbers and cards. In fact, easy 
employment powers the job-magnet that draws people to illegally enter 
our country. That is why Mr. Reyes and I authored H.R. 98. We need to 
address the ``demand-side'' of the illegal immigration issue.
    H.R. 98 makes the Social Security card fraud-proof and provides 
employers with a tamper-free tool to verify work authorization status. 
This will come as a great relief to employers who have been forced to 
act as immigration and document experts. Under the bill, the Social 
Security Administration (SSA) is required to issue cards that contain a 
digitized photo of the cardholder, as well as other countermeasures to 
reduce fraud. This includes replacing the flimsy Social Security 
banknote paper with a durable plastic or similar material. Also, each 
card will contain physical security features designed to prevent 
tampering, counterfeiting or duplication.
    In addition, this card will have an electronic signature strip that 
contains an encrypted electronic identification code unique to that 
individual. Employers could verify worker eligibility via a Department 
of Homeland Security (DHS) database by swiping the card through an 
electronic card-reader or simply calling a toll-free number. The 
employer would know instantaneously whether or not they were permitted 
to hire the individual in question. As my colleagues on the 
Subcommittee know, the House-approved border control bill directs SSA 
to study the implementation and feasibility of such a proposal.
    I understand that privacy concerns have been raised regarding H.R. 
98; that the bill would create a national ID card. Let me just say 
unequivocally that H.R. 98 does not create a national ID card. In fact, 
section 11 of the bill unconditionally prohibits the use of the Social 
Security card as a national ID card. Let us not forget that job 
applicants, under current law, are already required to show documents 
that establish their identity and employment eligibility. Many, if not 
most, choose to show their employer the combination of a photo ID and 
their Social Security card. Eliminating a step by actually placing the 
photo on the Social Security card itself doesn't take us any further 
down the road of creating a national ID card.
    The only time anyone would actually be required to carry the 
improved Social Security card would either be for Social Security 
purposes or when they are applying for a new job. H.R. 98 explicitly 
states that individuals cannot be required to carry the new card, 
except for these two purposes. And the card itself will contain a 
disclaimer stating: ``This card not to be used for the purpose of 
identification.'' Social Security cards had a similar disclaimer from 
1946 to 1972.
    I also understand that concerns have been raised regarding the 
privacy and security of the employment eligibility database created 
under H.R. 98. Let me just say that no one is more sensitive to 
concerns about privacy and data security than I am. But let's remember, 
I wouldn't be sitting here in front of you today if we were already 
doing a great job of securing our Social Security and immigration 
systems. Nonetheless, we have taken great care to ensure the integrity 
of the Employment Eligibility Database which H.R. 98 creates. 
Specifically, the bill prohibits the use of any information in the 
database by any DHS employee for any purpose other than administering 
the database, and it requires DHS to limit access to the database to 
only those employees who administer the database.
    We also need to keep in mind that the government already has the 
information that would be contained on this new Social Security card. 
An individual's eligibility to work under the law is dependent on 
whether they are a U.S. citizen, and if not, their immigration status. 
SSA already maintains citizenship and immigration status files for each 
worker issued a Social Security card, and our legislation would not 
require them to gather any additional information than they do 
currently.
    The only thing H.R. 98 does is allow the information that SSA 
already collects to be used for the purpose of verifying a prospective 
employee's eligibility to work--via the DHS database--and the 
authenticity of their Social Security card. This streamlines two 
separate pre-existing government functions: determining a person's 
eligibility to work and ensuring that employers do not hire anyone 
ineligible to work.
    Mr. Chairman, in recent years, we have improved the security of 
almost every government-issued document, passports, green cards, 
driver's licenses, save one--the Social Security card. With over five 
million cards issued annually, we need to realize that it's time to 
bring the Social Security card into the 21st Century. In the process, 
we will end the magnet of jobs for illegal immigrants.
    I believe that H.R. 98 represents an excellent starting point to 
secure the Social Security card and enhance our efforts to stop the 
hiring of illegal immigrants. I look forward to working with the 
Members of the Subcommittee to reach these important goals.

                                 

    Chairman MCCRERY. Now, our colleague from Texas, Mr. Reyes.

STATEMENT OF SILVESTRE REYES, A REPRESENTATIVE IN CONGRESS FROM 
                       THE STATE OF TEXAS

    Mr. REYES. Thank you, Mr. Chairman, Mr. Levin, fellow 
colleagues. I am pleased to be here with my good friend and 
colleague from California, and I just want to make three 
points, but before I make those points, I want to tell you that 
in 1986, when the Immigration Control and Reform Act (P.L. 99-
603) (IRCA) was passed, it had a provision for employer 
sanctions in there. Had Congress provided the resources to INS, 
Border Patrol back then, we wouldn't be having the debates that 
we are having today.
    Fast forward to 2006 and the three points that I want to 
make are that, as my colleague stated, the technology has 
gotten to the point where we feel very confident that a Social 
Security card with biometrics and algorithm and all the other 
things that have been mentioned were included, it would be safe 
to say--I always hesitate from the law enforcement background 
that something is counterfeit-proof, but it would be very hard 
to replicate with the kind of technology that is available 
today. You need that card that would, in essence, relieve any 
employer from the responsibility of having to look at and file 
as many as nine and ten documents, as the I-9 provision 
currently requires, with the fraud-proof Social Security card.
    The second point I want to make is that along with that 
card, you need a system, a system where an employer, once he is 
presented with that card, can check and verify whether it is 
the individual. If there is a question, they can ask somebody 
to come out and check it out or maybe check it out through the 
computer. Those systems exist today. They are not cheap, but I 
would say they are a lot cheaper than all of these other 
proposals that have been--and not as controversial as the ones 
that have been proposed in the bill that we passed in December, 
the wall, taking citizenship, all these things that are very 
contentious.
    The third point I want to make is that adequate resources 
must be provided along with it. No system is good if you don't 
provide the resources for checks. You have got to provide the 
money. You have got to provide the people. Our bill does that.
    Those are the three basic points I wanted to make. I have a 
statement that I would like to include into the record, but 
now, being respectful of your time, I will yield back the 
balance of my time, subject to any questions you might have for 
me or for my colleague.
    Chairman MCCRERY. Thank you, Mr. Reyes.
    [The prepared statement of Mr. Reyes follows:]

    Statement of The Honorable Silvestre Reyes, a Representative in 
                    Congress from the State of Texas

    Good afternoon. I would like to thank Chairman Jim McCrery and 
Ranking Member Sander Levin for giving me the opportunity to testify 
before this Subcommittee today about the role a new, improved Social 
Security card could play in allowing employers to determine whether 
prospective employees are authorized to work in the United States and, 
ultimately, in helping to curb illegal immigration.
    I believe I come to this hearing with a somewhat unique perspective 
on this important issue. My district of El Paso, Texas--along with its 
sister city, Ciudad Jurez, Mexico--comprise the largest metropolitan 
area on the United States-Mexico border. Also, prior to coming to 
Congress, I was in the United States Border Patrol for 26\1/2\ years. I 
served as Chief, first in the McAllen sector and subsequently in the El 
Paso sector from 1984 until my retirement in 1995. I have also done my 
share of interior immigration enforcement at work sites where 
undocumented aliens were employed.
    As the only Member of Congress with a background in immigration and 
experience defending our nation's borders, I have firsthand knowledge 
of what we need to do to reduce illegal immigration and help keep 
America safe. I have witnessed the difference that strong enforcement 
of employment laws can make in discouraging attempted illegal entries 
into the United States. Furthermore, I believe that a fraud-proof 
Social Security card, coupled with a computerized employment 
eligibility verification system and properly enforced employer 
sanctions, could be a critical part of that effort.
    In 1986, Congress passed the Immigration Reform and Control Act, 
which included new sanctions against employers who hire illegal 
immigrants. After that law was enacted, in parts of the country such as 
the border region where those of us in law enforcement had the 
resources to enforce those sanctions, we saw a significant decrease in 
the number of people trying to enter the country unlawfully. Clearly, 
once word got out that employers would not hire illegal immigrants, a 
major incentive to enter the United States was greatly reduced and 
attempted entries dropped off considerably.
    I have been pleased to work with my friend and colleague from 
California, Rep. David Dreier, on H.R. 98, the Illegal Immigration 
Enforcement and Social Security Protection Act of 2005. The bill would 
substantially expand and improve on the 1986 provisions by enhancing 
the security of Social Security cards and allowing employers to 
instantaneously verify a prospective employee's eligibility to work in 
the United States. The bill would also increase civil and criminal 
penalties for employers who hire illegal immigrants or fail to verify 
their employment eligibility.
    If properly funded and with appropriate oversight and privacy 
protections, H.R. 98 would be an important step toward halting the flow 
of people seeking to enter the United States illegally in order to find 
employment. By doing so, our immigration and border security personnel 
will be able to focus more of their time, effort, and resources on 
those who may be trying to enter the country to do us harm.
    As you continue to hold hearings on important Social Security 
matters, I encourage this Subcommittee to consider how a next-
generation Social Security card and employment eligibility system could 
help address some of the urgent immigration matters we face in this 
country.
    Again, thank you for allowing me to testify today, and I look 
forward to continuing to work with my colleagues on this important 
issue.

                                 

    Chairman MCCRERY. Both of your statements will be included 
in the record. Your written statements will be included in the 
record in their entirety.
    Mr. Dreier, you said the employer would either swipe the 
card or call an 800 number. Explain that. What 800 number would 
they call?
    Mr. DREIER. Basically, what that would mean is that there 
would be a databank, the information, again, that the 
government already has, known information. Is someone an 
American citizen? Are they here on an H-2A visa, which is 
basically a farmworker visa, some other kind of work permit? 
They would simply be told yes or no. This person who is 
applying for a job to work in your company is, in fact, a 
qualified worker, and----
    Chairman MCCRERY. If you are an employer and you call this 
800 number, what do you say?
    Mr. DREIER. What you do is you provide the information that 
is there, the SSN, and obviously the goal would be to have a 
swipe for people so that they would be able to utilize the 
algorithm strip. There would be a transition period, clearly, 
through which they would go that would--obviously, a big 
challenge----
    Mr. REYES. Mr. Chairman, if I can just add to that, if you 
don't mind----
    Chairman MCCRERY. Sure.
    Mr. REYES. What happens today when you go into a restaurant 
or you go into a shop and you pay with a credit card, they put 
it into the system. They swipe it or they insert it in the 
machine-readable system. If there is an issue or a problem that 
they think it may not be you or some other thing, then the 
merchant will call an 800 number and they will verify the 
account and all these other things.
    That is what we have in mind here. Remember, we are talking 
about employers, employers that are already used to, by and 
large, as every American is, in utilizing this kind of a 
system. It won't be exactly a system like the ATM or the credit 
card system, but it will be similar, with the card sufficing as 
proof that it is the individual, that it was presented to the 
employer, and the employer, in fact, verified it. Any other 
questions in there about that, there is an 800 number. They 
pick up the phone, they call and they talk to either a call 
center or a DHS system that would answer any questions and, 
again, would relieve the employer of the liability because they 
have gone and made a good faith effort.
    Chairman MCCRERY. I was just trying to get to the question 
of why the need for a tamper-proof card. If all you need is the 
number and you can call an 800 number, it seems to me you would 
need the card----
    Mr. DREIER. Well, I think as Mr. Reyes says, it really 
would be designed as a back-up to deal with----
    Chairman MCCRERY. With questions?
    Mr. DREIER. --because the goal is to really utilize this 
algorithm strip that is there that is----
    Chairman MCCRERY. Yes.
    Mr. DREIER. --again, and I think that Silver is right on 
target when he says that the notion of saying that something is 
100 percent absolutely counterfeit-proof is a bit of a stretch, 
but there has been no attempt since 1935 to really move the 
Social Security card itself into the modern era, and I think 
that we ought to at least engage in the fight, trying to put 
into place the most technologically advanced mechanism we 
possibly can to deal with this.
    Chairman MCCRERY. Would you put a picture on the----
    Mr. DREIER. Yes, it has a photograph on it.
    Chairman MCCRERY. It has a photograph on the card, so that 
would be----
    Mr. DREIER. When a person becomes of working age--I know 
that some people have raised this question, well, would you put 
the baby picture on, because people get their Social Security 
card. It is when in their State they would become of working 
age that the photo-embedded item would be provided on there.
    Chairman MCCRERY. Okay. Mr. Levin?
    Mr. LEVIN. I am tempted to ask a question, but I think it 
involves larger issues. For example, what would happen to the 
people of working age, the 12 million who are here now 
illegally?
    Mr. DREIER. Well, I am happy to answer that question. I 
think that part of the goal here is that since we are focusing 
on this question, if 98 percent of the people who come here 
illegally are coming to get a job, and with a tamper-proof, 
smart, counterfeit-proof, whatever you want to call it, Social 
Security card, they can't get a job, my sense is that many of 
them might choose to return to a country of origin. I am not 
saying that absolutely everyone, but I am convinced that would 
go a long way toward dealing with this overall sweeping problem 
that we are dealing with of our border security and the problem 
of illegal immigration.
    Mr. LEVIN. I guess my question does open up a larger issue, 
so we will leave it for another day since the Senate is kind of 
monopolizing discussion at the moment.
    Mr. DREIER. That is why we should weigh in over here a 
little bit this week on it.
    Mr. LEVIN. Okay. Thank you.
    Chairman MCCRERY. Well, obviously, if we went to a guest 
worker program of some sort, then that would facilitate getting 
something like this----
    Mr. DREIER. Oh, absolutely.
    Chairman MCCRERY. --that could be used for----
    Mr. DREIER. I will say that I believe that as we do this, 
it is imperative that we have a responsible, non-amnesty-
granting temporary worker program that does go hand-in-hand 
with this so that we can meet the economic demand that exists 
in this country and then tackle the question that you correctly 
raise.
    Mr. REYES. If I can just----
    Chairman MCCRERY. Please.
    Mr. REYES. We come together on offering this as one part of 
the solution, but I do believe that we have got to have 
comprehensive immigration reform. We have got to have secure 
borders. We have got to have a guest worker program, which this 
would fit in with. Then you have got to take care of, as 
Congressman Levin said, you have got to take care of those 
people that have been in this country, paying their taxes, 
being part of our community. That is what I think would be a 
realistic way to implement this.
    What this does is it becomes part of the mechanism of 
making sure that we don't have the magnet--I can tell you from 
personal experience, after IRCA, we saw a dramatic downturn in 
attempted illegal entries for about 3 years. Some areas of our 
border--I was chief in McAllen at the time with Border Patrol--
some areas of our border saw a decline in attempted entries 
into this country of as much as 80 percent. The reason for that 
was the publicity that was generated that, for the first time, 
there were employer sanctions in place. You would not be able 
to get a job. The attraction of undergoing that arduous trip 
through the border and trying to get a job somewhere in this 
country was gone.
    It wasn't until about 3 years into the program that people 
started realizing, well, Congress didn't allot the personnel to 
check, so my uncle or my cousin or my friend said that if you 
can make it to Denver, you can still get a job. Even though it 
had the requirements of the I-9, there were no teeth in the 
law.
    I think that this on its own probably is not the whole 
solution, but it gets us part of the way, and then 
comprehensive immigration reform, I think would take us the 
rest of the way.
    Mr. DREIER. Mr. Chairman, what this really does is, again, 
as we look at this question, why is it that people come into 
this country illegally, they come seeking a job. People use a 
Social Security card, often a fraudulent one, to get a job and 
this is the way to end that demand side, the magnet that draws 
them in, by having a structure in place like this. I agree 
that, overall, this is not the panacea, but I think that this 
will go an awful long way toward addressing this issue.
    Chairman MCCRERY. Mr. Johnson?
    Mr. JOHNSON. Thank you, Mr. Chairman. I am wondering how 
easy it is to duplicate a card like that.
    Mr. DREIER. It is a great question, Sam, and I will tell 
you that one of the things that we have done is we have said 
that nothing has been done since 1935.
    Mr. JOHNSON. Right.
    Mr. DREIER. I believe that with the technological advances 
that are made, that it would be, I hope, impossible to 
duplicate it. There are no guarantees, but we should do every 
single thing within our power to, after these many decades 
having done nothing, use the technology that we have today to 
ensure that it is as tamper-proof, as smart, as counterfeit-
proof as we possibly can.
    Mr. JOHNSON. I couldn't agree with you more. What kind of 
upgrade are you going to have to have to get--business offices 
don't have the ability to scan cards, a lot of them.
    Mr. DREIER. Well, that is a great question, and obviously 
this is something that would have to be phased in over a period 
of time. At the end of the day, I think that it would be easier 
on businesses because of the fact that they don't have to look 
at these 94 different combinations of documents, and I am, 
frankly, offended by a lot of this stuff where you would ask 
one person whether or not they are an American citizen and not 
another person based in the way someone might look. I am very 
offended by that. I think that the existence of this card will 
go a long way toward helping that. Obviously, we will have to 
deal with businesses as they look at the challenge of having 
the equipment----
    Mr. JOHNSON. Yes, there is going to be a cost involved. You 
are from California, and you have got a lot of agricultural 
migrant workers out there. How are you going to get them a 
card?
    Mr. DREIER. You know what? The fact----
    Mr. JOHNSON. Are we going to--let me rephrase it a little 
bit.
    Mr. DREIER. Sure.
    Mr. JOHNSON. Guys that come across legally for migrant 
work, are we going to give them some kind of an identification?
    Mr. DREIER. Well, see, what they would have on this is they 
would, within the database, it would be stated that they are 
here, if it is an H-2A visa or any kind of work permit, that 
would mean that they are a qualified worker by virtue of it. If 
we do end up with some kind of responsible non-amnesty-granting 
temporary worker program, someone who is here under that would 
be able to have this card for those purposes. If someone is 
here illegally and they don't have a card and they are hired, 
then that employer would be subjected to a, as I said, a 400-
percent increase in the fine, 5 years in prison, and we hire 
10,000 enforcement agents to make sure that this is enforced, 
which gets back to Silver's point, which is a very important 
one.
    If you look at IRCA, we coupled amnesty with sanctions and 
unenforced sanctions is what ended up once again reigniting 
this flow of people in illegally----
    Mr. JOHNSON. Well, that is what I was about to say. If you 
depend on the employer, they are not going to do it.
    Mr. DREIER. Exactly.
    Mr. JOHNSON. Thank you, Mr. Chairman.
    Mr. DREIER. I will say that I didn't believe that the 
employer should be turned into a Border Patrol agent.
    Mr. JOHNSON. I agree.
    Mr. DREIER. That is one of the concerns that I have, and I 
know we share that. I voted against the--I was here in 1986 and 
voted against IRCA for that reason.
    Mr. JOHNSON. Thank you.
    Chairman MCCRERY. Thank you, Mr. Johnson. Mr. Becerra?
    Mr. BECERRA. Thank you to the two of you for being here and 
making your presentation. It is rather interesting. We are 
about to have witnesses who will come and give us testimony on 
the Social Security card, the use of the number, and so forth, 
and we have had over the course of actually the last few years 
a number of hearings. Last session, we passed out, without a 
single ``no'' vote, legislation by Representative Shaw to 
actually restrict the use of the SSN. It is interesting, 
because your proposal would make it the universal identifier 
and we are about to hear from witnesses who are going to tell 
us why there are problems in allowing the number to be more 
universally available. It is a fascinating discussion.
    We need to figure out a way to be able to identify folks. 
Right now, the SSA would tell you, if they were here to 
testify, that just by having a number, we can't tell you, or 
they can't tell us if that individual is a citizen----
    Mr. DREIER. Absolutely.
    Mr. BECERRA. --or not. They may or may not be able to tell 
us whether that person is here legally. You would have to do a 
lot of work before you could get the SSN to become a national 
identification number.
    Mr. DREIER. Well, we don't want it to be that, though. We 
don't want it to be a national ID card. In fact, as I said, we 
actually have on this card that it is not a national ID card 
and it is used only for Social Security purposes and when 
applying for a new job.
    Mr. BECERRA. Okay, so then, Mr. Chairman, let me ask you 
this. What are you going to tell all the credit bureaus, the 
banks, all the folks, all the industries that currently use the 
SSN--hospitals used to use them publicly as the patient 
identification number--what do you tell all those industries 
that are telling us right now, you can't do more to restrict 
our utilization of the number because that has become our 
universal identifier within our industry?
    Mr. DREIER. You see, that is up to them. What I have said 
is a national ID card, getting on board an airplane, utilizing 
it for a Federal purpose, which is really what we are in the 
business of doing. The way some private entity or a State or 
local entity handles the use of this number and card is their 
business----
    Mr. BECERRA. Would you prohibit the use for any other 
purposes?
    Mr. DREIER. Yes, I am not saying--I am not saying that it 
can't be used, because I don't want to in any way restrict the 
SSN from being utilized for purposes that we determine are 
necessary. All I am saying is that I don't want the use of a 
smart, counterfeit-proof Social Security card to be 
misinterpreted as some sort of national identification card. 
That is all I am arguing.
    Mr. BECERRA. The thing there, David, is if indeed it is a 
strong identifier that has good firewalls from abuse, then it 
is going to become a great identifier for a lot of other folks, 
as well. If it works well for identifying whether or not you 
are entitled to work in this country, someone is going to say, 
well, it is probably going to work well to identify whether or 
not you have got good credit or whether or not we should offer 
you this mortgage. I think we have to be very careful. Unless 
you prohibit its use for other purposes----
    Mr. DREIER. I think that is something we might consider 
looking at, if you want to.
    Mr. REYES. If I can say something, currently--I just became 
a grandfather for the third time. When your baby is born, he or 
she gets a Social Security card.
    Mr. BECERRA. Yes.
    Mr. REYES. When you volunteer for the Army or the Navy, the 
Marine Corps, the Air Force, your Social Security card becomes 
your identifier. When I was drafted, I was given a number, RN-
18746717. You never forget that. Today's service people use 
that Social Security card for those purposes. I don't know 
that--and maybe David has given it more thought, but I haven't 
given it a lot of thought in terms of why you would want to 
preclude or limit somebody's ability to use the SSN when I 
know----
    Mr. BECERRA. If you were to stay a little longer, you would 
hear testimony by someone who actually had her SSN misused for 
identity purposes----
    Mr. REYES. See, even in this system, I think here is what 
is important about having the system. I made the three points. 
The system would tell you if somebody else is using the same 
number, because in today's technology, the availability--if 
somebody presents--say, for instance, somebody came up with a 
system of----
    Mr. BECERRA. Yes, but by then, it is too late----
    Mr. REYES. No----
    Mr. BECERRA. --for the person who had his or her identity 
stolen.
    Mr. REYES. The point is, it will raise an alert when that 
card is presented. It is like--and I don't know how they work 
currently on use of credit cards, but I know that occasionally 
when I give a credit card, especially when you travel out of 
the country, they will ask for identification. My wife will get 
a call at home and say, this purchase was made in London or 
whatever. We want to make sure that you or your husband is 
comfortable that one of you is in London.
    The technology exists that would be able to tell the system 
that the SSN that was presented in Peoria, Illinois, all of a 
sudden a week later was presented in Los Angeles and maybe 
within 72 hours was presented within Miami, so that tells you 
that number has been compromised somehow and the system alerts 
DHS and they would check all three people that presented that 
card.
    Mr. DREIER. Which one of the two of you is making all those 
purchases, too.
    Mr. REYES. Yes.
    Mr. BECERRA. Thank you, Mr. Chairman. Thank you, gentlemen.
    Chairman MCCRERY. Mr. Brady?
    Mr. BRADY. Thank you, Mr. Chairman, and David and Grandpa 
Reyes, it is good to have you here today. I think Xavier's 
comment about SSNs, one of the issues we are struggling with is 
our SSN system already so compromised that we can never really 
bring integrity to the system. Your point is that if Social 
Security is going to be a key employer verification in this 
whole immigration-Border Security debate, make it counterfeit-
proof. Here is the way to do it.
    I think, in the end, the question of whether we will have a 
counterfeit or attempt to create a counterfeit Social Security 
document, it isn't a matter of if we do but when and how we do 
it, how we structure it, and I know that I supported the House 
bill on border security that passed earlier, or late last year, 
but I know that today, if we had to rely on the Social Security 
system to verify workers in this country, either new or 
existing, the system would simply crater. It doesn't have the 
integrity, the resources, the technology to do that, so I just 
appreciate you bringing a bipartisan idea to the table and I 
appreciate you, Chairman, letting us hear what some of our 
Members who are giving this issue some thought a chance to talk 
to us about that.
    I don't really have any questions. Thanks for giving this a 
thoughtful----
    Mr. DREIER. Let me just thank you very much for that, 
Kevin, and say that I believe that we are in a position where 
this can go a long way toward addressing those identity issues, 
which Xavier correctly raised, dealing with the question that 
Sandy raised as to exactly what happens to the people who are 
here, and tackles this whole issue of the credibility of Social 
Security and the utilization of the number itself as we head to 
the future.
    I had a conversation yesterday with a number of Senators 
about this. They are in the midst of their debate on this, and 
I should say that this provision is actually included in one of 
the Senate bills that has been introduced. John Cornyn and Jon 
Kyl have introduced legislation that actually includes H.R. 98 
as an important component of it.
    It is my hope that we will be able to see this move as 
expeditiously as possible through so that we can include this 
as part of a comprehensive package, and I certainly leave it up 
to you all to demonstrate for us what the best approach is.
    Chairman MCCRERY. Thank you, Mr. Brady.
    Mr. Dreier, Mr. Reyes, thank you very much for being with 
us----
    Mr. DREIER. Thank you very much for having us.
    Chairman MCCRERY. --and for showing up today and sharing 
with us your thoughts.
    Mr. DREIER. Thanks, Mr. Chairman.
    Chairman MCCRERY. Our next panel is composed of two 
witnesses, Ms. Cynthia Fagnoni, Managing Director of Education, 
Work force, and Income Security, United States GAO, and Joel 
Winston, the Associate Director, Division of Privacy and 
Identity Protection, Bureau of Consumer Protection, Federal 
Trade Commission.
    Your written testimony will be included in the record in 
its entirety and we would like for you to try to summarize your 
written testimony in about 5 minutes, and Ms. Fagnoni, we will 
begin with you. Welcome.

STATEMENT OF CYNTHIA M. FAGNONI, MANAGING DIRECTOR, EDUCATION, 
    WORKFORCE, AND INCOME SECURITY ISSUES, U.S. GOVERNMENT 
                     ACCOUNTABILITY OFFICE

    Ms. FAGNONI. Thank you. Thank you, Mr. Chairman, Mr. Levin, 
and Members of the Subcommittee. I am pleased to be here this 
afternoon to discuss ways to better protect the SSN.
    Although the SSN was originally created as a means of 
tracking workers' earnings and eligibility for Social Security 
benefits, today, the number is used for many non-Social 
Security purposes. The wide use of the SSN is significant 
because once it is obtained fraudulently, it can be used to 
create false identities for financial misuse, to falsely obtain 
credit, or to assume another person's identity.
    Today, I would like to discuss the use of SSNs by 
government agencies and certain private sector entities, 
Federal laws that regulate the use and disclosure of SSNs, and 
gaps that remain in protecting the SSN and what more could be 
done. My testimony is based on reports GAO has issued over the 
last several years, many of them completed at the request of 
this Subcommittee.
    First, let me begin with the widespread use of SSNs by both 
the public and private sectors. Federal, State, and county 
government agencies rely extensively on the SSN to maintain 
records with unique identifiers and ensure program integrity. 
Last year, we reported that SSNs are available in a variety of 
public records held by States, local jurisdictions, and courts, 
public records or documents routinely made available to the 
public for inspection, such as marriage licenses and property 
transactions. We also reported that information resellers, 
consumer reporting agencies, and health care organizations use 
SSNs for a variety of purposes, including verifying a person's 
identity or matching existing records.
    Earlier this year, we reported that banks, security firms, 
telecommunications companies, and tax preparation companies 
routinely obtain SSNs from their customers for authentication 
and verification purposes and sometimes share SSNs with their 
contractors for limited purposes, such as identification 
requirements, debt collection, and data storage.
    Regarding the laws, although Federal and State laws have 
been enacted to restrict the use and disclosure of consumers' 
personal information, including SSNs, no one law 
comprehensively regulates the SSN use and protections. 
Moreover, many of the laws enacted are industry-specific and do 
not apply broadly.
    Several States have enacted laws to restrict the use and 
display of SSNs. California, for example, has enacted such a 
law. Thirteen other States now have passed laws similar to 
California's. Four States--California, Georgia, Nevada, and New 
York--require notification of security breaches, another 
example. As a result of such State restrictions, some companies 
now notify customers of security breaches regardless of where 
they happen in the country.
    Although Congress and State legislatures have enacted laws 
that help to restrict SSN display and protect an individual's 
personal information, we have found gaps in the protection of 
SSNs. We have reported that government agencies at all levels 
lack the uniform approach to ensuring the security of the SSN. 
In addition, we found that gaps exist in the Federal law and 
oversight of different industries that share SSNs with their 
contractors. SSNs also continue to be exposed on government-
issued ID cards. Finally, few restrictions are placed on 
information resellers to obtain and resell SSNs in the course 
of their business.
    GAO has made a number of recommendations in proposed 
matters for Congressional consideration to address these gaps. 
We propose that Congress pull together a representative group 
of Federal, State, and local officials to develop a unified 
approach to safeguarding SSNs used at all levels of government. 
We also recommended that OMB advise all levels of government of 
the applicability of the Privacy Act (P.L. 93-579) and develop 
a government-wide policy to ensure a consistent approach for 
displaying SSNs on ID cards.
    Regarding the private sector, we have recommended that 
Congress consider possible options for addressing the gaps in 
the existing Federal requirements for safeguarding SSNs shared 
with contractors. We continue to focus on SSN issues, identify 
gaps, and will continue to recommend possible solutions, where 
appropriate.
    Mr. Chairman, this completes my oral statement. I would be 
happy to answer any questions you or other Members of the 
Subcommittee may have. Thank you.
    [The prepared statement of Ms. Fagnoni follows:]

    Statement of Cynthia M. Fagnoni, Managing Director, Education, 
 Workforce, and Income Security, U.S. Government Accountability Office

    Mr. Chairman and Members of the Committees:
    I am pleased to be here today to discuss ways to better protect the 
Social Security Number (SSN). The SSN was created as a means to track 
workers' earnings and eligibility for Social Security benefits. 
However, the SSN has evolved beyond its original intended purpose and 
has become the identifier of choice for public and private sector 
entities, and is used for numerous non-Social Security purposes. This 
is significant because SSNs, along with a name and date of birth, are 
the pieces of information most often sought by identity thieves. Once 
an SSN is obtained fraudulently, it can then be used to create false 
identities for financial misuse, assuming another individual's 
identity, fraudulently obtaining credit, violating immigration laws, or 
fleeing the criminal justice system. Recent statistics suggest that the 
incidence of identity theft is rapidly growing. The Federal Trade 
Commission (FTC) estimated that over a 1-year period nearly 10 million 
people--or 4.6 percent of the adult U.S. population--discovered that 
they were victims of some form of identity theft, translating into 
estimated losses exceeding $50 billion. FTC also reported that most 
victims of identity theft do not report the crime, and, therefore, the 
total number of identity theft incidences is unknown.
    Over the last few years Congress and some states have recognized 
the importance of restricting the use and display of SSNs by both 
public and private sectors. As a result, federal and state laws have 
begun to be enacted that to some degree protect individual's personal 
information, including SSNs. GAO has issued a number of reports and 
testified before this Subcommittee about the various aspects of SSN use 
in both the public and private sectors. (See related GAO products at 
the end of this testimony.) Accordingly, you asked us to speak about 
some of our findings regarding SSN use and protections. My remarks 
today will focus on (1) the use of SSNs by government agencies and 
certain private sector entities, (2) the federal laws that regulate the 
use and disclosure of SSNs, and (3) the gaps that remain in protecting 
the SSN and what more could be done.
    In summary, SSN use is widespread by both the public and private 
sectors. Agencies at all levels of government frequently collect and 
use SSNs to administer their programs, verify applicants' eligibility 
for services and benefits, and perform research and evaluations of 
their programs. In addition, SSNs are available in a variety of public 
records held by states, local jurisdictions, and courts, appearing in 
records that document common life events and transactions, such as 
marriages and home purchases. Certain private sector entities also use 
SSNs. Information resellers, credit reporting agencies (CRAs), and 
health care organizations routinely obtain SSNs from various public and 
private sources, and use SSNs for various purposes, such as to build 
tools that verify an individual's identity or match existing records. 
In addition, private sector entities that engage in third party 
contracting sometimes share SSNs with their contractors for limited 
purposes.
    There is no one law that comprehensively regulates SSN use and 
protections. However, certain federal laws have been enacted to 
restrict the use and disclosure of consumers' personal information, 
including SSNs, but these laws tend to be industry-specific and do not 
apply broadly. In addition, certain states had begun to enact their own 
legislation restricting the use and display of SSNs by public and 
private sector entities, which has subsequently led other states to 
start enacting similar regulation. Finally, Congress is currently 
considering several proposals to restrict SSN use and display, similar 
to state legislation.
    Although some action has been taken at the federal and state level 
to protect SSNs, more could be done. In our prior work, we found gaps 
in the practices for protecting SSNs by government agencies and across 
industry sectors. As a result, we made recommendations to federal 
agencies to address the issues we found and proposed matters for 
Congress to consider. For example, we found that certain measures that 
could help protect SSNs are not uniformly in place at all levels of 
government. In addition, there are gaps in the federal law and 
oversight in different industries that share SSNs with their 
contractors, and there are few restrictions placed on certain entities' 
abilities to obtain and use SSNs in the course of their business. 
Finally, SSNs are widely exposed in a variety of public records and are 
still subject to exposure on identity cards issued under federal 
auspices. To address some of these issues, we made recommendations and 
proposed matters for congressional consideration. For example, to 
address gaps in the government uses of SSNs and the exposure of SSNs in 
public records and on identification cards, we advised Congress to 
convene a group of government officials to develop a unified approach 
to safeguarding SSNs. To address the gaps in federal laws that would 
apply to industries that share SSNs with their contractors, we 
recommended Congress consider options to restrict the use and display 
of SSNs to third party contractors.
Background
    The Social Security Act of 1935 authorized the Social Security 
Administration (SSA) to establish a record-keeping system to manage the 
Social Security program, which resulted in the creation of the SSN.\1\ 
Through a process known as ``enumeration,'' unique numbers are created 
for every person as a work and retirement benefit record. Today, SSA 
issues SSNs to most U.S. citizens, but they are also available to non-
citizens lawfully admitted to the United States with permission to 
work. Lawfully admitted noncitizens may also qualify for a SSN for 
nonwork purposes when a federal, state, or local law requires that they 
have a SSN to obtain a particular welfare benefit or service. SSA staff 
collect and verify information from such applicants regarding their 
age, identity, citizenship, and immigration status.
---------------------------------------------------------------------------
    \1\ The Social Security Act of 1935 created the Social Security 
Board, which was renamed the Social Security Administration in 1946.
---------------------------------------------------------------------------
    With the enhancement of computer technologies in recent years, 
private sector businesses are increasingly computerizing their records; 
as a result, these enhancements have spawned new businesses activities 
involving the aggregation of person information. Information resellers, 
sometimes referred to as information brokers, are businesses that 
specialize in amassing consumer information including SSNs for 
informational services. They may provide their services to a variety of 
customers, either to specific businesses clients or through the 
Internet to anyone willing to pay a fee. Consumer reporting agencies, 
also known as credit bureaus, are agencies that collect and sell 
information about the creditworthiness of individuals. CRAs collect 
information that is considered relevant to a person's credit history, 
and obtain SSNs from their customers or businesses that furnish data to 
them, as well as from private and public sources. Organizations that 
provide health care services also commonly use consumers' SSNs. They 
obtain SSNs from individuals themselves and companies that offer health 
care plans.
    In recent years, companies have increasingly relied on the use of 
contractors to perform certain activities and functions related to 
their business operations. This trend has often been referred to as 
outsourcing. However, no commonly recognized definition of outsourcing 
exists, and there has been confusion over whether it encompasses only 
activities a company performed in-house or includes any activity a 
company may contract out. According to outsourcing experts, 
approximately 90 percent of businesses contract out some activity 
because they find either it is more economical to do so or other 
companies are better able to perform these activities. Some of the 
activities companies outsource will require that contractors be 
provided personal information about the companies' customers in order 
to perform those activities, in some cases, this information includes 
SSNs.
    Due to the pervasive use of SSNs, individuals are routinely asked 
to disclose their SSNs, along with other personal identifying 
information, for numerous purposes. In some instances where individuals 
provide their SSNs to government entities, documents containing the SSN 
are routinely made available to the public for inspection. The 
widespread disclosure of SSNs in public records has raised concern 
because it can put individuals at increased risk of identity theft. In 
addition, given the explosion in the Internet use and the ease with 
which personally identifiable information is accessible, individuals 
looking to steal someone's identity are increasingly able to do so. 
According to FTC, it receives roughly 15,000 to 20,000 contacts per 
week on its hotline and Web site, or through the mail from victims and 
consumers who want to avoid becoming victims.
Both Government and Private Sector Entities Collect and Use SSNs for a 
        Variety of Purposes
    Government entities are generally required by law to collect SSNs 
to determine individuals' eligibility for services and benefits. SSNs 
are also widely available in public records maintained by state and 
local governments and the courts. Certain private sector entities, such 
as information resellers, CRAs, and healthcare organizations obtain 
SSNs from public and private sources, or directly from their customers, 
and use them for various purposes. In addition, banks, securities 
firms, telecommunication firms, and tax preparers engage in third party 
contracting and sometimes share SSNs with their contractors for limited 
purposes.

Government Entities Are Required by Laws and Regulations to Collect 
        SSNs, and Use Them for Various Purposes
    As required by a number of federal laws and regulations, agencies 
at all levels of government frequently collect and use SSNs to 
administer their programs, to link data for verifying applicants' 
eligibility for services and benefits, and to conduct program 
evaluations.\2\ For example, the Personal Responsibility and Work 
Opportunity Act of 1996 mandates that, among other things, states have 
laws in place to require the collection of SSNs on driver's license 
applications. Such laws and regulations have contributed to the 
widespread use of SSNs by government agencies, because the SSN serves 
as a unique identifier.
---------------------------------------------------------------------------
    \2\ GAO, Social Security: Government and Commercial Use of the 
Social Security Number Is Widespread, GAO/HEHS-99-28 (Washington, D.C.: 
February 16, 1999) and GAO, Social Security Numbers: Government 
Benefits from SSN Use, but Could Provide Better Safeguards, GA0-02-352 
(Washington, D.C.: May 31, 2002).
---------------------------------------------------------------------------
    Government agencies use SSNs for a variety of purposes. We have 
found that agencies typically used SSNs to manage their records and to 
facilitate data sharing to verify an applicant's eligibility for 
services and benefits.\3\ For example, agencies use SSNs
---------------------------------------------------------------------------
    \3\ GA0-02-352.

      for internal administrative purposes, which included 
activities such as identifying, retrieving, and updating records;
      to collect debts owed the government and conduct or 
support research and evaluations as well as using employees' SSNs for 
activities such as payroll, wage reporting, and providing employee 
benefits;
      to ensure program integrity, such as matching records 
with state and local correctional facilities to identify individuals 
for whom the agency should terminate benefit payments; and
      for statistics, research, and evaluation; \4\
---------------------------------------------------------------------------
    \4\ The Bureau of the Census is authorized by statute to collect a 
variety of information and is prohibited from making it available, 
except in certain circumstances.
---------------------------------------------------------------------------
SSNs Are Widely Available in Public Records Held by States, Local 
        Jurisdictions, and Courts, but Many of These Agencies Are 
        Taking Steps to Limit Display
    SSNs are publicly available throughout the United States, primarily 
at the state and local levels of government.\5\ Based on a survey of 
federal, state, and local governments, we reported in 2004 that state 
agencies in 41 states and the District of Columbia were displaying SSNs 
in public records; this was also true in 75 percent of U.S. 
counties.\6\ We also found that while the number and type of records in 
which SSNs were displayed varied greatly across states and counties, 
SSNs were most often found in court and property records.
---------------------------------------------------------------------------
    \5\ Not all records held by government or public agents are 
``public'' in terms of their availability to any inquiring person. For 
example, adoption records are generally sealed. Personnel records are 
often not readily available to the public, although newspapers may 
publish the salaries of high, elected officials. There is no common 
definition of public records. However, we define public records as 
those records generally made available to the public for inspection in 
their entirety by a federal, state, or local government agency. Such 
documents are typically accessed in a public reading room, clerk's 
office, or on the Internet.
    \6\ GAO, Social Security Numbers: Governments Could Do More To 
Reduce Display in Public Records and on Identity Cards, GAO-05-59 
(Washington, D.C.: November 9, 2004).
---------------------------------------------------------------------------
    Public records displaying SSNs are stored in multiple formats that 
vary by different levels of government. State government offices tended 
to store such records electronically, while most local government 
records were stored on microfiche or microfilm. However, our survey 
found that public access to such records was often limited to 
inspection of the individual paper copy or request by mail.\7\
---------------------------------------------------------------------------
    \7\ GAO-05-59
---------------------------------------------------------------------------
    We found that few state agencies make public records available on 
the Internet, although some do so. However, few state or local offices 
reported any plans to significantly expand Internet access to public 
records that display SSNs. Based on our survey results, only four state 
agencies indicated plans to make such records available on the 
Internet, and one agency planned to remove records displaying SSNs from 
Internet access.

Private Sector Entities Obtain SSNs from Public and Private Sources and 
        Use Them for Various Purposes
    Private sector entities such as information resellers, CRAs, and 
health care organizations generally obtain SSNs from various public and 
private sources. Large or well known information resellers have told us 
they obtain SSNs from various public records, such as records of 
bankruptcies, tax liens, civil judgments, criminal histories, deaths, 
real estate transactions, voter registrations, and professional 
licenses. They also said that they sometimes obtain batch files of 
electronic copies of jurisdictional public records where available. 
However, some reseller officials said they are more likely to rely on 
SSNs obtained directly from their clients, who would voluntarily 
provide such information for a specific service or product, than those 
found in public records.\8\
---------------------------------------------------------------------------
    \8\ GAO, Social Security Numbers: Private Sector Entities Routinely 
Obtain and Use SSNs, and Laws Limit the Disclosure of This Information, 
GAO-04-11 (Washington, D.C.: January 22, 2004).
---------------------------------------------------------------------------
    Like information resellers, CRAs also obtain SSNs from public and 
private sources. CRA officials have told us that they obtained SSNs 
from public sources, such as bankruptcy records. We also found that 
these companies obtained SSNs from other information resellers, 
especially those that specialized in obtaining information from public 
records. However, CRAs are more likely to obtain SSNs from businesses 
that subscribe to their services, such as banks, insurance companies, 
mortgage companies, debt collection agencies, child support enforcement 
agencies, credit grantors, and employment screening companies. 
Therefore, individuals who provide these businesses with their SSNs for 
reasons such as applying for credit would subsequently have their 
charges and payment transactions, accompanied by the SSN, reported to 
the CRAs.
    Health care organizations, including health care insurance plans 
and providers, are less likely to obtain SSN data from public sources. 
Health care organizations typically obtained SSNs either from 
individuals themselves or from companies that offer health care plans. 
For example, subscribers or policyholders enrolled in a health care 
plan provide their SSN as part of their health care plan application to 
their company or employer group. In addition to health care plans, 
health care organizations also included health care providers, such as 
hospitals. Such entities often collected SSNs as part of the process of 
obtaining information on insured people. However, health care provider 
officials told us that, particularly with hospitals, the medical record 
number is the primary identifier, rather than the SSN.
    We found that the primary use of the SSN by information resellers, 
CRAs, and health care organizations alike was to help verify the 
identity of an individual. Large information resellers said they 
generally use the SSN as an identity verification tool. They also use 
it for internal matching purposes of its databases, as a factor in 
identifying individuals for their product reports, or for conducting 
investigations for their clients for resident screening or employment 
screening. CRAs use SSNs as the primary identifier of individuals that 
enables them to match the information they receive from their business 
clients with information stored in their databases on individuals. 
Because these companies have various commercial, financial, and 
government agencies furnishing data to them, the SSN is the primary 
factor that ensures that incoming data is matched correctly with an 
individual's information on file. We found that in some cases CRAs and 
information resellers can sometimes be the same entity, a fact that 
blurs the distinction between the two types of businesses but does not 
affect the use of SSNs by these entities. Finally, health care 
organizations also use the SSN to help verify the identity of 
individuals. These organizations use SSNs, along with other information 
such as name, address, and date of birth, as a factor in determining a 
member's identity.
    Private sector companies also share customers' SSNs with their 
contractors. Banks, investment firms, telecommunication companies, and 
tax preparation companies we interviewed routinely obtain SSNs from 
their customers for authentication and identification purposes.\9\ All 
these companies contracted out various services, such as data 
processing, administrative, and customer service functions. Although 
these companies may share consumer information, such as SSNs, with 
contractors that provide services to their customers, company officials 
said that they only share such information with their contractors for 
limited purposes, generally when it is necessary or unavoidable.
---------------------------------------------------------------------------
    \9\ GAO, Social Security Numbers: Stronger Protections Needed When 
Contractors Have Access to SSNs, GAO-06-238 (Washington, D.C.: January 
23, 2006).
---------------------------------------------------------------------------
    The companies we contacted provided us with standard contract forms 
they use in contracting with service providers to safeguard customers' 
personal information, such as SSNs, from misuse.\10\ In general, the 
types of provisions these companies included in their standard contract 
forms included electronic and physical data protections, audit rights, 
data breach notifications, subcontractor restrictions, and data 
handling and disposal requirements. We found that most of the companies 
we interviewed had established some type of due diligence or 
credentialing process to verify the reliability of potential 
contractors prior to and during contract negotiations. Furthermore, we 
found that some industry associations have voluntarily developed 
guidance for their members regarding the sharing of personal 
information with third parties.
---------------------------------------------------------------------------
    \10\ GAO-06-238
---------------------------------------------------------------------------
No Single Law Governs the Use and Disclosure of SSNs Although Various 
        Laws Have Been Enacted That Help Protect SSNs
    Although no single law comprehensively governs the use and 
disclosure of SSNs, certain federal laws restrict the use and 
disclosure of personal information, including SSNs, by government 
agencies or private sector entities. These laws, however, tend to be 
directed at specific industries or governmental agencies and often do 
not apply broadly across public and private sectors or across private 
sector industries. For example, the overall use and disclosure of SSNs 
by the federal government is restricted under the Privacy Act, which, 
broadly speaking, seeks to balance the government's need to maintain 
information about individuals with the rights of individuals to be 
protected against unwarranted invasions of their privacy. The Privacy 
Act requires that any federal, state, or local government agency, when 
requesting an SSN from an individual, tell individuals whether 
disclosing their SSN is mandatory or voluntary, cite the statutory or 
other authority under which the request is being made, and state what 
uses it will make of the individual's SSN.
    Other federal laws have also placed restrictions on private sector 
entities' use and disclosure of consumers' personal information, 
including SSNs. These include the Fair Credit Reporting Act (FCRA), the 
Fair and Accurate Credit Transaction Act (FACTA), the Gramm-Leach-
Bliley Act (GLBA), the Drivers Privacy Protection Act (DPPA), and the 
Health Insurance Portability and Accountability Act (HIPAA). As shown 
in table 1, some of these federal laws either restrict certain private 
sector entities from disclosing personally identifiable information to 
specific purposes or with whom the information is shared. In addition, 
certain industries, such as the financial services industry, are 
required to protect individuals' personal information to a greater 
degree than entities in other industries.

 Table 1: Aspects of Federal Laws That Affect Private Sector Disclosure
                         of Personal Information
------------------------------------------------------------------------
           Federal Laws                         Restrictions
------------------------------------------------------------------------
Fair Credit Reporting Act          Limits access to credit data that
                                    includes SSNs to those who have a
                                    permissible purpose under the law.
------------------------------------------------------------------------
Fair and Accurate Credit           Amends FCRA to allow, among others
 Transactions Act                   things, consumers who request a copy
                                    of their credit report to also
                                    request that the first 5 digits of
                                    their SSN (or similar identification
                                    number) not be included in the file;
                                    requires consumer reporting agencies
                                    and any business that use a consumer
                                    report to adopt procedures for
                                    proper disposal.
------------------------------------------------------------------------
Gramm-Leach-Bliley Act             Creates a new definition of personal
                                    information that includes SSNs and
                                    limits when financial institutions
                                    may disclose the information to
                                    nonaffiliated third parties.
------------------------------------------------------------------------
Health Insurance Portability and   Protects the privacy of health
 Accountability Act                 information that identifies an
                                    individual and restricts health care
                                    organizations from disclosing such
                                    information to others without the
                                    patient's consent.
------------------------------------------------------------------------
Source: GAO analysis

    Congress has also introduced a federal statute that criminalizes 
fraud in connection with the unlawful theft and misuse of personal 
identifiable information. In 1998, Congress enacted the Identity Theft 
and Assumption Deterrence Act (Identity Theft Act). The act made it a 
criminal offense for a person to ``knowingly transfer, possess, or use 
without lawful authority,'' another person's means of identification 
``with the intent to commit, or to aid or abet, or in connection with, 
any unlawful activity that constitutes a violation of Federal law, or 
that constitutes a felony under any applicable state or local law.'' 
Under the act, a name or Social Security number is considered a ``means 
of identification'' and a number of cases have been prosecuted under 
this law.
    Many states have begun to enact laws to restrict the use and 
display of SSNs. (See appendix 1 for a listing of state laws previously 
reported by GAO.) After one state took action, other states followed in 
enacting similar laws. For example, in 2001, California enacted a law 
restricting the use and display of SSNs, which generally prohibited 
companies and persons from engaging in certain activities, such as 
posting or publicly displaying SSNs, or requiring people to transmit an 
SSN over the Internet unless the connection is secure or the number is 
encrypted. In addition, California enacted a law containing 
notification requirements in the event of a security breach where a 
business or a California state agency is required to notify any 
California resident whose unencrypted personal information was, or is 
reasonably believed to have been, acquired by an unauthorized person.
    Subsequently, other states have enacted laws restricting the use 
and display of SSNs. Specifically, in our prior work, we identified 13 
others states--Arizona, Arkansas, Connecticut, Georgia, Illinois, 
Maryland, Michigan, Minnesota, Missouri, Oklahoma, Texas, Utah, and 
Virginia--that have each passed laws similar to California's. \11\ 
While some states, such as Arizona, have enacted virtually identical 
SSN use and display restrictions, other states have modified the 
restrictions in various ways. For example, unlike the California law, 
which prohibits the use of the full SSN, the Michigan statute prohibits 
the use of more than four sequential digits of the SSN. The Michigan 
law also contains a prohibition against the use of SSNs on 
identification and membership cards, permits, and licenses. Missouri's 
law includes a prohibition against requiring an individual to use his 
or her SSN as an employee number. Oklahoma's law is unique in that it 
only limits the ways in which employers may use their employees' SSNs, 
and does not apply more generally to other types of transactions and 
activities.
---------------------------------------------------------------------------
    \11\  See Arkansas (Ark. Code Ann.  4-86-107 (2005)); Arizona 
(Ariz. Rev. Stat.  44-1373 (2004)); Connecticut (Conn. Gen. Stat.  
42-470 (2003)); Georgia (Ga. Code Ann.  33-24-57.1 (2003)); Illinois 
(815 Ill. Comp. Stat. 505/2QQ (2004)); Maryland (Md. Code Ann., Com. 
Law  14-3301 et seq. (2005)); Michigan (Mich. Comp. Laws  445.81 et 
seq. (2004)); Minnesota (Minn. Stat.  325E.59 (2005)); Missouri (Mo. 
Rev. Stat.  407.1355 (2003)); Oklahoma (Okla. Stat. tit. 40,  173.1 
(2004)); Texas (Tex. Bus. & Com. Code Ann. 35.58 (2003)); Utah (Utah 
Code Ann.  31A-21-110 (2004)); and Virginia (Va. Code Ann.  59.1-
443.2 (2005)).
---------------------------------------------------------------------------
    Some states have recently enacted other types of restrictions on 
the uses of SSNs as well. Arkansas, Colorado, and Wisconsin limit the 
use of a student's SSN as a student identification number.\12\ New 
Mexico requires businesses that have acquired consumer SSNs to adopt 
internal policies to limit access to authorized employees.\13\ Texas 
recently enacted a law requiring businesses to properly dispose of 
business records that contain a customer's personal identifying 
information, which is defined to include SSNs.\14\
---------------------------------------------------------------------------
    \12\ Ark. Code Ann.  6-18-208 (2005); Colo. Rev. Stat.  23-5-127 
(2003); and Wis. Stat.  36.32 (2001).
    \13\ N.M. Stat. Ann.  57-12B-1 et seq. (2003).
    \14\ Tex. Bus. & Com. Code Ann.  35.48 (2005).
---------------------------------------------------------------------------
    Other recent state legislation includes new restrictions on state 
and local government agencies. For example, South Dakota law prohibits 
the display of SSNs on all driver's licenses and nondriver's 
identification cards,\15\ while Indiana law generally prohibits a state 
agency from releasing a SSN unless otherwise required by law.\16\ In 
addition, as of January 1, 2007, a Nevada law will require governmental 
agencies, except in certain circumstances, to ensure that the SSNs 
recorded in their books and on their records are maintained in a 
confidential manner.\17\
---------------------------------------------------------------------------
    \15\ S.D. Codified Laws  32-12-17.13 (2005).
    \16\ Ind. Code  4-1-10-1 et seq. (2005).
    \17\ Nev. Rev. Stat. 239.030 (2005).
---------------------------------------------------------------------------
    We also identified four states that have passed legislation 
containing notification requirements in the event of a security breach. 
For example, New York recently enacted a law requiring such 
notifications.\18\ California requires a business or a California state 
agency to notify any California resident whose unencrypted personal 
information was, or is reasonably believed to have been, acquired by an 
unauthorized person.\19\ In the last year, this law forced several 
large companies to notify individuals that their information was 
compromised because of certain circumstances. Under a Nevada law, 
government agencies and certain persons who do business in the state 
must notify individuals if their personal information is reasonably 
believed to have been compromised.\20\ Similarly, Georgia requires 
certain private sector entities to notify their customers if a security 
breach occurred that compromised their customers' personal information, 
such as their SSNs.\21\
---------------------------------------------------------------------------
    \18\ N.Y. State Tech. Law  208 (2005).
    \19\ Cal. Civ. Code  1798.29 (2002); 1798.82 (2002).
    \20\ Nev. Rev. Stat.  603A.220 (2005).
    \21\ Ga. Code Ann.  10-1-910 et seq. (2005).
---------------------------------------------------------------------------
    In addition, we found that some state offices were beginning to 
take measures to change the way in which they displayed or shared SSNs 
in public records. For example, we found that many state agencies had 
restricted access to or redacted--covered or otherwise hidden from 
view--SSNs from public versions of records. Specific restrictions and 
other actions state agencies reported taking included blocking or 
removing SSNs from electronic versions of records, allowing individuals 
identified in the record to request removing their SSN from the 
publicly available version, replacing SSNs with alternative 
identifiers, and restricting access only to individuals identified in 
the records.
    Finally, Congress is currently considering consumer privacy 
legislation, which in some cases includes SSN restrictions. In 2005, 
there were more than 20 proposed bills pending before the U.S. House 
and Senate.\22\ In some cases, the provisions being considered mirrored 
provisions in enacted state laws. For example, some proposed 
legislation included prohibitions on the display of SSNs, similar to a 
Colorado law, while other proposed legislation address the solicitation 
of SSNs by public and private sector entities. In addition, some 
federal privacy legislation also proposed consumer safeguards, such as 
security freezes and prohibitions on the sale and purchase of SSNs.
---------------------------------------------------------------------------
    \22\ GAO, Social Security Numbers: Federal and State Laws Restrict 
Use of SSNs, yet Gaps Remain, GAO-05-1016T (Washington, D.C.: 
September15, 2005)
---------------------------------------------------------------------------
More Could Be Done To Protect SSNs
    Although laws at both state and federal levels have helped to 
restrict SSN display and protect individual's personal information, 
clearly gaps remain. We have issued a number of reports for this 
Subcommittee that have looked at the collection, use, and protections 
of SSNs by federal agencies and private sector entities. In some cases 
where federal action could be taken, we have proposed matters for 
congressional consideration to explore legislative actions or 
recommendations to a federal agency to address problems we found. In 
other cases, mainly those that relate to private sector entities, we 
have proposed a matter for Congressional consideration. OMB has 
implemented two of our recommendations and Congress is still 
considering what actions need to be taken.
Prior Work Found Gaps in the Protections of SSNs
    In our review of government uses of SSNs, we reported that certain 
measures that could provide more assurances that SSNs obtained by 
government entities are secure are not universally in place at any 
level of government.\23\ Agencies that deliver services and benefits 
use SSNs to administer programs and took some steps to safeguard SSNs. 
However, when federal, state, and county agencies request SSNs, they 
did not consistently inform the SSN holders of whether they must 
provide the SSN to receive benefits or services and how the SSN will be 
used. In addition, although some agencies took action to limit the 
display of SSNs on documents that were not intended to be public but 
may be viewed by others, these actions sometimes took place in a 
piecemeal manner rather than as a result of a systematic effort.
---------------------------------------------------------------------------
    \23\ GAO-02-352
---------------------------------------------------------------------------
    In our reviews of private sector entities' collection and use of 
SSNs, we found gaps in how different industries are covered by federal 
laws protecting individual's personal information. In our third party 
contractors' review, we reported that federal regulation and oversight 
of SSN sharing varies across four industries we reviewed, revealing 
gaps in federal law and agency oversight for different industries that 
share SSNs with their contractors.\24\ For example, federal law and 
oversight of the sharing of personal information in the financial 
services industry is very extensive: financial services companies must 
comply with GLBA requirements for safeguarding customer's personal 
information, and regulators have an examination process in place that 
includes determining whether banks and securities firms are 
safeguarding this information. IRS has regulations and guidance in 
place to restrict the disclosure of SSNs by tax preparers and their 
contractors, but does not perform periodic reviews of tax preparers' 
compliance. FCC does not have regulations covering SSNs and also does 
not periodically review telecommunications companies to determine 
whether they are safeguarding such information. Companies in the 
industries we reviewed relied on accepted industry practices and 
primarily used the terms of their contracts to safeguard personal 
information, including SSNs they shared with outside contractors.
---------------------------------------------------------------------------
    \24\ GAO-06-238.
---------------------------------------------------------------------------
    We also found that there are few restrictions placed on certain 
entities' abilities such as information resellers to resell SSNs in the 
course of their business. Although certain federal laws have some 
restrictions on reselling nonpublic personal information, these laws 
only apply to certain types of private sector entities, such as 
financial institutions.
    In our review of SSNs in public records, we found that SSNs are 
widely exposed to view in a variety of public records and are still 
subject to exposure on identity cards issued under federal 
auspices.\25\ The number and type of records in which SSNs are 
displayed varies greatly for both states and counties, and SSNs are 
available in some federal court records. A number of government 
agencies and oversight bodies are taking steps to eliminate the open 
display of SSNs. For example, some actions state agencies reported 
taking included blocking or removing SSNs from electronic versions of 
records, and replacing SSNs with alternative identifiers. However, such 
initiatives to protect the SSN may slow its misuse, but the absence of 
uniform and comprehensive policy is likely to leave many individuals 
vulnerable.
---------------------------------------------------------------------------
    \25\ GAO-05-59.
---------------------------------------------------------------------------
    Finally, although they are not displayed in public records en 
masse, we found that millions of SSNs are still subject to exposure on 
individual identity cards issued under federal auspices. We found that 
in 2004 an estimated 42 million Medicare cards displayed entire 9-digit 
SSNs, as did approximately 8 million Department of Defense (DOD) 
insurance cards and 7 million Department of Veterans Affairs (VA) 
beneficiary cards. Some of these agencies have begun taking action to 
remove SSNs from identification cards. For example, VA is eliminating 
SSNs from 7 million VA identification cards and is replacing cards with 
SSNs or issuing new cards without SSNs from 2004 through 2009, until 
all such cards have been replaced. DOD has begun replacing 
approximately 6 million health insurance cards that display SSNs with 
cards that do not display the bearer's SSN, but continues to include 
SSNs on approximately 8 million military identification cards. The 
Centers for Medicare and Medicaid Services, with the largest number of 
cards displaying the entire 9-digit SSN, does not plan to remove the 
SSN from Medicare identification cards.

GAO Has Proposed Matters for Congressional Consideration and 
        Recommendations
    In order to address the issues we found, GAO has proposed matters 
for congressional consideration and recommended that a federal agency 
take action. To date, OMB has implemented two of our three 
recommendations, but Congress is still considering what other actions 
to take.

      In order to address the problems we found with how 
government entities assure the security of SSNs, we proposed that 
Congress consider convening a representative group of federal, state, 
and local officials to develop a unified approach to safeguarding SSNs 
used in all levels of government. The Privacy Act and other federal 
laws prescribe actions federal departments and agencies must take to 
assure the security of SSNs and other personal information. However, 
these requirements may not be uniformly observed. We presented a matter 
for congressional consideration to facilitate intergovernmental 
collaboration in strengthening safeguards at the state and local 
levels. We also made two recommendations to the Office of Management 
and Budget that it direct federal agencies to review their practices 
for securing SSNs and providing required information, and advise all 
federal, state, and local governments of the applicability of the 
Privacy Act to their uses of SSNs. OMB has implemented both our 
recommendations.
      In our report on third party contactors' uses of SSNs, we 
recommended that Congress consider possible options for addressing the 
gaps in existing federal requirements for safeguarding SSNs shared with 
contractors. The current gaps do not provide incentives for companies 
to commit to protecting personal information. Each industry is subject 
to different federal oversight and is often left to decide what 
established practices for safeguarding SSNs and other consumer 
information it wishes to follow. We suggested that one approach 
Congress could take would be to require industry-specific protections 
for the sharing of SSNs with contractors where such measures are not 
already in place. For example, Congress could consider whether the 
Telecommunications Act of 1996 should be amended to address how that 
industry shares SSNs with contractors. Alternatively, we suggested that 
Congress could take a broader approach. For example, in considering 
proposed legislation that would generally restrict the use and display 
of SSNs, Congress could also include a provision that would explicitly 
apply this restriction to third party contractors. We stated that with 
either approach, Congress would want to establish a mechanism 
overseeing compliance by contractors and enforcement.
      In our report on the display of SSNs on identification 
cards and in public records, we recommended that OMB identify all those 
federal activities that require or engage in the display of 9-digit 
SSNs on health insurance, identification, or any other cards issued to 
federal government personnel or program beneficiaries, and devise a 
governmentwide policy to ensure a consistent approach to this type of 
display. Although SSA has authority to issue policies and procedures 
over the Social Security cards that it issues, it does not have 
authority over how other federal agencies use and display SSNs. Rather, 
it is up to individual government agencies to have their own policies 
for the cards issued under their authority. The lack of a broad, 
uniform policy allows for inconsistent, but persistent exposure of the 
SSN. OMB has not yet taken action on our recommendation but said at the 
time we issued our report they would consider it. With regard to SSN 
exposure in public records, we again noted that it would be 
constructive for a representative group of federal, state, and local 
officials to develop a unified approach to safeguarding SSNs used in 
all levels of government, particularly those displayed in public 
records.
      Finally, with regard to private sector entities, such as 
information resellers reselling personal information, including SSNs, 
we noted that there are few restrictions placed on these entities 
ability to obtain, use, and resell SSNs for their businesses. The 
federal laws that have some restrictions can be interpreted broadly. 
The broad interpretation combined with the uncertainty about the 
application of the exceptions suggest that reselling personal 
information--including SSNs--is likely to continue.
Conclusions
    The use of SSNs by both public and private sector entities is 
likely to continue given that it is used as the key identifier by most 
of these entities and there is currently no other widely accepted 
alternative. Given the significance of the SSN in committing fraud or 
stealing a person's identity, it is imperative that steps be taken to 
protect it. Without proper safeguards in place, SSNs will remain 
vulnerable to misuse, thus adding to the growing number of identity 
theft victims.
    SSNs are still widely used and publicly available, although 
becoming less so. State legislatures have begun to place restrictions 
on SSNs by enacting laws that restrict the use and display of SSNs and 
prohibit the theft of individuals' personal information. Yet, more 
could be done to protect SSNs. As Congress continues to propose and 
consider legislation to protect individuals' personal information, gaps 
in protections that have already been identified could help focus the 
debate on the areas that could be addressed immediately based on our 
work in order to prevent SSNs and other personal information from being 
misused.
    At this Subcommittee's request, we are continuing work on SSNs and 
the ease with which they can be purchased from Internet information 
resellers. We look forward to supporting continued congressional 
consideration of these important policy issues. That concludes my 
testimony, and I would be pleased to respond to any questions the 
subcommittee has.

     Appendix I: Selected State SSN Laws Previously Reported by GAO
------------------------------------------------------------------------
             Type of Law                        Enacting States
------------------------------------------------------------------------
Imposes Limits on State and Local      Connecticut
 Governments, including Restrictions   Delaware
 on Public Disclosure                  Florida
                                       Georgia
                                       Hawaii
                                       Indiana
                                       Minnesota
                                       Nebraska
                                       Nevada
                                       New Jersey
                                       North Dakota
                                       Oregon
                                       South Carolina
                                       Tennessee
                                       Texas
                                       Virginia
                                       West Virginia
------------------------------------------------------------------------
Limits Use and Display of SSNs         Arizona
                                       Arkansas
                                       California
                                       Connecticut
                                       Georgia
                                       Illinois
                                       Maryland
                                       Michigan
                                       Minnesota
                                       Missouri
                                       Oklahoma
                                       Texas
                                       Utah
                                       Virginia
------------------------------------------------------------------------
Limits Use of SSNs on Drivers'         Indiana
 Licenses                              North Dakota
                                       South Dakota
                                       West Virginia
------------------------------------------------------------------------
Requires Notification of Security      California
 Breaches                              Georgia
                                       Nevada
                                       New York
------------------------------------------------------------------------
Prohibits Certain Activities Related   Arizona
 to Identity Theft                     Idaho
                                       New York
------------------------------------------------------------------------
Limits or Prohibits Use of SSN as      Arkansas
 Student ID Number                     Colorado
                                       Wisconsin
------------------------------------------------------------------------
Authorizes Redaction of SSNs in        California
 Certain Public Records                New Jersey
------------------------------------------------------------------------
Limits Certain Activities of           North Dakota
 Financial Institutions                Vermont
------------------------------------------------------------------------
Prohibits Businesses From Requiring    New Mexico
 SSNs as a Condition of Doing          Rhode Island
 Business
------------------------------------------------------------------------
Requires Development of Employee       New Mexico
 Access Policies
------------------------------------------------------------------------
Requires Business to Properly Dispose  Texas
 of Business Records Containing
 Customers' Personal Information
------------------------------------------------------------------------
Provides Identity Theft Victim         Washington
 Assistance
------------------------------------------------------------------------
Requires that SSNs be Truncated for    Louisiana
 Certain Public Records
------------------------------------------------------------------------
Requires Third Party Contracting       California
 Protections
------------------------------------------------------------------------
Source: GAO Analysis

Related GAO Products
    Social Security Numbers: Stronger Protections Needed When 
Contractors Have Access to SSNs. GAO-06-238. Washington, D.C.: January 
23, 2006.
    Social Security Numbers: Federal and State Laws Restrict Use of 
SSNs, yet Gaps Remain. GAO-05-1016T. Washington, D.C.: September 15, 
2005.
    Social Security Numbers: Governments Could Do More to Reduce 
Display in Public Records and on Identity Cards. GAO-05-59. Washington, 
D.C.: November 9, 2004.
    Social Security Numbers: Use Is Widespread and Protections Vary in 
Private and Public Sectors. GAO-04-1099T. Washington, D.C.: September 
28, 2004.
    Social Security Numbers: Use Is Widespread and Protections Vary. 
GAO-04-768T. Washington, D.C.: June 15, 2004.
    Social Security Numbers: Private Sector Entities Routinely Obtain 
and Use SSNs, and Laws Limit the Disclosure of This Information. GAO-
04-11. Washington, D.C.: January 22, 2004.
    Social Security Numbers: Ensuring the Integrity of the SSN. GAO-03-
941T. Washington, D.C.: July 10, 2003.
    Social Security Numbers: Government Benefits from SSN Use but Could 
Provide Better Safeguards. GAO-02-352. Washington, D.C.:May 31, 2002.
    Social Security: Government and Commercial Use of the Social 
Security Number is Widespread. GAO/HEHS-99-28. Washington, D.C.: 
February 16, 1999.

                                 

    Chairman MCCRERY. Thank you, Ms. Fagnoni. Mr. Winston?

  STATEMENT OF JOEL WINSTON, ASSOCIATE DIRECTOR, DIVISION OF 
PRIVACY AND IDENTITY PROTECTION, BUREAU OF CONSUMER PROTECTION, 
                    FEDERAL TRADE COMMISSION

    Mr. WINSTON. Mr. Chairman, Mr. Levin, Members of the 
Subcommittee, I am Joel Winston, Associate Director of the 
Division of Privacy and Identity Protection at the Federal 
Trade Commission (FTC). I appreciate the opportunity to testify 
today about the important issue of SSNs and their relation to 
identity theft. Although the views expressed in the written 
testimony represent those of the Commission, my oral 
presentation and responses to your questions are my own and do 
not necessarily represent the opinions of the Commission or any 
individual Commissioner.
    Americans today are very concerned about protecting their 
identities, and with good reason. Identity theft is a 
pernicious and persistent problem. When a thief steals your 
identity, the economic and emotional impact can be severe. 
American businesses pay a heavy price, as well, as much as $50 
billion every year. Every time consumers hear about the latest 
data breach that threatens to expose their personal 
information, they lose a little more confidence in our 
commercial system.
    Access to SSNs contributes to the worst form of identity 
theft, having new accounts opened in your name. The SSN has 
become an all-purpose identifier because of its convenience, 
its uniqueness to each individual, and its permanence over 
time. Many businesses also use the SSN to authenticate that the 
person presenting it is who he says he is. It is this dual use 
that makes the SSN so valuable to identity thieves.
    At the same time, the SSN serves many important functions 
in our financial system. For example, our credit reporting 
system hinges on the availability of SSNs to match consumers 
with their financial information. SSNs also are used to locate 
lost beneficiaries, collect child support, and detect fraud, 
among many other things.
    This presents a challenge, how to find the right balance 
between permitting beneficial use and disclosure of SSNs while 
keeping them out of the hands of criminals. The solution must 
combine a number of approaches. To begin with, public and 
private entities should use less sensitive identifiers whenever 
possible and they must do a better job of securing consumer 
data. This is a fundamental legal responsibility. Under the 
Federal Trade Commission Act, the Commission can act against 
firms that misrepresent their security procedures or fail to 
take reasonable steps to secure sensitive information. The FTC 
Safeguards Rule requires financial institutions to implement 
reasonable safeguards to protect consumer information. The FTC 
Disposal Rule requires businesses that hold certain consumer 
information to dispose of it in a safe manner.
    The Commission has acted aggressively to enforce these 
legal requirements. Our two most recent cases involved massive 
data breaches that led to numerous instances of identity fraud. 
In both cases, the Commission alleged that the company failed 
to have reasonable procedures to safeguard consumer 
information, including in one of the cases SSNs.
    In addition to law enforcement, education and outreach are 
critical weapons in this fight. The Commission has targeted its 
efforts at the three groups best situated to combat identity 
theft, consumers, industry, and law enforcement. We receive 
between 15,000 and 20,000 contacts per week from individuals 
seeking advice on avoiding identity theft or coping with the 
consequences. We provide information and assistance, including 
tools to simplify the recovery process.
    We are working to implement the provisions of the Fair and 
Accurate Credit Transactions Act of 2003 Act (P.L. 108-159) 
(FACT Act), many of which address identity theft. The free 
annual credit report program, for example, has allowed millions 
of consumers to obtain and check their credit reports, where 
the first signs of identity fraud often appear.
    The Commission also works with the business community to 
promote a culture of security. Our outreach efforts encourage 
and help businesses to maintain only the information that they 
need and to protect the information that they maintain.
    Finally, the Commission assists criminal law enforcement 
through our operation of the ID Theft Data Clearinghouse, a 
national database with over a million identity theft 
complaints. Law enforcers, ranging from the FBI to local 
sheriffs, use the clearinghouse to aid in their investigation.
    In closing, I want to emphasize that identity theft is a 
multi-faceted problem for which there is no simple solution. 
The challenge of determining how best to keep SSNs out of the 
hands of wrongdoers illustrates how difficult this problem is. 
Still, there is much that we can do to discourage unnecessary 
use of SSNs, enhance data protection, educate consumers, and 
assist criminal prosecutors. The Commission will continue to 
play a central role in the fight against identity theft and we 
look forward to working with the Congress in this endeavor.
    Thank you again for the opportunity to testify today and I 
would be happy to answer any questions.
    [The prepared statement of Mr. Winston follows:]

Statement of Joel Winston, Associate Director, Division of Privacy and 
   Identity Protection, Bureau of Consumer Protection, Federal Trade 
                               Commission

I. INTRODUCTION
    Mr. Chairman, Mr. Levin, and members of the Subcommittee, I am Joel 
Winston, Associate Director of the Division of Privacy and Identity 
Protection at the Federal Trade Commission (``FTC'' or 
``Commission'').\1\ I appreciate the opportunity to present the 
Commission's views on identity theft and Social Security numbers 
(``SSNs'').
---------------------------------------------------------------------------
    \1\ The views expressed in this statement represent the views of 
the Commission. My oral presentation and responses to questions are my 
own and do not necessarily represent the views of the Commission or any 
Commissioner.
---------------------------------------------------------------------------
    The Commission has a broad mandate to protect consumers generally 
and to combat identity theft specifically. Controlling identity theft 
is an issue of critical concern to all consumers--and to the 
Commission. The FTC serves a key role as the central repository for 
identity theft complaints, facilitates criminal law enforcement in 
detecting and prosecuting identity thieves, and provides extensive 
victim assistance and consumer education. In recognition of the need to 
protect sensitive consumer information and prevent identity theft, the 
FTC recently created a new Division of Privacy and Identity Protection. 
This division--which consists of staff with expertise in privacy, data 
security, and identity theft--addresses cutting-edge consumer privacy 
matters through aggressive enforcement, as well as rulemaking, policy 
development, and outreach to consumers and businesses.
     This testimony describes the ways in which SSNs are collected and 
used, their relationship to identity theft, current laws that restrict 
the use or transfer of consumers' personal information, and the 
Commission's efforts to help consumers avoid identity theft or 
remediate its consequences.

II. THE IDENTITY THEFT PROBLEM
    Identity theft is a pernicious crime that harms both consumers and 
businesses. Recent surveys estimate that nearly 10 million consumers 
are victimized by some form of identity theft each year.\2\ The costs 
of this crime are staggering. The Commission's 2003 survey estimated 
that identity theft cost businesses approximately $50 billion, and cost 
consumers an additional $5 billion in out-of-pocket expenses, over the 
twelve-month period prior to the survey.\3\ The 2003 survey looked at 
two major categories of identity theft: (1) misuse of existing 
accounts; and (2) the creation of new accounts in the victim's name. 
The 2003 survey found that the costs imposed by new account fraud were 
substantially higher than the misuse of existing accounts.\4\
---------------------------------------------------------------------------
    \2\ See Federal Trade Commission--Identity Theft Survey Report 
(2003), http://www.ftc.gov/os/2003/09/synovatereport.pdf and Rubina 
Johannes, 2006 Identity Fraud Survey Report (2006), http://
www.javelinstrategy.com/research. A free summary of the 2006 Identity 
Fraud Survey Report is available at http://www.bbb.org/alerts/
article.asp?ID=651.
    \3\ Federal Trade Commission--Identity Theft Survey Report at 6 
(2003), http://www.ftc.gov/os/2003/09/synovatereport.pdf.
    \4\ Id.
---------------------------------------------------------------------------
III. USES AND SOURCES OF SOCIAL SECURITY NUMBERS
     SSNs today play a vital role in our economy. With 300 million 
American consumers, many of whom share the same name,\5\ the unique 9-
digit SSN is a key identification tool for businesses, government, and 
others.\6\ For example, consumer reporting agencies use SSNs to ensure 
that the data furnished to them is placed in the correct file and that 
they are providing a credit report on the correct consumer.\7\ 
Businesses and other entities use these reports to evaluate the risk of 
providing to individuals services, such as credit, insurance, home 
rentals, or employment. Timely access to consumer credit, as well as 
the overall accuracy of credit reporting files, could be compromised if 
SSNs could not be used to match consumers to their financial 
information. Additionally, SSNs are used in locator databases to find 
lost beneficiaries, potential witnesses, and law violators, and to 
collect child support and other judgments. SSN databases also are used 
to fight identity fraud--for example, to confirm that an SSN provided 
by a loan applicant does not, in fact, belong to someone who is 
deceased.\8\ Without the ability to use SSNs as a personal identifier 
and fraud prevention tool, the granting of credit and the provision of 
other financial services would become riskier and more expensive and 
inconvenient for consumers.
---------------------------------------------------------------------------
    \5\ According to the Consumer Data Industry Association, 14 million 
Americans have one of ten last names, and 58 million men have one of 
ten first names.
    \6\ See General Accounting Office, Private Sector Entities 
Routinely Obtain and Use SSNs, and Laws Limit the Disclosure of This 
Information (GAO 04-01) (2004).
    \7\ See Federal Trade Commission--Report to Congress Under Sections 
318 and 319 of the Fair and Accurate Credit Transactions Act of 2003 at 
38-40 (2004),http://www.ftc.gov/reports/facta/041209factarpt.pdf.
    \8\ The federal government also uses the SSN as an identifier, for 
example, as both an individual's Medicare and taxpayer identification 
number. It also is used to administer the federal jury system, federal 
welfare and workmen's compensation programs, and military draft 
registration. See Social Security Administration, Report to Congress on 
Options for Enhancing the Social Security Card (Sept. 1997), 
www.ssa.gov/history/reports/ssnreportc2.html.
---------------------------------------------------------------------------
    SSNs are available from both public and private sources. Public 
records in city and county government offices across the country, 
including birth and death records, property records, tax lien records, 
voter registrations, licensing records, and court records, often 
contain consumers' SSNs.\9\ Increasingly, these records are being 
placed online where they can be accessed easily and anonymously.\10\ 
There also are a number of private sources of SSNs, including consumer 
reporting agencies that include name, address, and SSN as part of the 
``credit header'' information on consumer reports. Data brokers also 
collect personal information, including SSNs, from a variety of sources 
and compile and resell that data to third parties.\11\
---------------------------------------------------------------------------
    \9\ Local and state governments are reducing their reliance on SSNs 
for many administrative purposes in response to identity theft 
concerns. For example, only a few states still use SSNs as drivers 
license numbers. See David A. Lieb, Millions of Motorists Have Social 
Security Numbers on Licenses, The Boston Globe, Feb. 6, 2006, http://
www.boston.com/news/local/massachusetts/articles/2006/02/06/
millions_of_motorists_have_social_security_numbers_on_licenses/. In 
some cases, however, governments still use SSNs as identifiers when it 
is not essential to do so. See Mark Segraves, Registering to Vote May 
Lead to Identity Theft, WTOP Radio, Mar. 22, 2006, http://www.wtop.com/
?nid=428&sid=733727.
    \10\ Improved access to public records has important public policy 
benefits, but at the same time raises privacy concerns. Some public 
records offices redact sensitive information such as SSNs, but doing so 
can be very costly. The Commission has recognized the sensitive nature 
of SSNs, even when they are contained in publicly available records. 
For example, in response to a comment on the DSW order, the Commission 
stated that ``[C]ertain publicly available records, such as court 
records, contain Social Security numbers and other highly sensitive 
information that can be used to perpetrate identity theft.'' The 
Commission response letter is available at http://www.ftc.gov/os/
caselist/0523096/0523096DSW LettertoCommenter BankofAmerica.pdf.
    \11\ Some data brokers have announced that they are voluntarily 
restricting the sale of SSNs and other sensitive information to those 
with a demonstrable and legitimate need. See Social Security Numbers 
Are for Sale Online, Newsmax.com, Apr. 5, 2005, http://www.newsmax.com/
archives/articles/2005/4/4/155759.shtml.
---------------------------------------------------------------------------
    The misuse of SSNs, however, can facilitate identity theft. For 
example, new account fraud--the most serious form of identity theft--is 
often possible only if the thief obtains the victim's SSN. The 
challenge is to find the proper balance between the need to keep SSNs 
out of the hands of identity thieves, while giving businesses and 
government entities sufficient means to attribute information to the 
correct person. Restrictions on disclosure of SSNs also could have a 
broad impact on such important purposes as public health, criminal law 
enforcement, and anti-fraud and anti-terrorism efforts. Moreover, as 
referenced above, regulation or restriction of the availability of SSNs 
in public records poses substantial policy and practical concerns.
IV. CURRENT LAWS RESTRICTING THE USE OF DISCLOSURE OF SOCIAL SECURITY 
        NUMBERS
    There are a variety of specific statutes and regulations that 
restrict disclosure of certain consumer information, including SSNs, in 
certain contexts. In addition, under some circumstances, entities are 
required to have procedures in place to ensure the security and 
integrity of sensitive consumer information such as SSNs. Three 
statutes that protect SSNs from improper access fall within the 
Commission's jurisdiction: Title V of the Gramm-Leach-Bliley Act 
(``GLBA'');\12\ Section 5 of the Federal Trade Commission Act (``FTC 
Act'');\13\ and the Fair and Accurate Credit Transactions Act of 2003 
(``FACT Act''),\14\ amending the Fair Credit Reporting Act 
(``FCRA'').\15\
---------------------------------------------------------------------------
    \12\ 15 U.S.C.  6801-09.
    \13\ 15 U.S.C.  45(a).
    \14\ Pub. L. No. 108-159, 117 Stat. 1952.
    \15\ 15 U.S.C.  1681-1681x, as amended.
---------------------------------------------------------------------------
A. The Gramm-Leach-Bliley Act
    The Gramm-Leach-Bliley Act (``GLBA'') imposes privacy and security 
obligations on ``financial institutions.''\16\ Financial institutions 
are defined broadly as those entities engaged in ``financial 
activities'' such as banking, lending, insurance, loan brokering, and 
credit reporting.\17\
---------------------------------------------------------------------------
    \16\ 15 U.S.C.  6809(3)(A).
    \17\ 12 C.F.R.  225.28, 225.86.
---------------------------------------------------------------------------
1. Privacy of Consumer Financial Information
    In general, financial institutions are prohibited by Title V of the 
GLBA\18\ from disclosing nonpublic personal information, including 
SSNs, to non-affiliated third parties without first providing consumers 
with notice and the opportunity to opt out of the disclosure.\19\ 
However, the GLBA includes a number of statutory exceptions under which 
disclosure is permitted without having to provide notice and an opt-
out. These exceptions include consumer reporting (pursuant to the 
FCRA), fraud prevention, law enforcement and regulatory or self-
regulatory purposes, compliance with judicial process, and public 
safety investigations.\20\ Entities that receive information under an 
exception to the GLBA are subject to the reuse and redisclosure 
restrictions of the GLBA Privacy Rule, even if those entities are not 
themselves financial institutions.\21\ In particular, the recipients 
may only use and disclose the information ``in the ordinary course of 
business to carry out the activity covered by the exception under which 
. . . the information [was received].''\22\
---------------------------------------------------------------------------
    \18\ Privacy of Consumer Financial Information, 16 C.F.R. Part 313 
(``GLBA Privacy Rule'').
    \19\ The GLBA defines ``nonpublic personal information'' as any 
information that a financial institution collects about an individual 
in connection with providing a financial product or service to an 
individual, unless that information is otherwise publicly available. 
This includes basic identifying information about individuals, such as 
name, SSN, address, telephone number, mother's maiden name, and prior 
addresses.  See, e.g., 65 Fed. Reg. 33,646, 33,680 (May 24, 2000) (the 
FTC's Privacy Rule).
    \20\ 15 U.S.C.  6802(e).
    \21\ 16 C.F.R.  313.11(a).
    \22\ Id.
---------------------------------------------------------------------------
    Entities can obtain SSNs from consumer reporting agencies, 
generally from the credit header data on the credit report. However, 
because credit header data is typically derived from information 
originally provided by financial institutions, entities that receive 
this information generally are limited by the GLBA's reuse and 
redisclosure provision.
2. Required Safeguards for Customer Information
    The GLBA also requires financial institutions to implement 
appropriate physical, technical, and procedural safeguards to protect 
the security and integrity of the information they receive from 
customers, whether directly or from other financial institutions.\23\ 
The FTC's Safeguards Rule, which implements these requirements for 
entities under FTC jurisdiction,\24\ requires financial institutions to 
develop a written information security plan that describes their 
procedures to protect customer information. Given the wide variety of 
entities covered, the Safeguards Rule requires a plan that accounts for 
each entity's particular circumstances--its size and complexity, the 
nature and scope of its activities, and the sensitivity of the customer 
information it handles. It also requires covered entities to take 
certain procedural steps (for example, designating appropriate 
personnel to oversee the security plan, conducting a risk assessment, 
and overseeing service providers) in implementing their plans.\25\
---------------------------------------------------------------------------
    \23\ 15 U.S.C.  6801(b); Standards for Safeguarding Customer 
Information, 16 C.F.R. Part 314 (``Safeguards Rule'').
    \24\ The Federal Deposit Insurance Corporation, the National Credit 
Union Administration (``NCUA''), the Securities and Exchange 
Commission, the Office of the Comptroller of the Currency, the Board of 
Governors of the Federal Reserve System, the Office of Thrift 
Supervision, and state insurance authorities have promulgated 
comparable information safeguards rules, as required by Section 501(b) 
of the GLBA. 15 U.S.C.  6801(b); see, e.g., Interagency Guidelines 
Establishing Standards for Safeguarding Customer Information and 
Rescission of Year 2000 Standards for Safety and Soundness, 66 Fed. 
Reg. 8,616-41 (Feb. 1, 2001). The FTC has jurisdiction over entities 
not subject to the jurisdiction of these agencies.
    \25\ The Commission previously has recommended that Congress 
consider whether companies that hold sensitive consumer data, for 
whatever purpose, should be required to take reasonable measures to 
ensure its safety. Such a requirement could extend the FTC's existing 
GLBA Safeguards Rule to companies that are not financial institutions. 
See Statement of Federal Trade Commission Before the Committee on 
Commerce, Science, and Transportation, U.S. Senate, on Data Breaches 
and Identity Theft (June 16, 2005) at 7, http://www.ftc.gov/os/2005/06/
050616databreaches.pdf.
---------------------------------------------------------------------------
B. Section 5 of the FTC Act
    Section 5 of the FTC Act prohibits ``unfair or deceptive acts or 
practices in or affecting commerce.''\26\ Under the FTC Act, the 
Commission has broad jurisdiction over a wide variety of entities and 
individuals operating in commerce. Prohibited practices include making 
deceptive claims about one's privacy procedures, including claims about 
the security provided for consumer information.\27\
---------------------------------------------------------------------------
    \26\ 15 U.S.C.  45(a).
    \27\ Deceptive practices are defined as material representations or 
omissions that are likely to mislead consumers acting reasonably under 
the circumstances. Cliffdale Associates, Inc., 103 F.T.C. 110 (1984).
---------------------------------------------------------------------------
    In addition to deception, the FTC Act prohibits unfair practices. 
Practices are unfair if they cause or are likely to cause consumers 
substantial injury that is neither reasonably avoidable by consumers 
nor offset by countervailing benefits to consumers or competition.\28\ 
The Commission has used this authority to challenge a variety of 
injurious practices, including companies' failure to provide reasonable 
and appropriate security for sensitive customer data.\29\ The 
Commission can obtain injunctive relief for violations of Section 5, as 
well as consumer redress or disgorgement in appropriate cases.
---------------------------------------------------------------------------
    \28\ 15 U.S.C.  45(n).
    \29\ Other practices include, for example, allegations of 
unauthorized charges in connection with ``phishing,'' high-tech scams 
that use spam or pop-up messages to deceive consumers into disclosing 
credit card numbers, bank account information, SSNs, passwords, or 
other sensitive information.  See FTC v. Hill, No. H 03-5537 (filed 
S.D. Tex. Dec. 3, 2003), http://www.ftc.gov/opa/2004/03/
phishinghilljoint.htm; FTC v. C.J., No. 03-CV-5275-GHK (RZX) (filed 
C.D. Cal. July 24, 2003), http://www.ftc.gov/os/2003/07/
phishingcomp.pdf.
---------------------------------------------------------------------------
C. The Fair and Accurate Credit Transactions Act of 2003
    The FACT Act amended the FCRA to include a number of provisions 
designed to increase the protection of sensitive consumer information, 
including SSNs. One such provision required the banking regulatory 
agencies, the NCUA, and the Commission to promulgate a coordinated rule 
designed to prevent unauthorized access to consumer report information 
by requiring all users of such information to have reasonable 
procedures to dispose of it properly and safely.\30\ This Disposal 
Rule, which took effect on June 1, 2005, should help minimize the risk 
of improper disclosure of SSNs.
---------------------------------------------------------------------------
    \30\ 16 C.F.R. Part 382 (``Disposal of Consumer Report Information 
and Record Rule'').
---------------------------------------------------------------------------
    In addition, the FACT Act requires consumer reporting agencies to 
truncate the SSN on consumer reports at the consumer's request.\31\ 
Eliminating the unnecessary display of this information could lessen 
the risk of it getting into the wrong hands.
---------------------------------------------------------------------------
    \31\ 15 U.S.C.  1681g(a)(1)(A). The FTC advises consumers of this 
right through its consumer outreach initiatives. See e.g., the FTC's 
identity theft prevention and victim recovery guide, Take Charge: 
Fighting Back Against Identity Theft at 5 (2005), available at http://
www.ftc.gov/bcp/conline/pubs/credit/idtheft.pdf.
---------------------------------------------------------------------------
D. Other Laws
    Other federal laws not enforced by the Commission regulate certain 
other specific classes of information, including SSNs. For example, the 
Driver's Privacy Protection Act (``DPPA'') \32\ prohibits state motor 
vehicle departments from disclosing personal information in motor 
vehicle records, subject to fourteen ``permissible uses,'' including 
law enforcement, motor vehicle safety, and insurance. The Health 
Information Portability and Accountability Act (``HIPAA'') and its 
implementing privacy rule prohibit the disclosure to third parties of a 
consumer's medical information without prior consent, subject to a 
number of exceptions (such as, for the disclosure of patient records 
between entities for purposes of routine treatment, insurance, or 
payment).\33\ Like the GLBA Safeguards Rule, the HIPAA Privacy Rule 
also requires entities under its jurisdiction to have in place 
``appropriate administrative, technical, and physical safeguards to 
protect the privacy of protected health information.'' \34\
---------------------------------------------------------------------------
    \32\ 18 U.S.C.  2721-25.
    \33\ 45 C.F.R. Part 164 (``HIPAA Privacy Rule'').
    \34\ 45 C.F.R.  164.530(c).
---------------------------------------------------------------------------
E. FTC Enforcement Actions
    Over the past year or so, reports have proliferated about 
information compromises at U.S. businesses, universities, government 
agencies, and other organizations that collect and store sensitive 
consumer information, including SSNs. Some of these incidents 
reportedly have led to identity theft, confirming that security 
breaches can cause real and tangible harm to consumers, businesses, and 
other institutions.
    Since 2001, the Commission has brought twelve cases challenging 
businesses that have failed to take reasonable steps to protect 
sensitive consumer information in their files.\35\ Two of the 
Commission's most recent law enforcement actions arose from high-
profile data breaches that occurred last year. In the first case, the 
Commission alleged that a major data broker, ChoicePoint, Inc., failed 
to use reasonable procedures to screen prospective subscribers and 
monitor their access to sensitive consumer data, in violation of the 
FCRA \36\ and the FTC Act.\37\ The Commission's complaint alleged that 
ChoicePoint's failures allowed identity thieves to obtain access to the 
personal information of over 160,000 consumers, including nearly 10,000 
consumer reports. In settling the case, ChoicePoint agreed to pay $10 
million in civil penalties for the FCRA violations--the highest civil 
penalty ever levied in a consumer protection case--and $5 million in 
consumer redress for identity theft victims. The Order also requires 
ChoicePoint to implement a number of strong data security measures, 
including bi-annual audits to ensure that these security measures are 
in place.
---------------------------------------------------------------------------
    \35\ Documents related to these enforcement actions generally are 
available at http://www.ftc.gov/privacy/index.html.
    \36\ 15 U.S.C.  1681-1681x, as amended. The FCRA specifies that 
consumer reporting agencies may only provide consumer reports for 
certain ``permissible purposes.'' ChoicePoint allegedly approved as 
customers individuals whose applications had several indicia of fraud, 
including false credentials, the use of commercial mail drops as 
business addresses, and multiple applications faxed from the same 
public commercial location. The FTC's complaint alleged that 
ChoicePoint did not have a permissible purpose in providing consumer 
reports to such individuals and failed to have reasonable procedures to 
verify prospective subscribers.
    \37\ United States v. ChoicePoint, Inc., No. 106-CV-0198 (N.D. Ga. 
Feb. 15, 2006).
---------------------------------------------------------------------------
    In the second action, the Commission reached a settlement with 
CardSystems Solutions, Inc., the card processor allegedly responsible 
for last year's breach of credit and debit card information for Visa 
and MasterCard, which exposed tens of millions of consumers' credit and 
debit numbers.\38\ This case addresses the largest known compromise of 
sensitive financial data to date. As in the ChoicePoint case, the FTC 
alleged that CardSystems engaged in a number of practices that, taken 
together, failed to provide reasonable and appropriate security for 
sensitive consumer data. These settlements provide important 
protections for consumers and also provide important lessons for 
industry about the need to safeguard consumer information.
---------------------------------------------------------------------------
    \38\ In the Matter of CardSystems Solutions, Inc., FTC File No. 
052-3148 (proposed settlement posted for public comment, Feb. 23, 
2006). The settlement requires CardSystems and its successor 
corporation to implement a comprehensive information security program 
and obtain audits by an independent third-party professional every 
other year for 20 years. As noted in the FTC's press release, 
CardSystems faces potential liability in the millions of dollars under 
bank procedures and in private litigation for losses related to the 
breach.
---------------------------------------------------------------------------
V. THE COMMISSION'S EFFORTS TO COMBAT IDENTITY THEFT
    In addition to our efforts to ensure that businesses take 
reasonable steps to safeguard sensitive consumer information, the 
Commission works in many other ways to address the identity theft 
problem. Pursuant to the 1998 Identity Theft Assumption and Deterrence 
Act (``the Identity Theft Act''),\39\ the Commission has implemented a 
program that assists consumers, businesses, and other law enforcers.
---------------------------------------------------------------------------
    \39\ Pub. L. No. 105-318, 112 Stat. 3007 (1998) (codified at 18 
U.S.C.  1028).
---------------------------------------------------------------------------
A. Working with Consumers
    The Commission hosts a toll-free hotline, 1-877-ID THEFT, and a 
secure online complaint form on its website, www.consumer.gov/idtheft, 
for consumers concerned about identity theft. Every week, the 
Commission receives about 15,000 to 20,000 contacts from victims and 
consumers seeking information on how to avoid identity theft. The 
callers to the hotline receive counseling from trained personnel who 
provide information on steps they can take both to prevent identity 
theft and to resolve problems resulting from the misuse of their 
identities. Victims are advised to: (1) obtain copies of their credit 
reports and have a fraud alert placed on them;\40\ (2) contact each of 
the creditors or service providers with which the thief has established 
or accessed an account to request that the account be closed and to 
dispute any associated charges; and (3) report the theft to the police 
and, if possible, obtain a police report. The police report is useful 
in demonstrating to purported creditors and debt collectors that the 
consumer is a victim of identity theft, and serves as an ``identity 
theft report'' that can be used for exercising various victims' rights 
granted by the FACT Act.\41\ The Commission's identity theft website, 
www.consumer.gov/idtheft, has an online complaint form where victims 
can enter their complaints into the Clearinghouse.
---------------------------------------------------------------------------
    \40\ The FACT Act added a requirement that consumer reporting 
agencies, at the request of a consumer, place a fraud alert on the 
consumer's credit report. Consumers may obtain an initial alert if they 
have a good faith suspicion that they have been or are about to become 
an identity theft victim. The initial alert must stay on the file for 
at least 90 days. Actual victims who submit an identity theft report 
can obtain an extended alert, which remains in effect for up to seven 
years. Fraud alerts require users of consumer reports who are extending 
credit or related services to take certain steps to verify the 
consumer's identity. See 15 U.S.C.  1681c-1.
    \41\ These include the right to an extended fraud alert, the right 
to block fraudulent trade lines on credit reports and to prevent such 
trade lines from being furnished to a consumer reporting agency, and 
the ability to obtain copies of fraudulent applications and transaction 
reports. See 15 U.S.C.  1681 et seq., as amended.
---------------------------------------------------------------------------
    The Commission also has taken the lead in developing and 
disseminating identity theft-related consumer education materials, 
including an identity theft primer, ID Theft: What It's All About, and 
a victim recovery guide, Take Charge: Fighting Back Against Identity 
Theft. The Commission alone has distributed more than 2.1 million 
copies of the Take Charge booklet (formerly known as ID Theft: When Bad 
Things Happen To Your Good Name) since its release in February 2000 and 
has recorded more than 2.4 million visits to the Web version. The 
Commission also maintains the identity theft website, www.consumer.gov/
idtheft, which provides publications and links to testimony, reports, 
press releases, identity theft-related state laws, and other resources.
    Last fall, the Commission, together with partners from law 
enforcement, the technology industry, and nonprofits, launched OnGuard 
Online, an interactive, multi-media resource for information and up-to-
the minute tools on how to recognize Internet fraud, avoid hackers and 
viruses, shop securely online, and deal with identity theft, spam, 
phishing, and file-sharing.\42\
---------------------------------------------------------------------------
    \42\ See www.onguardonline.gov. OnGuard Online is also available in 
Spanish. See www.AlertaEnLinea.gov.
---------------------------------------------------------------------------
    In addition, the Commission will launch this spring a major new 
identity theft education campaign. The campaign will encourage 
consumers to guard against identity theft by taking steps to reduce 
their risk, keep a close eye on their personal information, and move 
quickly to minimize the damage if identity theft occurs. The 
centerpiece of the campaign will be a turnkey toolkit--a comprehensive 
how-to guide that will help promote grassroots education about identity 
theft.
    The Commission also has developed ways to simplify the recovery 
process. One example is the ID Theft Affidavit, included in the Take 
Charge booklet and on the website. This standard form was developed in 
partnership with industry and consumer advocates for victims to use in 
resolving identity theft debts. To date, the Commission has distributed 
more than 293,000 print copies of the Affidavit and has recorded more 
than 1.1 million hits to the Web version.
B. Working with Industry
    The private sector can play a key role in combating identity theft 
by reducing its incidence through better security and authentication. 
The Commission works with institutions to promote a ``culture of 
security'' by identifying ways to spot risks to the information they 
maintain and keep it safe.
    Among other things, the Commission has disseminated advice for 
businesses on reducing risks to their computer systems\43\ and on 
compliance with the Safeguards Rule.\44\ Our emphasis is on preventing 
breaches before they happen by encouraging businesses to make security 
part of their regular operations and corporate culture. The Commission 
also has published Information Compromise and the Risk of Identity 
Theft: Guidance for Your Business, a booklet on managing data 
compromises.\45\ This publication provides guidance on when it would be 
appropriate for an entity to notify law enforcement and consumers in 
the event of a breach of personal information.
---------------------------------------------------------------------------
    \43\ Security Check: Reducing Risks to Your Computer Systems, 
available at http://www.ftc.gov/bcp/conline/pubs/buspubs/security.htm.
    \44\ Financial Institutions and Customer Data: Complying with the 
Safeguards Rule, available at http://www.ftc.gov/bcp/conline/pubs/
buspubs/safeguards.htm.
    \45\ Information Compromise and the Risk of Identity Theft: 
Guidance for Your Business, available at http://www.ftc.gov/bcp/
conline/pubs/buspubs/idtrespond.pdf.
---------------------------------------------------------------------------
    In 2003, the Commission held a workshop that explored the 
challenges consumers and industry face in securing their computers. 
Titled ``Technologies for Protecting Personal Information: The Consumer 
and Business Experiences,'' the workshop also examined the role of 
technology in meeting these challenges.\46\ Workshop participants, 
including industry leaders, technologists, researchers on human 
behavior, and representatives from consumer and privacy groups, 
identified a range of challenges in safeguarding information and 
proposed possible solutions.
---------------------------------------------------------------------------
    \46\ See workshop agenda and transcripts available at www.ftc.gov/
bcp/workshops/technology. See Staff Report available at http://
www.ftc.gov/bcp/workshops/technology/finalreport.pdf.
---------------------------------------------------------------------------
C. Working with Law Enforcement
    A primary purpose of the Identity Theft Act was to provide law 
enforcement with access to a centralized repository of identity theft 
victim data to support their investigations. The Commission operates 
this database as a national clearinghouse for complaints received 
directly from consumers and through numerous state and federal 
agencies, including the Social Security Administration's Office of 
Inspector General.
    With over 1,060,000 complaints, the Clearinghouse provides a 
detailed snapshot of current identity theft trends as reported by the 
victims themselves. The Commission publishes data annually showing the 
prevalence of complaints broken out by state and city.\47\ Since its 
inception, nearly 1,400 law enforcement agencies have registered for 
access to the Clearinghouse database. Individual investigators within 
those agencies can access the system from their desktop computers 24 
hours a day, seven days a week. The Clearinghouse also gives access to 
training resources, and enables users to coordinate their 
investigations.
---------------------------------------------------------------------------
    \47\ See Federal Trade Commission--National and State Trends in 
Fraud & Identity Theft (Jan. 2006), available at http://
www.consumer.gov/sentinel/pubs/Top10Fraud2005.pdf. The Commission also 
conducts national surveys to learn how identity theft impacts the 
general public. The FTC conducted the first survey in 2003 and is 
conducting a second survey this spring. See Federal Trade Commission--
Identity Theft Survey Report (Sept. 2003), available at http://
www.ftc.gov/os/2003/09/synovatereport.pdf.
---------------------------------------------------------------------------
    The Commission also encourages use of the Clearinghouse through 
training seminars offered to law enforcement. In cooperation with the 
Department of Justice, the U.S. Postal Inspection Service, the U.S. 
Secret Service, and the American Association of Motor Vehicle 
Administrators, the Commission began organizing full-day identity theft 
training seminars for state and local law enforcement officers in 2002. 
To date, this group has held 20 seminars across the country. More than 
2,880 officers have attended these seminars, representing over 1,000 
different agencies. Future seminars are being planned for additional 
cities.
    To further assist law enforcers, the Commission staff developed an 
identity theft case referral program. The staff creates preliminary 
investigative reports by examining patterns of identity theft activity 
in the Clearinghouse, and refers the reports to financial crimes task 
forces and others for further investigation and possible prosecution. 
In addition, analysts from the FBI, U.S. Secret Service, and Postal 
Inspection Service work on-site at the FTC, developing leads and 
supporting ongoing investigations for their agencies.
VI. CONCLUSION
    The crime of identity theft is a scourge, causing enormous damage 
to businesses and consumers. The unauthorized use of consumers' SSNs is 
an important tool of identity thieves, especially those seeking to 
create new accounts in the victim's name. Although current laws place 
some restrictions on the use or disclosure of SSNs by certain entities 
under certain circumstances, this information is still otherwise 
available from both public and private sources, thereby enabling 
identity thieves to obtain SSNs through legal means as well as illegal 
means.
    At the same time, SSNs are an important driver of our market 
system. Businesses and others rely on SSNs to provide many important 
benefits for consumers and to fight identity theft.
    There are a number of things that government, industry, and 
consumers can do to help stem the tide of identity theft. First, both 
government and industry need to consider what information they collect 
and maintain from or about consumers and whether they need to do so. 
Entities that possess sensitive consumer information should continue to 
enhance their procedures to protect it. The Commission will continue 
its law enforcement and outreach efforts to encourage and, when 
necessary, require better protections.
    Second, industry should continue the development of improved fraud 
prevention methods to stop identity thieves from misusing the consumer 
information they have managed to obtain. In this regard, the FACT Act 
should prove instrumental by requiring the bank regulatory agencies, 
the NCUA, and the FTC to develop jointly regulations and guidelines for 
financial institutions and creditors to identify possible risks of 
identity theft.\48\
---------------------------------------------------------------------------
    \48\ 15 U.S.C.  1681m(e).
---------------------------------------------------------------------------
    Third, the Commission will continue and strengthen its efforts to 
empower consumers by providing them with the knowledge and tools to 
protect themselves from identity fraud and to deal with the 
consequences when it does occur. As discussed above, new consumer 
rights granted by the FACT Act should help consumers minimize the 
damage.
    Finally, the Commission will continue to assist criminal law 
enforcement in detecting and prosecuting identity thieves. The prospect 
of serious jail time hopefully will discourage those considering 
identity theft from perpetrating this crime.
    The Commission looks forward to continuing to work with Congress to 
address ways to reduce identity theft.

                                 

    Chairman MCCRERY. Thank you, Mr. Winston. Can you fill us 
in on what your agency does specifically to try to ensure 
compliance with the laws that you talked about in your 
testimony that fall in your jurisdiction?
    Mr. WINSTON. Well, we go about it in many ways. First and 
foremost, we are a law enforcement agency and we investigate 
and take action against companies that violate the laws that we 
enforce, for example, cases against companies that fail to 
safeguard information that they have. We brought 12 cases to 
date. We have a number of others under investigation. I think 
we have sent a pretty clear message to the business community 
that this is an important requirement.
    At the same time, we are strong believers in education, 
both for businesses and consumers. That is always the first 
line of defense and we work very hard in that regard.
    Chairman MCCRERY. Ms. Fagnoni, you talked about the fact 
that many States have enacted laws that restrict the use of 
SSNs. Can you give us an idea of how those actions by States 
affect businesses and commerce in those States and maybe even 
how it affects businesses and commerce across the country?
    Ms. FAGNONI. The work we did, we had more information about 
the impacts on different government activities and the ease of 
getting information. One example of how business and commerce 
has been affected by these laws is that, particularly when a 
State like California, a large State such as California enacts 
a law, for example, the law where any entity where there is a 
security breach involving information, private information, 
personal information from somebody who resides in the State of 
California, the California law is that those individuals have 
to be notified. Some large companies now have on that basis 
made it a practice to notify anyone when there is a security 
breach, regardless of what State they happen to live in, based 
on, perhaps the pressure and the precedent in having certain 
laws in place.
    That is one example where companies have had to adapt and 
adjust to some of those laws. Having different laws in 
different States probably can also cause some challenges for 
people who do business in multiple jurisdictions. As I said, a 
lot of what our studies have shown is that once, whether it is 
government or private entities become more aware of the ways in 
which the SSN can be fraudulently used and they start to take 
actions on their own to better secure the information, they can 
still continue to use the SSN for the purposes that are very 
important to commerce. They have a better sense and a clear 
understanding of the need to protect the exposure of that 
number beyond the uses for which it is needed.
    Chairman MCCRERY. Thank you. Would you talk a little bit 
about the Internet and the availability of SSNs on the 
Internet? Should we be looking at some new Federal laws 
regarding public display of SSNs?
    Ms. FAGNONI. In the work we did looking at government and 
selected private sector use of SSNs, we did not find a large 
percentage of entities that were placing the SSNs on the 
Internet, particularly in the local and State government 
levels. Most of the information that is publicly available 
through those entities is on paper or microfiche or microfilm 
and people actually have to go to a location, such as a 
courthouse or someplace like that, and actually look for the 
information.
    We do have some work ongoing right now where we are looking 
at the information resellers who are selling information via 
the Internet and we will have some information to report fairly 
soon on that. It does raise some questions about how carefully 
some information sellers are paying attention to who is 
actually asking for the information and what kinds of 
safeguards are in place to ensure that the information is being 
provided only to those where it is an appropriate use.
    Chairman MCCRERY. Thank you. Mr. Becerra?
    Mr. BECERRA. Thank you, Mr. Chairman, and thank you to the 
two of you for your testimony.
    Let me ask a question and revert back to the testimony of 
our two colleagues who were just here and talked about using 
the SSN for purposes of trying to determine one's eligibility 
to work in this country. Any comments on what you heard in the 
discussion that took place among the Members on that particular 
proposal?
    Ms. FAGNONI. We don't really have work that would comment 
on it directly, but there is a difference. First of all, they 
were talking about having a card that was tamper-proof, and 
there are all sorts of issues associated with looking at the 
different options and what would be appropriate and what the 
cost would be.
    There also is an issue which somebody raised about the 
information on the card which is only going to be as good as 
the information in the databases in DHS and SSA. We have 
reported on the fact that to the extent that, for example, 
information about somebody's visa status, if that is not kept 
up to date and isn't updated somehow through the encryption, 
then that is going to limit the usefulness of the database.
    There is a whole separate issue on the deterrent effect, 
which I really can't comment on.
    Mr. BECERRA. Okay.
    Mr. WINSTON. I found the discussion very interesting and I 
thought the point that you made actually was the one that I was 
thinking of, as well, and that is you can have a national 
number for immigrants or even for citizens, but any time you 
have a number that is the key to benefits, it is going to 
potentially be something that is valuable to identity thieves. 
The trick is to find a way of identifying people and 
authenticating who they are without having that information get 
in the hands of the wrongdoers and that is a very difficult 
task.
    Mr. BECERRA. As we explore how we can better protect the 
SSN, is there something that we have learned in these 
examinations about best practices or what some either public or 
private sector agencies, enterprises are doing to try to 
protect the number, anything that you can tell us that can help 
us with regard to this ongoing examination?
    Ms. FAGNONI. Keying off Mr. Winston's testimony, in the 
work we did where we looked at four sectors--banking, financial 
institutions, telecommunications, and tax preparers--it was 
clear that because of the laws and the regulatory structure 
surrounding the banking and financial institutions industries, 
there are a lot more protections in place regarding the 
protection of personal information, including the SSN.
    Particularly in telecommunications, there really are no 
laws that are designed to explicitly ensure that 
telecommunications companies are protecting SSNs. The companies 
are relying on individual contracts and things like that.
    As a matter for the Congress, one option would be to look 
at regulatory structures in terms of protecting information and 
consider whether or not those could be more broadly applied, or 
conversely, to look at some other specific sectors that don't 
now have laws in place that might warrant them.
    Mr. BECERRA. Let me ask just one last question, and if you 
wish to comment on something else, that is fine so long as I 
have time. I am not sure how to phrase it. Do we need to have 
one identifier, or should we ask all these various industries 
to have their own identifiers? The banking industry or 
financial services, you all keep an identifier that is for your 
purposes. Credit bureaus, those who are checking status of your 
demographic, your activities, whether purchasing or doing 
anything else, you keep your own number. The Federal 
Government, you keep your own number. State, driver's license 
and all the rest, you keep your own number.
    Should we have one, or should we, for purposes of trying to 
make sure we don't have a number that can be stolen or has that 
value if it is stolen, should we try to move toward something 
that says, you all keep your own numbers and that way no one 
can steal that much value from an individual when they get that 
identifier?
    Ms. FAGNONI. The reason the SSN is so valuable is because 
often, and I am sure you will hear this from the next panel, 
somebody who is trying to check somebody's credit or make sure 
that the individual they are talking to is the appropriate 
person and they should be sharing certain information, the only 
way they can ensure somebody's identity, looking across 
different kinds of pieces of information, is through that 
common identifier, the SSN.
    At the same time, though, we have a lot of examples where 
more and more kinds of entities are moving away from the 
display of the SSN. I think there is a difference between 
needing it and protecting it because it is a very important way 
to protect against fraud. At the same time, whether it is a 
driver's license or a health care card or whatever, over the 
past several years cards that routinely used SSNs now either 
first voluntarily and then now routinely across the board use 
other special identifiers unique to that particular entity for 
display purposes. They still have that SSN, behind the scenes 
that they need for data matching and things like that.
    Mr. WINSTON. I would just add very briefly, I agree with 
that, and there is a lot we can do to convince people to stop 
using SSNs when they don't need to, but at the same time, we 
have to look at the back end, and the back end is somebody 
appears before you with an SSN and wants to take out a loan. 
How do you make sure that person is who he says he is? It is 
the fact that the SSN is being used for that purpose, as well 
as for the identification purpose, that creates the problem. 
That is the key that unlocks the door to identity theft. The 
more we can go to systems of passwords, PINs, and get away from 
using the SSN as the authenticator, I think the better we will 
be.
    Mr. BECERRA. Thank you. Thanks very much, Mr. Chairman.
    Chairman MCCRERY. Mr. Brady?
    Mr. BRADY. Thank you, Mr. Chairman. A couple of questions, 
three, really. The first two are fairly direct. Identity theft 
is such a big issue. What percentage, would you guess, of 
identity thefts start with a stolen SSN?
    Mr. WINSTON. I can talk about the surveys we have done and 
that others have done, which indicate that about two-thirds of 
identity theft is what is called account takeover, and that is 
where somebody gets your credit card number or your bank card 
number and gets into your account. Typically, that doesn't 
require an SSN to do.
    The other one-third is new account fraud, where they 
actually go out and open a new account in your name. Typically, 
although not always, typically, you need an SSN to do that kind 
of fraud. It is about one-third.
    Mr. BRADY. That leads right to the second question. What is 
the most common way of obtaining a stolen SSN? Is it a stolen 
card? Is it mail theft, computer hacking, information 
resellers? What is the most common of those, would you guess?
    Mr. WINSTON. It is a little hard to tell from the surveys 
because most people don't know how their identity was stolen in 
the first place. They just know it happened. They don't know 
who did it. They don't know how it got done. If you look at 
just the data for people who do know what happened, you find 
that most of it is done through lost wallets or friends, 
relatives who get a hold of your information. That is not 
necessarily representative of half or more of the people who 
don't know. There are a lot of potential sources. It is really 
hard to tell what is the biggest.
    Mr. BRADY. A final question. Part of the, I think, 
complexity is the issue of information resellers. Even if we 
are able to sort of contain this issue at the source, as it 
gets sold, integrity becomes less and loose and things happen. 
I will ask both of you, who is responsible for ensuring that 
information resellers and financial institutions and those to 
whom they sell SSNs only disclose according to the law and who 
monitors it and what kind of resource do we use to tackle that 
problem?
    Ms. FAGNONI. Well, quickly, initially, who has authority, 
if anyone, is dependent on what industry is involved, and that 
is where we found, at least of the four industries we looked at 
and other examples we have, it varies. It is based on the laws 
that regulate that particular industry.
    In some cases, information resellers, for example, consider 
themselves to be financial institutions and therefore subject 
to the different kinds of laws regulating that industry. In 
other cases, they don't and it is honestly not clear if there 
is any regulatory framework.
    Mr. WINSTON. Just to elaborate on that, generally speaking, 
resellers get SSNs from credit bureaus. Credit bureaus get it 
from financial institutions. That is subject to the Gramm-
Leach-Bliley Act (P.L. 106-102). There are restrictions on 
people who buy information from resellers in how they can use--
how they can get the information and how they can use it. We 
are responsible for enforcing that law as to the non-bank 
entities. The banking agencies are responsible for the banks.
    Mr. BRADY. How much resource do you put toward that?
    Mr. WINSTON. We have a new division at the FTC, the 
Division of Privacy and Identity Protection, which is devoted 
solely to issues of identity theft, consumer privacy, ensuring 
that consumer information is protected. We have a staff of 
about 30 people who are looking at these issues and enforcing 
the law.
    Mr. BRADY. For your agency, can you guess or do you know 
how many businesses have been investigated, information 
resellers, for example, or businesses using it fraudulently 
have been investigated and successfully prosecuted?
    Mr. WINSTON. There have been a number, but the most recent 
case against Choice Point is a good example.
    Mr. BRADY. Sure.
    Mr. WINSTON. Choice Point is one of the largest data 
brokers in the country and they didn't have procedures in place 
to ensure that the people who called them up to buy SSNs and 
other information were legitimate. As a result----
    Mr. BRADY. Thankfully, that got a lot of attention, but are 
we talking about thousands of businesses across the country are 
investigated, hundreds are investigated, dozens are 
investigated?
    Mr. WINSTON. Keep going.
    [Laughter.]
    Mr. BRADY. Getting a little smaller, isn't it.
    Mr. WINSTON. We are a small agency. I don't know what the 
number would be. It is certainly not in the hundreds or 
thousands. That is all we can--that is all that we have the 
resources to do.
    Mr. BRADY. Thank you, Mr. Chairman, and thank you, both 
panelists.
    Ms. FAGNONI. Thank you.
    Chairman MCCRERY. Thank you, Ms. Fagnoni. Thank you, Mr. 
Winston.
    Our next panel is Nicole Robinson, North Atlantic Coast 
Volunteer Coordinator, Identity Theft Resource Center, San 
Diego, California; Mary McQueen, on behalf of the Council of 
State Court Administrators, Williamsburg, Virginia; Erik Stein, 
member of BITS Fraud Reduction Steering Committee; Stuart 
Pratt, President and CEO of Consumer Data Industry Association; 
and Bruce Hulme, Legislative Director, National Council of 
Investigation and Security Services from New York. Welcome, 
everybody.
    The same rules apply. Your written statements will be 
included in the record in their entirety, but we would ask you 
to summarize those statements in about 5 minutes.
    We will begin, Ms. Robinson, with you. Thank you for 
coming. You may begin.

 STATEMENT OF NICOLE ROBINSON, NORTH ATLANTIC COAST VOLUNTEER 
    COORDINATOR, IDENTITY THEFT RESOURCE CENTER, SAN DIEGO, 
                           CALIFORNIA

    Ms. ROBINSON. Good afternoon, Mr. Chairman, Members of the 
Committee. Thank you for the opportunity to testify on behalf 
of this very important topic.
    My name is Nicole Robinson, and besides being the North 
Atlantic Coast Coordinator for the Identity Theft Resource 
Center, I am also a victim of identity theft, and I want to 
start first off to tell you--try to be brief about my identity 
theft case.
    It first started in 2000 and I was notified by a fraud 
investigator, Kay Jewelers said someone had used my SSN to open 
an instant credit account. That first night, she bought watches 
and a ring totaling $2,300. The next night, she came trying to 
max out the account and they were alerted to it because people 
don't usually do that with jewelry store accounts.
    Well, I contacted the three credit reporting agencies on 
that Monday. It was very difficult to get my credit reports 
because she had used different addresses in Texas and I 
couldn't get my own credit reports. I soon came to find out 
that she had applied for a personal loan at my mortgage lender. 
She was picked up by the Bear County police getting a personal 
check in my name. My mortgage lender never contacted me, 
although they knew they held a mortgage for me in Maryland and 
she was in Texas. The police let her go that day. She promised 
that she wouldn't do it again. She cried. She said she didn't 
know what she was doing was wrong and they let her go home.
    After that, since she knew I had a mortgage, she applied 
for a mortgage several days later. She continued to apply for 
credit, even though she had been picked up by the police. She, 
in a 3 month period, got $36,000 in goods and services. She had 
a Geico car insurance policy in my name and Geico would not 
give me the VIN number off the vehicle so I could track back to 
the dealership that sold it because they said they had to 
protect her privacy.
    As time went on, she was eventually indicted and she pled 
guilty to two counts of misusing my identifying information. 
She served no time in jail. She was ordered to pay restitution. 
I have only seen a small portion of the restitution thus far.
    As time has gone, I have borne the burden of her theft of 
my identity. I continue to get her collection notices at my 
home in Maryland. As recently as last summer, I got a 
collection notice from a collection agency where Nicole 
Robinson--and that is her name, her name is Nicole Robinson, as 
well--she had gone to a dentist in Texas while she was in 
police custody and had a tooth extracted. Well, of course she 
didn't pay for it and so the collection agency started to look 
for her. Instead of finding her in Texas, they sent a 
collection notice to my home in Maryland.
    I have continued to get collection notices for bad checks 
that she has written. I also get preapproved credit card offers 
at my home in her name, and the only reason why I know it is 
for her is because we have a different middle initial and they 
always come with her middle initial.
    As I started to get my credit reports, in 2004, I got a 54-
page credit report. It had 170 accounts on it. A hundred-and-
thirty of them were in collections. It had 42 different names 
and 65 different addresses. I was notified by another credit 
reporting agency that my SSN resided on five different credit 
reports.
    Even as recently as this year, when a mortgage broker ran 
my credit report, her bad debts, even a judgment from an 
apartment complex in Texas, is on my credit report, and it is 
not on the credit reports that the credit reporting agency 
sends to me, but it is on the credit report that they disclose 
to the lenders.
    As a result of me being a victim of identity theft, I do 
speak to consumer groups about protecting your SSN. The way my 
SSN was stolen by Nicole Robinson is that she worked for a 
business called Care Mark, and Care Mark used to provide mail-
in pharmaceutical services for a law firm where I used to work. 
Even though I was no longer an employee of the law firm, she 
still had access to my information in their databases. I 
ultimately found out that she used the SSN of several people 
named Nicole Robinson and she was able to get cars and jewelry, 
and when she bought a vacuum cleaner, somebody reported to the 
police in Texas that she had a warehouse full of stuff that she 
had stolen.
    I just want to go over briefly some of the recommendations 
from the Identity Theft Resource Center on securing data. We 
realize that businesses do use the SSN. It is so much a part of 
what a lot of businesses do. We think that businesses should 
take extra precautions to secure the SSN.
    In my case, Nicole Robinson had access to my SSN years 
after I was a member of the health plan that required me to use 
my SSN as an identifier. She should have never had access to 
that number because I was no longer a member of that plan. Even 
if she had access to my records, my SSN should have been 
redacted in whole or in part.
    We believe that consumer education is key. A lot of people 
don't see the risk in carrying their Social Security cards in 
their wallets and we believe that when you get your annual 
statement from the SSA, there should be a consumer alert on 
there about protecting your SSN.
    We also believe that businesses should assume 
responsibility for the protection of your SSN. If they require 
it, they should also protect it.
    Thank you very much.
    [The prepared statement of Ms. Robinson follows:]
     Statement of Nicole Robinson, North Atlantic Coast Volunteer 
   Coordinator, Identity Theft Resource Center, San Diego, California
    Members of the committee: Thank you for the opportunity to provide 
both written and oral testimony for your committee today and for your 
interest in the topic of identity theft.
    The oral portion of our testimony will be provided by Nicole 
Robinson, a survivor of identity theft, and the highest ranking ITRC 
volunteer on North Atlantic Coast.
    The nonprofit Identity Theft Resource Center (ITRC) is passionate 
about combating identity theft, empowering consumers and victims, 
assisting law enforcement, reducing business loss due to this crime and 
helping victims. We also realize that you are in a difficult position 
of trying to impose laws that may impact consumers, business and 
government.
    However, ITRC firmly believes that it is possible to find a balance 
between the creation of strong identity theft laws to protect consumers 
and businesses and allowing the business community to flourish and 
grow. It is critical that all parties be considered in any legislation 
you pass and in all of your deliberations. After all--In each case of 
Financial Identity Theft there are at least two sets of victims--the 
individual whose SSN was used and the business that has lost services, 
goods or money. We all victims of this crime and we appreciate your 
time in addressing this issue.
    We are honored by your invitation and will continue to make our 
opinions available upon request to your representatives over the next 
few months as you grapple with this complex crime and its many issues.
Introduction:
    Governmental agencies at all levels, businesses and consumers have 
for ease and convenience tied and associated many critical elements of 
daily life to the individual Social Security Number (SSN). The 
individual number is the primary key to the individual's credit 
history, work history education and health information. You must have 
one to work, gain tenancy, credit and to identify individuals on tax 
forms.
    More and more business and entities are collecting personal 
information about each and every one of us. These can range from your 
bank to the soccer league that your child plays in. Add to that number 
the schools where you or your child attended, all the job applications 
you have ever filled out, the Funeral Home that is preplanning your 
final arrangements and the many health facilities that you have used. 
Some veterinarians, self-storage units and even car rental companies 
ask for SSNs.
    In some cases there is a valid reason to collect the information 
and the Identity Theft Resource Center holds that it should be allowed 
to continue. Our concern lies not in the collection of the Social 
Security number but in the use, storage, access and misuse of this key 
information.
    It must be noted that the crime of identity theft is not a 
particularly new crime. It is more that in the current environment of 
electronic credit and business identity theft has become extremely 
profitable and safe for the thief. The thief faces little chance of 
apprehension with minimal penalties for the theft of thousands of 
dollars.
    Each day the thieves grow more accomplished at their task. Now it 
is time for businesses, governmental agencies and consumers to adopt a 
more proactive position on the value of the Social Security number as a 
marketable commodity. Consumers need to realize it has value. 
Businesses and governmental entities need to accept responsibility for 
this item of value, the Social Security number. We need to create a 
plan that focuses on all involved parties and not just on the business 
community.
    Numerous surveys have proven that consumers do not feel trust for 
companies or the government proactively protecting their personal 
identifying information. They believe, with cause, their information is 
accessible to too many people and handled without protection. In order 
to increase customer, employee and client trust, new security processes 
must be implemented as soon as possible.
Findings and Recommendations:
SSN as an identifier on items in wallets
    Finding: Too many people carry their Social Security number on 
their person, in the form of the actual Social Security card, health 
insurance cards, Military ID cards, employee id cards or Medicare/
MediCal cards and driver's license numbers. Wallets are primary targets 
by identity thieves, pickpockets and drug addicts who hope to profit 
this information.
    Recommendation: The Social Security number should not be used as an 
identifier in any circumstances and should never be on cards carried in 
the wallet, even on the magnetic strip due to improvements in skimming 
technology. Randomized numbering systems should be used that match the 
SSN in a well-protected database when necessary such as for Medicare 
benefits.
Consumer Education
    Recommendation: That all Social Security cards come with an 
advisory with the original card and that this advisory should also be 
sent out yearly with the person's work benefit statement. This advisory 
should include under what circumstances one should give out a SSN, when 
not to, a telephone number to call with questions or to file 
complaints, and not to carry a SS card in one's wallet, palm pilot or 
laptop.
    Recommendation: That the SSA work with other governmental and 
private entities to continue to educate consumers about scams that 
involve the SSN. A study of the SSA site only included one scam warning 
as the beginning of March 2006.
Overcollection/misuse of the SSN
    Recommendation: Too many companies are unnecessarily asking for a 
person's SSN. While it may not be practical to limit the collection of 
the SSN, a blanket liability should be incurred all entities that 
collect this information from an individual or secondary source. It is 
not unreasonable for any individual to expect basic standards of 
protection of the information obtained by the entity doing the 
collection. Federal, state and private right of actions should included 
in any bill considered in order for there to be effective encouragement 
to self-enforce these standards.
Information Security
    Finding: The number of publicized security breaches during 2005 
clearly indicates a serious problem. Whereas it is not possible to 
build an impenetrable security system around data, it is clear that 
companies and governmental agencies need to have a tighter control on 
information. This rule cannot just apply to businesses. All 
governmental agencies need to be held to the same standard and be a 
leader in this movement.
    Recommendation: Companies and all levels of governmental agencies 
should be required to do an information risk assessment of both paper 
and electronic documents containing a Social Security number. This 
assessment should include the ability to follow information from the 
point of entry to beyond disposal, including the auditing of any 
person, department or storage space. A written policy should be 
designed that limits access to the SSN, describes the protection of the 
information and how information should be destroyed. ITRC strongly 
recommends a breach notification similar to California's or New 
Jersey's current laws.
SSN as an identifier for customers or employees
    In order to limit access of an individual's SSN, all companies 
should assign a separate account number and the SSN should never been 
seen on a call center screen by an employee of the company. There are 
many other ways, including passwords, to verify a person's identity.
Document Disposal
    Finding: A popular spot identified by law enforcement and other 
investigative entities is the unshredded documents and data recklessly 
discarded into or near trash cans and dumpsters. Only several states 
have passed mandatory document disposal laws stating that paper and 
electronic documents must be rendered unreadable prior to disposal.
    Example: A recent situation occurred in Los Angeles when the 
Department of Social Services had boxes of medical records, application 
forms and other documents with SSN put in boxes by a trash can. These 
documents never had been shredded but were being sent whole to China 
for recyling. Unfortunately they were also seen blowing in the wind and 
people went through boxes for information knowing they were out there.
    Recommendation: A law that states that all documents, no matter 
what form they are in, must be rendered unreadable prior to leaving the 
entity that no longer wishes to store them.
Educational Facilities and SAT testing
    Finding: In 2005 more than half of the disclosed breaches were 
educational facilities, mainly colleges and universities. The 
University of Colorado had 4 breaches in the last 14 months. After 
speaking with IT departments and administrators at several of these 
colleges, it is clear that changes need to be made. Parents send 
children to colleges to help them on their career paths. One identity 
theft problem can stop a future before it begins.
    Recommendations: First, SSN should never be a student's public 
identification number, computer access number or publicly used for any 
other purpose. These steps will significantly limit the number of 
professors who have lost or had laptops stolen with student numbers and 
stop roster with names and SSNs from circulating classrooms.
    Second, other than a few departments that are involved in payroll, 
student loans, scholarships and such should have access to the 
student's SSN. While it is easy to track a student by SSN it is easy to 
have that information securely stored in a database with limited access 
so that when a student asks for a transcript or school records they be 
found. However, the SSN should never been printed in full on any 
document sent through the mail.
    Third, the ``College Boards,'' the company that does SAT testing 
must immediately stop asking students for SSN and stop placing them on 
mailing labels. ITRC has had numerous calls about this activity.
Immigrants who no longer need or wish to have a SSN
    Finding: ITRC has heard from a number of people who lived in the 
United States for a limited period of time or have moved from the 
United States to live permanently in another country. They would like a 
way to prevent any possible use of their SSN now that they no longer 
need it.
    Recommendation: The creation of a national credit freeze program 
would not only help victims of identity theft and businesses from 
giving cards to thieves but would also solve this problem. However, 
that only solves the financial side of the problem. Other solutions 
would have to be found within the SSA so that those numbers would be 
tagged as inactive for employment or benefit purposes.
SSN of the Deceased
    Finding: According to the SSA not all deceased individuals are on 
the Master Death Registry. It is partially consumer driven (change in 
benefit status) and partially populated by some states that do report 
all deaths to the SSA.
    Recommendation: All governmental agencies that issue a death 
certificate should report that death to the SSA either directly or via 
a state program. Since this Registry is available to the credit 
reporting agencies and Department of Motor Vehicles this would 
significantly stop the use of a dead 7 year old's SSN by an adult.
SSNs sent through the mail
    Finding: ITRC receives numerous inquiries from parents who never 
receive their newborns Social Security cards. Either they have been 
lost or intercepted by a would-be identity thief.
    Recommendation: After talking with the Chief Privacy Officer of the 
U.S. Postal Service, there are a number of ways that the Post Office 
and SSA can work together to help insure the delivery of these 
documents. ITRC recommends that a committee be formed and a new 
procedure implemented within six months.
    Finding: Companies still send information via the U.S. Mail with 
SSNs on mailing labels or in the body of the letter. In some cases it 
would clear to an identity thief that this envelope contains valuable 
information.
    Recommendation: That mailing labels may never include a SSN and 
that when a SSN is included in the body of a document that it must be 
partially truncated.
IRS and selling of information
    ITRC would be remiss if it did not comment on the plan being 
considered by the IRS to allow the sale by tax preparation services of 
our tax returns or personal tax information. Many people get numerous 
papers from tax preparers and just sign them. They go unread or may be 
beyond an individual's reading ability. This proposed plan must not be 
implemented. It creates another public record that will benefit thieves 
more than anyone else. If this must be allowed then there can be no 
allowances for acceptance of any release that is not clear and 
specific.
Public Records
    Recommendation: The SSN should never be published on the Internet 
by a business or governmental entity including court records. In 
response to those who state they need that information, it can be 
specifically requested of the court, with appropriate redaction of 
unnecessary information that may place the individual in harm's way. 
This includes witness and victim information, family records during 
custody and divorce hearings and bankruptcy hearings.
    Recommendation: In a court proceeding where information must be 
exchanged between opposing sides, the SSN should be at least partially 
redacted in order to protect the sanctity of that number.
New Laws--A Standard and not the Ceiling
    The concepts discussed above are intended to benefit business and 
consumers. While we understand that companies don't want to deal with 
50 different laws, it is also important to note that some states want 
to hold state and local governmental agencies and businesses to a 
higher standard than the ones recommended above. Any federal law should 
be a standard, to cover those citizens in states currently without 
information protection statutes and not pre-empt stronger state laws.
In Conclusion:
    Protecting Social Security numbers from identity thieves needs to 
be everyone's job--not just the consumers. We need businesses and 
governmental agencies to work cooperatively with consumers to keep this 
valuable number out of the hands of those who have no regard for the 
damage they cause individuals and companies.
    Businesses cannot afford to continue to lose money to identity 
thieves. While the numbers discussed in terms of fraud loss may sound 
like a trickle now, it is going to worsen. Identity thieves are more 
sophisticated, meth addicts have turned to this crime for money for 
fixes, and information trafficking is big business. Without required 
control procedures for the handling of Social Security numbers, this 
crime will worsen and our economy will suffer.
    Its going to require the reeducation of consumers, businesses and 
governmental agencies. It going to require new behavior patterns, new 
ways of controlling information in the workplace and strict vigilance 
against new trends and attacks.
    The proactive and not reactive protection of the Social Security 
number is in your hands. This small nine-digit number has the ability 
to destroy a company or an individual when misused. It is clear that 
some states have taken great strides to protect consumers. 
Unfortunately some business groups believe that anything that will 
benefit consumers will harm them and have fought change. Consumers 
blame businesses.
    This is not a time for finger pointing. The blame game must end. We 
must be on the same team fighting a battle against this Goliath if we 
are to win. We must realize that we are one people and anything that 
harms one of us harms us all.
    Thank you for your time and interest.
    Linda Foley
    Jay Foley

                                 

    Chairman MCCRERY. Thank you, Ms. Robinson. Ms. McQueen?

 STATEMENT OF MARY C. McQUEEN, PRESIDENT, NATIONAL CENTER FOR 
   STATE COURTS, ON BEHALF OF THE CONFERENCE OF STATE COURT 
                         ADMINISTRATORS

    Ms. MCQUEEN. Thank you, Mr. Chairman, Mr. Levin, Members of 
the Subcommittee. I am Mary McQueen. The Conference of State 
Court Administrators is pleased to present testimony on today's 
hearings before this important Committee.
    Before I begin my remarks, I would like to provide some 
background about who that group is, and I submit testimony on 
their behalf. I am a former member of the Conference of State 
Court Administrators, having served as the Chief Administrative 
Officer for the court system in the State of Washington for 25 
years, and most recently assumed the position as the President 
for the National Center for State Courts. The National Center 
operates in coordination with the Conference of State Court 
Administrators and Chief Justices in a similar way that the 
Federal Judicial Center operates with the Federal judiciary.
    The Conference of State Court Administrators and the 
Conference of Chief Justices represent the top judicial 
officials and chief administrative officers in the 58 States, 
Commonwealths, and U.S. Territories, and we work very closely 
together with the chief justices to develop best practices to 
improve the administration of justice. You may know that more 
than 98 percent of all judicial proceedings in the United 
States are in State courts that consist of over 30,000 judges 
and over 16,000 courts.
    Mr. Chairman, let me begin by informing you that the State 
courts have taken several important steps to protect individual 
privacy and we share the Committee's concerns. The State courts 
hope to partner with the Chair and the Members of this 
Subcommittee in your efforts to increase those privacy steps.
    A question we are always asked is why do State courts need 
SSNs? What is the State courts' interest in collecting those 
numbers, and why do State courts require parties to provide 
them in litigation? I would like to just briefly identify five 
different uses of the SSN in State courts.
    The first and obvious one to those of you who are members 
of the bar is to ensure that accurate information is placed 
before a fact finder. We want to ensure, especially in family 
law cases, that we have access to the information that is 
necessary to determine child support, to distribute property, 
and to determine paternity.
    Secondly, we also need to identify the parties. Courts 
often use SSNs to identify criminal defendants that lack 
fingerprint information.
    We also use SSNs to enforce judgments in court orders. 
Courts often order restitution or the repayment of fines as a 
legal judgment, and SSNs have become the universal commercial 
identifier for use in monetary penalties. Litigants' SSNs are 
also necessary for use in State income tax intercept programs, 
where outstanding monetary judgments are deducted from State 
income tax returns. Federal law now requires State courts to 
place a party's SSN in records relating to divorce and child 
support decrees, and in October 1999, that requirement was 
extended to require SSNs for all children to whom support is 
required to be paid.
    We also need SSNs to create jury pools and to pay jurors. 
It requires us when we issue a check to jurors that that income 
is reported, and we are required to have SSNs for those 
individuals.
    Finally, we use SSNs to notify the SSA of incarcerated and 
absconded persons. The SSA cuts off payments to persons 
incarcerated in all Federal, State, and local prisons or jails 
who are fugitives from justice and they need to identify those 
persons. While traditionally that information comes from 
correctional agencies, the courts initially provide those 
agencies with that information.
    As previously mentioned, the Welfare Reform Act (P.L. 104-
193) does require courts to collect SSNs on court orders 
granting divorces, providing for child support, or determining 
paternity, and SSNs can appear in many financial records, such 
as tax returns, which are required to be filed in many court 
proceedings.
    We were encouraged by some of the language that accompanied 
H.R. 2971 in the report dealing with incidental versus non-
incidental appearances of SSNs on public records and we would 
encourage that if you move forward, we would like to work with 
you on looking at some of those provisions.
    In drafting Social Security legislation, we respectfully 
request that you ask members of the court community participate 
in those discussions.
    Finally, in an effort to increase privacy and reduce the 
possibility of identity theft from court documents, the chief 
justices and the State court administrators have established a 
Standing Committee on Court Privacy and Access to Court 
Records. They have adopted national guidelines and model court 
rules, and we have identified three best practices. I would 
draw your attention to our visual aid here.
    These best practices include creating basically two sets of 
records. The State of Washington, the States of Michigan, 
Vermont, and South Dakota have adopted this approach, where 
basically in the types of records that incorporate sensitive 
information as well as SSN, there is a special procedure for 
sealing this information, placing them in a separate file, and 
when someone comes to the counter and asks to see the court 
file, those records are removed in the envelope and not 
provided to the public.
    We have also identified a best practices that we give an 
alert to the filing parties and make sure that they know they 
are responsible for including any SSNs in the documents that 
are filed and make sure that on all court model forms, that 
everybody uses, that there is an alert saying your SSN may be 
available, so please consider not including that.
    Also, as part of the two sets of records, several States 
have identified confidentiality filing forms, where you put 
that information on one sheet, not incorporate it into the 
court documents, and that one sheet is sealed.
    Finally, when requiring SSNs, we have recommended that you 
only use four digits that would appear in the court record.
    Mr. Chairman, we recognize the threat of identity theft as 
real. We commit that the State courts want to do our part in 
eliminating that opportunity. I have presented several reasons 
why the courts utilize SSNs as well as the solutions that we 
are working to implement.
    Thank you for allowing us to participate in this discussion 
and I will be happy to answer any questions you may have.
    [The prepared statement of Ms. McQueen follows:]
 Statement of Mary C. McQueen, on behalf of the Council of State Court 
                 Administrators, Williamsburg, Virginia
    Mr. Chairman and Members of the Subcommittee,
    The Conference of State Court Administrators (COSCA) is pleased to 
present testimony on today's fifth in a series of hearings on Social 
Security Number High Risk Issues.
SUMMARY
    Mr. Chairman and members of the subcommittee, the state court 
community has been grappling with the issue of protecting privacy as it 
relates to court records for the past few years. We are taking a 
proactive stance in protecting the privacy of individuals and their 
social security numbers, while at the same time maintaining traditional 
open court access. Today, we will share examples of what state courts 
that are doing on this via the approval of court rules.
    In collaboration with the Conference of Chief Justices (CCJ), we 
established a project entitled ``Public Access to Court Records: CCJ/
COSCA Guidelines for Policy Development by State Courts,'' which 
outlines the issues that a jurisdiction must address in developing its 
own rules, and provides one approach. The Guidelines touch on the use 
of social security numbers (SSNs) in court records as well as other 
private information. The entire text of the Guidelines can be found 
online at http://www.courtaccess.org/modelpolicy/
18Oct2002FinalReport.pdf. Both CCJ and COSCA, adopted a resolution 
endorsing the Guidelines and urged the states to address them.
    Mr. Chairman, SSNs are pervasive in state court documents and 
procedures. The testimony that follows gives the subcommittee numerous 
examples of how we use SSNs in day-to-day court proceedings. For 
example, we use SSNs to insure that judges have the best evidence 
available to them. We also use SSNs to collect fines and restitution. 
In addition, many SSNs appear in the public record in many types of 
court cases including, but not limited to, bankruptcy, divorce and 
child support cases. My testimony also details the federal requirements 
imposed on us to collect SSNs for various reasons, for example, to 
track parents who are not paying child support.
    Mr. Chairman, we stand ready to work with you to craft solutions to 
address the problem of identity theft. We want to do our part to 
eliminate it. We are at the same time concerned about the effort to 
require us to redact or expunge SSNs that appear in public records. We 
feel that this type of requirement would impose an unfunded mandate on 
state courts in this country. The cost to fulfill this requirement 
would be high because many SSNs appear in paper documents as well as 
other hard-to-redact microfilm/microfiche.
ABOUT COSCA
    Before I begin my remarks, I would like to provide some background 
on our group and our membership. I submit this testimony on behalf of 
the Conference of State Court Administrators (COSCA). I am a former 
member of COSCA having served as State Court Administrator of the state 
of Washington. The National Center for State Courts, of which I am 
President, serves as secretariat to COSCA. COSCA was organized in 1955 
and is dedicated to the improvement of state court systems. Its 
membership consists of the principal court administrative officer in 
each of the fifty states, the District of Columbia, the Commonwealth of 
Puerto Rico, the Commonwealth of the Northern Mariana Islands, and the 
Territories of American Samoa, Guam, and the Virgin Islands. A state 
court administrator implements policy and programs for a statewide 
judicial system. COSCA is a nonprofit corporation endeavoring to 
increase the efficiency and fairness of the nation's state court 
systems. As you know, state courts handle 98% of all judicial 
proceedings in the country. The purposes of COSCA are:

      To encourage the formulation of fundamental policies, 
principles, and standards for state court administration;
      To facilitate cooperation, consultation, and exchange of 
information by and among national, state, and local offices and 
organizations directly concerned with court administration;
      To foster the utilization of the principles and 
techniques of modern management in the field of judicial 
administration; and
      To improve administrative practices and procedures and to 
increase the efficiency and effectiveness of all courts.

    Although I do not speak for them today, I also would like to tell 
you about the Conference of Chief Justices (CCJ), a national 
organization that represents the top judicial officers of the 58 
states, commonwealths, and U.S. territories. Founded in 1949, CCJ is 
the primary voice for state courts before the federal legislative and 
executive branches and works to promote current legal reforms and 
improvements in state court administration. COSCA works very closely 
with CCJ on policy development and administration of justice issues.
STATE COURTS ARE RESPONDING TO PRIVACY CONCERNS
    Mr. Chairman, let me begin by informing you of the progress that 
many state courts are making to protect individual privacy rights, 
while maintaining the American tradition of open courts. Through court 
rules, state court systems are changing their procedures for viewing 
and accessing court records as they relate to the appearance of social 
security numbers. Washington State, for example, is establishing a 
procedure for ``sealing'' family case court records containing 
privileged information such as social security numbers and financial 
information. In effect, Washington is creating two sets of records: a 
public and a private one. Vermont is placing the burden on parties to 
expunge or redact social security numbers from papers filed with the 
court. Minnesota is requiring that parties in a divorce case fill out a 
confidential information sheet, which contains social security numbers, 
to be kept separate from the official record. South Dakota adopted a 
rule that protects SSNs and financial account number information by 
requiring these numbers to be redacted from documents and submitted to 
the Court on confidential information forms. As an example, I am 
attaching the South Dakota rule along with their required confidential 
information sheet to the end of my testimony.
    In addition to the proactive stance we are taking to this issue, we 
are also responding to some of the demands placed on our court systems 
by state legislatures and governors. In 2005, 53 bills were signed into 
law by governors dealing with social security number privacy. That's 17 
more than in 2004; an increase of 46 percent. These bills range from 
simple prohibition of displays of SSNs on public records to new 
expansive criminal and civil statutes that punish wrongdoers and those 
that traffic in social security numbers as a means to steal a person's 
identity. Activity in this area has not diminished in the current year. 
In the ongoing 2006 sessions, state legislatures are considering 176 
measures dealing with social security numbers and privacy. Again, this 
number is an increase over the prior year.
    At the direction of the CCJ and COSCA leadership, we established a 
special subcommittee of the CCJ/COSCA Court Management Committee to 
explore privacy protection innovations and share them with the Congress 
and the Administration. This committee meets twice a year at our annual 
and mid-year meetings. This subcommittee has been researching the issue 
and is responsible for compiling examples of best practices in this 
area that I am presenting today.
NATIONAL EFFORT TO CRAFT PUBLIC ACCESS GUIDELINES TO COURT RECORDS
    Our project entitled, ``Public Access to Court Records: CCJ/COSCA 
Guidelines for Policy Development by State Courts'' was a joint effort 
of CCJ/COSCA and the NCSC to give state court systems and local trial 
courts assistance in establishing policies and procedures that balance 
the concerns of personal privacy, public access and public safety.
    The State Justice Institute (SJI) funded this project in 2001 and 
it was staffed by the NCSC and the Justice Management Institute. The 
project received testimony, guidance and comments from a broad-based 
national committee that included representatives from courts (judges, 
court administrators, and clerks), law enforcement, privacy advocates, 
the media, and secondary users of court information.
    The Guidelines recommend the issues that a jurisdiction must 
address in developing its own rules governing public access. The 
Guidelines are based on the following premises:

      Retention of the traditional policy that court records 
are presumptively open to public access
      The criteria for access should be the same regardless of 
the form of the record (paper or electronic), although the manner of 
access may vary
      The nature of certain information in some court records 
is such that remote public access to the information in electronic form 
may be inappropriate, even though public access at the courthouse is 
maintained
      The nature of the information in some records is such 
that all public access to the information should be precluded, unless 
authorized by a judge
      Access policies should be clear, consistently applied, 
and not subject to interpretation by individual courts or court 
personnel

    The Guidelines Committee examined the use of SSNs in current court 
practices. They looked at the inclusion of SSNs in bulk distribution of 
court records, and in other private information that courts 
traditionally protect, such as addresses, phone numbers, photographs, 
medical records, family law proceedings, and financial account numbers. 
Finally, the Committee examined various federal laws and requirements 
governing SSN display and distribution by state and local entities.
    On August 1, 2002, CCJ and COSCA endorsed and commended ``the 
Guidelines to each state as a starting point and means to assist local 
officials as they develop policies and procedures for their own 
jurisdictions.''
STATE COURTS' INTEREST IN COLLECTING AND USING SOCIAL SECURITY NUMBERS
    A question we are often asked is why do state courts utilize SSNs? 
What is the state court interest in collecting SSNs? Why do state 
courts need to require parties to provide their SSNs in the course of 
state court litigation? The following are some of the reasons we use 
them:
    Accurate determination of assets/income Judges need the most 
accurate information on assets and income when making their decisions, 
especially in family law cases. In many instances this involves 
examining assets by a social security number. There are numerous 
examples of individuals giving a false social security number to avoid 
paying child support, for example. The same logic applies in dealing 
with divorce cases in dividing assets.
    Identification of parties A growing number of court systems are 
using case management information systems in which an individual's 
name, address, and telephone number are entered once, regardless of the 
number of cases in which the person is a party. The advantage of these 
systems is to be able to update an address or telephone number for all 
cases in which the person is a party by a single computer entry. SSNs 
provide a unique identifier by which court personnel can determine 
whether the current ``John Smith'' is the same person as a previous 
``John Smith'' who appeared in an earlier case.
    Courts have often used SSNs to identify criminal defendants as well 
as parties to civil cases. In the future, persons accused of crime will 
be identified by automated fingerprint identification systems (AFIS) 
which scan fingerprints and classify them electronically. The primary 
future need for SSNs as a means to identify individuals will therefore 
be in civil, not criminal, litigation.
    Collection of fees, fines and restitution by courts SSNs are the 
universal personal identifier for credit references, tax collection, 
and commercial transactions.
    When courts give a litigant an opportunity to pay an assessment 
resulting from a judgment in periodic payments, the court needs to be 
able to function as a collection agency. Having the convicted person's 
social security number is necessary for use of state tax intercept 
programs (in which a debt to the state is deducted from a taxpayer's 
state income tax refund) and other collection activities. Some states 
use additional means to enforce criminal fines and restitution orders, 
such as denial of motor vehicle registration; SSNs are often used for 
these purposes as well.
    Creation of jury pools and payment of jurors SSNs are a necessary 
part of the process by which multiple lists (for instance, registered 
voters and registered drivers) are merged by computer programs to 
eliminate duplicate records for individual citizens in the creation of 
master source lists from which citizens are selected at random for jury 
duty. Duplicate records double an individual's chance of being called 
for jury duty and reduce the representativeness of jury panels. Some 
courts use SSNs to pay jurors as well.
    Making payments to vendors SSNs are used as vendor identification 
numbers to keep track of individuals providing services to courts and 
to report their income to state and federal taxing authorities.
    Facilitating the collection of judgments by creditors and 
government agencies Courts are not the only entities that need to 
collect judgements. Judgment creditors need SSNs to locate a judgment 
debtor's assets and levy upon them. Courts often require that the 
judgment debtor make this information available without requiring 
separate discovery proceedings that lengthen the collection process and 
increase its costs. Federal law now requires state courts to place the 
parties' SSNs in the records relating to divorce decrees, child support 
orders, and paternity determinations or acknowledgements in order to 
facilitate the collection of child support. On October 1, 1999, that 
requirement was extended to include the SSNs of all children to whom 
support is required to be paid.
    Notification to the Social Security Administration of the names of 
incarcerated and absconded persons The Social Security Administration 
cuts off all payments to persons incarcerated in federal, state or 
local prison or jails, and to person who are currently fugitives from 
justice. The savings to the federal budget from this provision are 
substantial. To implement this process, Social Security Administration 
needs to identify persons who have been sentenced to jail or prison and 
persons for whom warrants have been issued. The agency has 
traditionally obtained this information from state and local 
correctional agencies. See 42 USC  402(x)(3) requiring Federal and 
State agencies to provide names and SSNs of confined persons to the 
Social Security Administration. The state courts of Maryland are 
involved in an experimental program to provide such information 
directly from court records. The Maryland program has two additional 
future advantages for state courts. First, the program offers the 
possibility of obtaining better addresses for many court records; 
social security and other welfare agencies have the very best address 
records because of beneficiaries' obvious interest in maintaining their 
currency. Second, cutting off benefits may provide a useful incentive 
for persons receiving benefits to clear up outstanding warrants without 
requiring the expenditure of law enforcement resources to serve them.
    Transmitting information to other agencies In addition to the 
Social Security Administration, many states provide information from 
court records to other state agencies. A frequently occurring example 
is the Motor Vehicle Department, to which courts send records of 
traffic violations for enforcement of administrative driver's license 
revocation processes. These transfers of information often rely upon 
SSNs to ensure that new citations are entered into the correct driver 
record.
POTENTIAL LEGISLATION
    Mr. Chairman, in the past, this subcommittee has considered various 
pieces of legislation that would, in some form or another, prohibit the 
display of a person's social security number on a public record. 
Blanket prohibitions like these will place courts in the position of 
trying to comply with conflicting public policies. We submit the 
following questions for your consideration:
    The Welfare Reform Law requires courts to collect SSNs on court 
orders granting divorces or child support or determining paternity. 
State laws contain similar requirements in other types of cases in some 
states. What steps must a court take to restrict access to these 
documents, which are matters of public record in most states?
    SSNs appear in many financial documents, such as tax returns, which 
are required to be filed in court (e.g., for child support 
determinations) or are appended to official court documents, such as 
motions for summary judgments. What steps must a court take to restrict 
access to these documents, which are also matters of public record in 
most states?
    We were encouraged by language in the report accompanying HR 2971 
(Rept. 108-685, Part 1, p. 21) in the 108th Congress dealing with 
incidental vs. non-incidental appearances of SSNs in public records:
    During Social Security Subcommittee hearings on the bill, court and 
other public records administrators testified they receive numerous 
documents filed by individuals, businesses, and attorneys that often 
include SSNs the government did not require to be submitted, and of 
which they are therefore unaware. They stated redaction of 
``incidentally'' included SSNs would create a serious administrative 
burden, and it would require significant resources to review each 
document and redact such incidental SSNs--With respect to SSNs 
submitted in court documents absent the court's requirement to do so, 
the individual communicating the SSN in the document, not the court, 
would be held responsible according to Section 108 of the bill. 
(Emphasis ours)
    In drafting social security legislation, we respectfully ask that 
you expand on the above sentiments in actual legislative language of 
any future bill.
    Courts will have substantial increased labor costs in staff time to 
redact or strike the appearance of SSNs in paper records or in 
microfilm/microfiche if a redaction requirement is imposed.
    In the event you draft legislation dealing with redaction, we urge 
you to make a distinction between existing court records/documents and 
future documents. For example, requiring a court to retroactively 
redact or expunge old records would be a nightmarish task due to the 
cost in staff time and the actual compiling of said court records.
    Finally, in an effort to make courts and court records more open, 
many courts are now beginning to make available many public records on 
the internet either as text/character documents or by scanning and 
placing them online through imaging software (PDF files). While the 
removal of SSNS in text/character documents may be relatively easy in 
some computer generated records (XML), other scanned records, such as 
PDF files, will be harder to change necessitating more staff and an 
increase in labor costs.
OUR FUTURE COURSE OF ACTION
    CCJ and COSCA have recommended that state courts adopt the 
following policies, unless state law directs them otherwise, to protect 
citizen privacy while providing service to litigants:
    Official court files State courts should not attempt to expunge or 
redact SSNs that appear in documents that are public records. As was 
mentioned earlier, federal law requires state courts to place the 
parties' SSNs in the records relating to divorce decrees, child support 
orders, and paternity determinations or acknowledgement in order to 
facilitate the collection of child support. The purpose of placing that 
data on judgments is not just to provide it to child support 
enforcement agencies; it is also to provide it to the parties 
themselves for their own private enforcement efforts. Any other 
interpretation puts the courts in an untenable position--having an 
affirmative obligation to provide judgments in one form to parties and 
child support enforcement agencies and in another form to all other 
persons.
    This same reasoning applies to income tax returns or other 
documents containing SSNs filed in court. It would be unreasonable, and 
expensive, to expect courts to search every document filed for the 
existence of SSNs. Further, court staff has no authority altering 
documents filed in a case; the social security number may have 
evidentiary value in the case--at the very least to confirm the 
identity of the purported income tax filer.
    Case management information databases Data in automated information 
systems raises more privacy concerns than information in paper files. 
Automated data can be gathered quickly and in bulk, can be manipulated 
easily, and can be correlated easily with other personal data in 
electronic form. Data in an automated database can also be protected 
more easily from unauthorized access than data in paper files. It is 
feasible to restrict access to individual fields in a database 
altogether or to limit access to specific persons or to specific 
categories of persons. Consequently, state courts should take steps to 
restrict access to SSNs appearing in court databases. They should not 
be available to public inquirers. Access to them should be restricted 
to court staff and to other specifically authorized persons (such as 
child support enforcement agencies) for whose use the information has 
been gathered.
    Staff response to queries from the public When court automated 
records include SSNs for purposes of identifying parties, court staff 
should be trained not to provide those numbers to persons who inquire 
at the public counter or by telephone. However, staff may confirm that 
the party to a case is the person with a particular social security 
number when the inquirer already has the social security number and 
provides it to the court staff member.
    In short, staff may not read aloud a social security number, but 
may listen to a social security number and confirm that the party in 
the court's records is the person with that number. This is the same 
distinction applied to automated data base searches. This distinction 
is one commonly followed in federal and state courts.
CONCLUSION
    Mr. Chairman, we recognize the role of SSNs in the incidence of 
identity theft cases. The current state of affairs with regards to the 
treatment of SSNs provides lawbreakers the continued opportunity to 
exploit the current system at the expense of ordinary Americans. The 
threat of identity theft is real and we want to do our part to 
eliminate it.
    I have presented several ways our courts utilize SSNs. Finding 
solutions to protect an individual's privacy will be complex and 
difficult. Many state courts are already taking steps to fashion 
solutions in response to the problem. I remind you of the earlier 
mentioned approaches from Washington, Vermont, Minnesota and South 
Dakota. Other states are experimenting with different approaches.
    Thank you for asking for our input on this important matter. The 
Conference of State Court Administrators stands ready to work 
collaboratively and cooperatively to craft solutions to this important 
issue. I will be happy to answer any questions you may have.
                                 ______
                                 
    Example of South Dakota court rule to protect SSNs from public 
dissemination
UNIFIED JUDICIAL SYSTEM
COURT RECORDS rule
SDCL ch. 15-15A
SDCL 15-15A-1. Purpose of rule of access to court records.
    The purpose of this rule is to provide a comprehensive policy on 
access to court records. The rule provides for access in a manner that:
     (1) Maximizes accessibility to court records,
     (2) Supports the role of the judiciary,
     (3) Promotes governmental accountability,
     (4) Contributes to public safety,
     (5) Minimizes risk of injury to individuals,
     (6) Protects individual privacy rights and interests,
     (7) Protects proprietary business information,
     (8) Minimizes reluctance to use the court to resolve disputes,
     (9) Makes most effective use of court and clerk of court staff,
    (10) Provides excellent customer service, and
    (11) Does not unduly burden the ongoing business of the judiciary.
    The rule is intended to provide guidance to 1) litigants, 2) those 
seeking access to court records, and 3) judges, court and clerk of 
court personnel responding to requests for access.
SDCL 15-15A-2. Eho has access to court records under the rule.
    Every member of the public has the same access to court records as 
provided in this rule, except as provided otherwise by statute or rule 
and except as provided in  15-15A-7.
    ``Public'' includes:
    (1) any person and any business or non-profit entity, organization 
or association;
    (2) any governmental agency for which there is no existing policy, 
statute or rule defining the agency's access to court records;
    (3) media organizations.
    ``Public'' does not include:
    (4) court or clerk of court employees;
    (5) people or entities, private or governmental, who assist the 
court in providing court services;
    (6) public agencies whose access to court records is defined by 
another statute, rule, order, policy or database access agreement with 
the South Dakota Unified Judicial System;
    (7) the parties to a case or their lawyers regarding access to the 
court record in their case, which may be defined by statute or rule.
SDCL 15-15A-3. Definition of terms.
    (1) ``Court record'' includes any document, information, or other 
thing that is collected, received or maintained by a clerk of court in 
connection with a judicial proceeding. ``Court record'' does not 
include other records maintained by the public official who also serves 
as clerk of court or information gathered, maintained or stored by a 
governmental agency or other entity to which the court has access but 
which is not part of the court record as defined in this section.
    (2) Information in a court record ``in electronic form'' includes 
information that exists as: (a) electronic representations of text or 
graphic documents; (b) an electronic image, including a video image, of 
a document, exhibit or other thing; or (c) data in the fields or files 
of an electronic database.
    (3) ``Public access'' means that the public may inspect and obtain 
a copy of the information in a court record unless otherwise prohibited 
by statute, court rule or a decision by a court of competent 
jurisdiction. The public may have access to inspect information in a 
court file upon payment of applicable fees.
    (4) ``Remote access'' means the ability to electronically search, 
inspect, or copy information in a court record without the need to 
physically visit the court facility where the court record is 
maintained.
SDCL 15-15A-4. Applicability of rule.
    This rule applies to all court records, regardless of the physical 
form of the court record, the method of recording the information in 
the court record or the method of storage of the information in the 
court record.
SDCL 15-15A-5. General access rule.
    (1) Information in the court record is accessible to the public 
except and as prohibited by statute or rule and except as restricted by 
 15-15A-7 through 15-15A-13.
    (2) There shall be a publicly accessible indication of the 
existence of information in a court record to which access has been 
restricted, which indication shall not disclose the nature of the 
information protected, i.e., ``sealed document.''
    (3) An individual circuit or a local court may not adopt a more 
restrictive access policy or otherwise restrict access beyond that 
provided by statute or in this rule, nor provide greater access than 
that provided for by statute or in this rule.
SDCL 15-15A-6. Court records that are only publicly available at a 
        court facility.
    A request to limit public access to information in a court record 
to a court facility in the jurisdiction may be made by any party to a 
case, an individual identified in the court record, or on the court's 
own motion. For good cause, the court will limit the manner of public 
access. In limiting the manner of access, the court will use the least 
restrictive means that achieves the purposes of this access rule and 
the needs of the requestor.
SDCL 15-15A-7. Court records excluded from public access.
    The following information in a court record is not accessible to 
the public:
    (1) Information that is not to be accessible to the public pursuant 
to federal law;
    (2) Information that is not to be accessible to the public pursuant 
to state law, court rule or case law as follows;
    (3) Examples of such state laws, court rules, or case law follow. 
Note this may not be a complete listing and the public and court staff 
are directed to consult state law, court rules or case law. Note also 
that additional documents are listed below that may not be within court 
records but are related to the court system; the public and court staff 
should be aware of access rules relating to these documents.
    (a) Abortion records (closed);  34-23A-7.1
    (b) Abuse and neglect files and records (closed, with statutory 
exceptions);  26-8A-13
    (c) Adoption files and adoption court records (closed, with 
statutory exceptions);  25-6-15 through 25-6-15.3
    (d) Affidavit filed in support of search warrant (sealed if so 
ordered by court, see statutory directives);  23A-35-4.1
    (e) Attorney discipline records (closed until formal complaint has 
been filed with Supreme Court by the State Bar Association's 
Disciplinary Board or Attorney General, accused attorney requests 
matter be public, or investigation is premised on accused attorney's 
conviction of a crime);  16-19-99
    (f) Civil case filing statements (closed);  15-6-5(h)
    (g) Coroner's inquest (closed until after arrest directed if 
inquisition finds criminal involvement with death);   23-14-12
    (h) Custody or visitation dispute mediation proceedings pursuant to 
 25-4-60 (closed, inadmissible into evidence)
    (i) Discovery material (closed unless admitted into evidence by 
court)  15-6-26(c); 15-6-5(g)
    (j) Domestic abuse victim's location (closed, with statutory 
exception);  25-10-39
    (k) Employment examination or performance appraisal records 
maintained by Bureau of Personnel (closed);  1-27-1
    (l) Grand jury proceedings (closed with statutory exceptions);   
23A-5-16
    (m) Guardianships and conservatorships (closed with statutory 
exceptions);  29A-5-311
    (n) Involuntary commitment for alcohol and drug abuse (petition, 
application, report to circuit court and court's protective custody 
order sealed; law enforcement or prosecutor may petition the court to 
examine these documents for limited purpose);  34-20A-70.2
    (o) Judicial disciplinary proceedings (closed until Judicial 
Qualifications Commission files its recommendation to Supreme Court, 
accused judge requests matter be public, or investigation is premised 
on accused judge's conviction of either a felony crime or one involving 
moral turpitude); ch. 16-1A, Appx. III(1)
    (p) Juvenile court records and court proceedings (closed with 
statutory exception);  26-7A-36 through -38;  26-7A-113 through -116
    (q) Mental illness court proceedings and court records (closed);  
27A-12-25; 27A-12-25.1 through -32
    (r) Pardons (statutory exceptions, see  24-14-11)
    (s) Presentence investigation reports (closed);   23A-27-5 
through -10;  23A-27-47
    (t) Probationer under suspended imposition of sentence (record 
sealed upon successful completion of probation conditions and 
discharge);  23A-27-13.1; 23A-27-17
    (u) Records prepared or maintained by court services officer 
(closed except by specific order of court);  23A-27-47
    (v) Trade secrets (closed);  15-6-26(c)(7)
    (w) Trusts (sealed upon petition with statutory exceptions);  21-
22-28
    (x) Voluntary termination of parental rights proceedings and 
records (closed except by order of court);  25-5A-20
    (y) Wills (closed with statutory exceptions);  29A-2-515
    (z) Written communication between attorney and client; attorney 
work product (closed unless such privilege is waived); ch. 16-18, Appx. 
Rule 1.6
    (aa) Information filed with the court pending in camera review 
(closed)
    (bb) Any other record declared to be confidential by law;  1-27-3.
SDCL 15-15A-8. Confidential numbers and financial documents excluded 
        from public access.
    The following information in a court record is not accessible to 
the public.
    (1) Social security numbers, employer or taxpayer identification 
numbers, and financial account numbers of a party or party's child.
    (2) Financial documents such as income tax returns, W-2's and 
schedules, wage stubs, credit card statements, financial institution 
statements, credit card account statements, check registers, and other 
financial information.
SDCL 15-15A-9. Filing confidential numbers and financial documents in 
        court records.
    (1) Social security numbers, employer or taxpayer identification 
numbers, and financial account numbers of a party or party's child, 
where required to be filed with the court shall be submitted on a 
separate Confidential Information Form, appended to these rules, and 
filed with the pleading or other document required to be filed. The 
Confidential Information Form is not accessible to the public.
    (2) Financial documents named in  15-15A-8(2) that are required to 
be filed with the court shall be submitted as a sealed document and 
designated as such to the clerk upon filing. The Sealed Financial 
Documents Information Form appended to these rules shall be attached to 
financial documents being filed with the court. The Sealed Financial 
Documents Information Form is confidential and is not accessible to the 
public. The sealed financial documents will not be publicly accessible, 
even if admitted as a trial or hearing exhibit, unless the court 
permits access pursuant to  15-15A-10. The court may, on its own 
motion, seal financial documents that have been submitted without the 
Sealed Financial Documents Information Form.
    (3) Parties with cases filed prior to the effective date of this 
rule, or the court on its own, may, by motion, protect the privacy of 
confidential information as defined in  15-15A-8. Parties filing this 
motion will submit a completed Confidential Information Form or Sealed 
Financial Documents Information Form as appropriate.
SDCL 15-15A-10. Procedure for requesting access to sealed financial 
        documents.
    (1) Any person may file a motion, supported by affidavit showing 
good cause, for access to sealed financial documents. Written notice of 
the motion shall be required.
    (2) If the person seeking access cannot locate a party to provide 
the notice required under this rule, after making good faith reasonable 
effort to provide such notice as required by applicable court rules, an 
affidavit may be filed with the court setting forth the efforts to 
locate the party and requesting waiver of the notice provisions of this 
rule. The court may waive the notice requirement of this rule if the 
court finds that further good faith efforts to locate the party are not 
likely to be successful.
    (3) The court shall allow access to sealed financial documents, or 
relevant portions of the documents, if the court finds that the public 
interest in granting access or the personal interest of the person 
seeking access outweighs the privacy interests of the parties or 
dependent children. In granting access the court may impose conditions 
necessary to balance the interests consistent with this rule.
SDCL 15-15A-11. Requests for bulk distribution of court records.
    Dissemination of bulk information for resale is prohibited pursuant 
to  1-27-1. Any other bulk dissemination is prohibited except as 
authorized by the State Court Administrator or the Chief Justice of the 
Supreme Court.
SDCL 15-15A-12. Access to compiled information from court records.
    (1) Compiled information is defined as information that is derived 
from the selection, aggregation or reformulation by the Supreme Court 
of some of the information from more than one individual court record.
    (2) Any member of the public may request compiled information that 
consists solely of information that is publicly accessible and that is 
not already available in an existing report. The Supreme Court may 
compile and provide the information if it determines, in its 
discretion, that providing the information meets criteria established 
by the Court, that the resources are available to compile the 
information and that it is an appropriate use of public resources. The 
State Court Administrator's Office will make the initial determination 
as to whether to provide the compiled information.
    (a) Compiled information that includes information to which public 
access has been restricted may be requested by any member of the public 
only for scholarly, journalistic, political, governmental, research, 
evaluation, or statistical purposes.
    (b) The request shall a) identify what information is sought; b) 
describe the purpose for requesting the information and explain how the 
information will benefit the public interest or public education, and 
c) explain provisions for the secure protection of any information 
requested to which public access is restricted or prohibited.
    (c) The Supreme Court may grant the request and compile the 
information if it determines that doing so meets criteria established 
by the Court, is consistent with the purposes of the access rules, that 
the resources are available to compile the information, and that it is 
an appropriate use of public resources.
    (d) If the request is granted, the Supreme Court may require the 
requestor to sign a declaration that:
    (i) The data will not be sold or otherwise distributed directly or 
indirectly, to third parties, except for journalistic purposes;
    (ii) The information will not be used directly or indirectly to 
sell a product or service to an individual or the general public, 
except for journalistic purposes; and
    (iii) There will be no copying or duplication of information or 
data provided other than for the stated scholarly, journalistic, 
political, governmental, research, evaluation, or statistical purpose.
    The Supreme Court may make such additional orders as may be needed 
to protect information to which access has been restricted or 
prohibited.
SDCL 15-15A-13. Requests to prohibit public access to information in 
        court records.
    A request to prohibit public access to information in a court 
record may be made by any party to a case, the individual about whom 
information is present in the court record, or on the court's own 
motion. Notice of the request must be provided to all parties in the 
case and the court may order notice be provided to others with an 
interest in the matter. The court shall hear any objections from other 
interested parties to the request to prohibit public access to 
information in the court record. The court must decide whether there 
are sufficient grounds to prohibit access according to applicable 
constitutional, statutory and common law. In deciding this the court 
should consider the purpose of this rule as set forth in  15-15A-1. In 
restricting access, the court will use the least restrictive means that 
will achieve the purposes of this access rule and the needs of the 
requestor.
SDCL 15-15A-14. When court records may be accessed.
    (1) Court records will be available where available for public 
access in the courthouse during hours established by the court. Court 
records in electronic form to which the court allows remote access 
under this rule will be available for access at least during the hours 
established by the court for courthouse access, subject to unexpected 
technical failures or normal system maintenance announced in advance.
    (2) Upon receiving a request for access to information the court 
will respond within a reasonable time regarding the availability of the 
information and provide the information within a reasonable time.
SDCL 15-15A-15. Fees for accessing court records.
    The Supreme Court may charge a fee for access to and copies of 
court records in electronic form, for remote access or compiled 
information. The fee shall be reasonable and may include costs for 
labor, materials and supplies. Fees for record searches are set forth 
in  16-2-29.5. Some entities, and other entities under certain 
conditions, are exempt from paying a record search fee pursuant to  
16-2-29. Copying and certification fees shall be charged as determined 
by statute or Supreme Court Rule.

CONFIDENTIAL INFORMATION FORM (Required by SDCL 15-15A-9)

_________________________      Case No. ________

Plaintiff / Petitioner
_________________________

Defendant / Respondent

    The information on this form is confidential and shall not be 
placed in a publicly accessible portion of a court record.

NAME ____________________________________

SOCIAL SECURITY NUMBER  ________________________

EMPLOYER IDENTIFICATION NUMBER ___________________

TAXPAYER IDENTIFICATION NUMBER ___________________

FINANCIAL ACCOUNT NUMBERS:
                                                 ______________________

Plaintiff / Petitioner
                                         ______________________________

                                         ______________________________

1.  ____________   ____________   ____________

2.  ____________   ____________   ____________

3.  ____________   ____________   ____________

Defendant / Respondent
                                            ___________________________

                                            ___________________________

1.  ____________   ____________   ____________

2.  ____________   ____________   ____________

3.  ____________   ____________   ____________

Other Parties (including minor children)
                                                    ___________________

                                                    ___________________

1.  ____________   ____________   ____________
  
2.  ____________   ____________   ____________

3.  ____________   ____________   ____________

4.  ____________   ____________   ____________

Information supplied by:
                                            ___________________________

Signed:
                                   ____________________________________

Firm:
                                   ____________________________________

Address:
                                    ___________________________________

                               ________________________________________

Date:
                                  _____________________________________

SEALED FINANCIAL DOCUMENTS INFORMATION FORM (Required by SDCL 15-15a-9)

_________________________      Case No. ________

Plaintiff / Petitioner

_________________________

Defendant / Respondent

The information on this form is confidential and shall not be placed in 
a publicly accessible portion of a court record.

      __________ Income Tax Records

                           Period Covered:

      __________ Financial Account Statements

                           Period Covered:

      __________ Wage Stubs

                           Period Covered:

      __________ Credit Card Account Statements

                           Period Covered:

      __________ Other

Information supplied by:
                                            ___________________________
Signed:
                                   ____________________________________

Firm:
                                   ____________________________________

Address:
                                    ___________________________________

                               ________________________________________

Date:
                                  _____________________________________

                                 

    Chairman MCCRERY. Thank you, Ms. McQueen. Mr. Stein?

STATEMENT OF ERIK STEIN, EXECUTIVE VICE PRESIDENT AND DIRECTOR, 
 FRAUD RISK MANAGEMENT, COUNTRYWIDE FINANCIAL CORPORATION, ON 
       BEHALF OF BITS FRAUD REDUCTION STEERING COMMITTEE

    Mr. STEIN. Thank you. Good afternoon, Chairman McCrery and 
Members of the Subcommittee. My name is Erik Stein. I am 
Executive Vice President and Director of Fraud Risk Management 
at Countrywide, America's largest residential mortgage lender 
and servicer, currently responsible for preventing, detecting, 
investigating, mitigating, and reporting on criminal conduct 
by, through, or within Countrywide Financial Corporation and 
its member family of companies.
    I am pleased to appear before you today on behalf of BITS 
and the Financial Services Roundtable to discuss the role of 
SSNs in identity theft and SSN privacy. I have submitted a more 
detailed written statement for the record, but would like to 
highlight five key points in my oral statement.
    First, SSNs have evolved, regardless of their original 
intent, to become the de facto unique identifier that today 
accompanies most consumers from cradle to grave. SSNs provide 
the link to associate consumers to their financial accounts, 
credit reports, public records, and a host of other critical 
relationships. SSNs are essential to financial institutions to 
meet various statutory obligations, such as knowing their 
customers, report tax-related activity, conduct financial 
crimes investigations, screen prospective employees, and more. 
All of these functions help keep our customers and their 
financial assets safe and ensure the security and reliability 
of the economy.
    Second, SSNs play a pivotal role in the accurate 
determination of an individual. With millions of citizens in 
America, the SSN is the single unique identifier common to them 
all. However, it is important to note that the verification of 
the SSN is not the same as the verification of identity. 
Verification of identity is accomplished through the use of 
other government-issued documentation, including drivers' 
licenses and passports, which financial institutions require to 
open accounts and make loans. However, financial institutions 
have not been afforded the tools to ensure the validity of SSNs 
and these other documents presented for identity verification 
even though the institutions are required by the USA PATRIOT 
Act (P.L. 107-56) to know their customers.
    That brings me to my third point, which is the proposed 
consent-based SSN verification, or CBSV program recently 
established by the SSA, is a critical first step in 
facilitating identity verification. The program allows 
verification of the SSN along with the corresponding name and 
date of birth provided by consumers to SSA's database. I and 
other fraud reduction professionals strongly encourage the 
Subcommittee to actively support the CBSV program and we urge 
the SSA to remove restrictions on the daily submission volume 
by participants, work to improve the proposed response times, 
eliminate the requirements for a stand-alone consumer 
authorization, allowing the authorization to be incorporated 
into loan or account documents, and review the cost structure. 
These changes would allow participants to consistently use CBSV 
on every new relationship, reducing fraud, identifying errors, 
and lowering costs.
    Fourth, criminals know the intrinsic value of SSNs in 
committing identity theft and other crimes. The sad reality is 
that criminals in search of identities with which to commit 
identity theft can readily obtain them through many means. For 
example, all a criminal need do is steal mail in January, when 
millions of 1099s and 1098s are distributed to taxpayers. These 
forms are required by statute to display the SSN and for 
mailing purposes must have the recipients' name and address. We 
recommend that Congress review statutory obligations that 
require the printing of SSNs on any documents to determine if 
the risk of compromise exceeds the value derived, and if so, 
enact changes to remove these obligations.
    My final point is that we should be mindful of the 
unintended consequences that could result from restricting the 
use of SSNs among legitimate businesses. Decreasing financial 
institutions' abilities to use SSNs could potentially lead to 
increased fraud, increased lending costs, decreased loan 
approval rates, and a myriad of other unforeseen results. It is 
important for Congress, the SSA, and other agencies to 
thoroughly consider the potential consequences and adverse 
impact such restrictions could have on commerce.
    In closing, it is important to note that through BITS, the 
financial services industry has been aggressive in efforts to 
mitigate identity theft, reduce fraud, and strengthen cyber 
security by working together to share information, analyze 
threats, and implement best practices. We need essential tools 
such as the CBSV program to continue these efforts.
    Thank you for the opportunity to testify before you today. 
I would be happy to answer any questions.
    [The prepared statement of Mr. Stein follows:]
    Statement of Erik Stein, Member, BITS Fraud Reduction Steering 
                               Committee
Introduction
    Good afternoon Chairman McCrery and members of the Subcommittee. My 
name is Erik Stein. I am Executive Vice President and Director of Fraud 
Risk Management at Countrywide Financial Corporation, America's largest 
residential mortgage lender and servicer. I have over 25 years of 
banking, credit card, mortgage lending and dot com experience and am 
currently responsible for preventing, detecting, investigating, 
mitigating and reporting on criminal conduct by, through or within 
Countrywide and its family of companies.
    I am pleased to appear before you today on behalf of BITS and its 
Fraud Reduction Steering Committee (FRSC) to discuss the role of Social 
Security Numbers (SSNs) in identity theft and enhancing SSN privacy.
    BITS is a nonprofit industry consortium of 100 of the largest 
financial institutions in the U.S. BITS is the non-lobbying division of 
The Financial Services Roundtable. BITS' mission is to serve the 
financial services industry's needs at the interface between commerce, 
technology and financial services. BITS' member companies provide fuel 
for America's economic engine, accounting directly for $40.7 trillion 
in managed assets, $960 billion in revenue, and 2.3 million jobs. BITS 
works as a strategic brain trust to provide intellectual capital and 
address emerging issues where financial services, technology and 
commerce intersect. BITS focuses onkey issues where industry 
cooperation serves the public good, such as critical infrastructure 
protection, fraud prevention, and the safety of financial services. 
BITS' activities are driven by the CEOs and their direct reports--CIOs, 
CTOs, Vice Chairmen and Executive Vice President-level executives of 
the businesses.
    Especially relevant to today's testimony, the mission of the BITS 
Fraud Reduction Steering Committee (FRSC) is to identify fraudulent 
trend activity, reduce fraud losses, and foster new opportunities to 
reduce the impact of fraud on the financial services industry and our 
customers. Participants in the BITS Fraud Reduction Steering Committee 
include representatives from financial institutions, industry 
associations and the Federal Reserve.
    BITS works with government organizations including the U.S. 
Department of Homeland Security, U.S. Department of the Treasury, 
federal financial regulators, Federal Reserve, technology associations, 
and major third-party service providers to achieve its mission.
    BITS is also a founding and active member of the Financial Services 
Sector Coordinating Council for Critical Infrastructure Protection and 
Homeland Security (FSSCC). The mission of the FSSCC is to:

      Foster and facilitate the coordination of financial 
services sector-wide voluntary activities and initiatives designed to 
improve Critical Infrastructure Protection and Homeland Security
      Identify voluntary efforts where improvements in 
coordination can foster sector preparedness
      Identify barriers and recommend initiatives to improve 
sector-wide knowledge sharing and timely dissemination of critical 
information among all sector constituents
      Promote public trust and confidence in the financial 
services sector's ability to withstand and recover from terrorist 
attacks, cybercrime, and natural disasters.

    The financial services industry has been aggressive in its efforts 
to strengthen cyber security, reduce fraud, and mitigate identity 
theft. Members of BITS are sharing information, analyzing threats, 
creating best practices, urging the software and technology industries 
to do more to provide more secure products and services, and combating 
fraud and ID theft. As just one example of these efforts, the Identity 
Theft Assistance Center (ITAC), which BITS and the Financial Services 
Roundtable established in 2004, recently announced that it had helped 
over 5,000 individuals in restoring their financial identity.
SSNs: A Unique Identifier
    SSNs have evolved, regardless of original intent, to become the de 
facto unique identifier for consumers. This number is the only unique 
identifier that today accompanies most consumers from cradle to grave. 
SSNs remain a constant in an ever-changing world of name change from 
marriage and divorce, shifting addresses, and driver's license re-
issuance as consumers move from one state to another. SSNs are used in 
efforts to ensure the accurate association of financial accounts, 
credit reports, public records, medical records and a host of other 
critical relationships and services to a consumer.
Critical Role of SSNs for Financial Institutions
    The use of SSNs by financial institutions is essential to satisfy a 
variety of statutory obligations such as to report earned interest 
income and deductible interest payments on mortgages for millions of 
American consumers. In addition, SSNs facilitate practical realities 
such as accessing credit reports to determine creditworthiness, 
performing due diligence on business partners and correspondent banks 
and, as required by the USA Patriot Act, performing enhanced due 
diligence on politically-exposed persons (PEP).\1\
---------------------------------------------------------------------------
    \1\ The Federal Financial Institutions Examination Council's 
(FFIEC) Bank Secrecy Act Anti-Money Laundering Examination Manual 
defines a PEP as ``a person identified in the course of normal account 
opening, maintenance or compliance procedures to be a `senior foreign 
political figure,' any member of a senior foreign political figure's 
`immediate family,' and any `close associate' of a senior foreign 
political figure.''
---------------------------------------------------------------------------
    Under the USA Patriot Act, financial institutions are obligated to 
``know their customer,'' and to take steps to verify the identity of 
account holders. In addition, financial institutions perform due 
diligence on business partners and vendors. One of the integral parts 
of compliance with these obligations often involves the use of public 
records which are searched by use of the SSN, or, in the case of 
business, EIN, to ensure that the results returned are unique to the 
subject of the due diligence.
    After the customer's identity has been verified and the 
relationship has been established, many financial institutions utilize 
the SSN internally to track the customer's relationship with the 
financial institution across multiple accounts and for a variety of 
legitimate internal business reasons. This legitimate, internal 
business use should remain exempt from additional limitations.
    Criminal investigations initiated by financial institutions are 
facilitated by the availability of SSNs both in the financial 
institution's database and in public records. Public records are 
frequently used by financial institutions' staff during the 
investigation of potential criminal conduct. During the investigation, 
the SSN is the single most reliable method of identification, 
correlation and association of the perpetrators to their public 
records, which often provide critical details imperative to solving the 
crime and locating the suspect(s). The loss of this valuable tool would 
jeopardize the effective investigation of financial crimes.
    Financial institutions and other businesses routinely screen 
prospective employees to verify identity, validate applicant employment 
and education history, and check for criminal conduct prior to 
extending job offers. These background checks, particularly in high-
risk occupations or vulnerable industries, can reduce the incidence of 
criminal infiltration, potential workplace violence and security risks, 
including customer data security and privacy risks. The SSN is critical 
in verifying a potential employee's background and allows for the 
ongoing monitoring of employees in high-risk positions. Without the use 
of a SSN, financial institutions would find it very difficult to adhere 
to a ``know your employee'' standard.
SSN Verification: A Key Tool for Successful Identity Determination of 
        Customers
    SSNs play a pivotal role in identity determination: the 
establishment and verification of the identity of unique persons with 
whom financial institutions, and others, conduct business. With 
millions of John Smiths in America, the identity determinate of which 
John Smith with whom a financial institution is dealing is made by the 
single unique identifier common to all Americans, his SSN.
    Importantly, financial institutions realize that the ability to 
successfully verify John's SSN is not the same as successfully 
determining his identity. A financial institution must do this through 
the use of identification documents such as driver's license, passport 
and other, typically government-issued, identity documents containing a 
picture, signature, expiration date, security features, a physical 
description, etc. It should be noted that SSNs have not been used for 
identity verification due to the lack of a highly secure SSN card, 
tamper-proof signature, picture and expiration. The SSN card contains 
few security features making it easy to counterfeit and reducing or 
eliminating any value in its use for identity verification. The SSN is 
thus only a tool, albeit an invaluable one, in the process of 
determining the identity of an individual. It is clear, however, that 
verification is a key tool for achieving positive identity 
determination.
Value of the SSN to Criminals
    The critical role of SSNs is the fundamental reason for their 
intrinsic value to criminals' intent on committing crimes. Criminals 
utilize SSNs in the commission of identity theft. Identity Theft may be 
divided into ``true name'' fraud where the perpetrator uses the 
``true'' identity of a consumer, or identity fraud where combinations 
of consumer's identities are pieced together or even fabricated to 
create a synthetic identity, a new person.
    It is important to recognize that criminals committing identity 
fraud don't need to steal or purchase SSNs to commit their crime. The 
structure of the SSN is common knowledge to anyone who has ever had, or 
seen, one or checked the Social Security Administration's (SSA) website 
(i.e. http://policy.ssa.gov/poms.nsf/lnx/0100201030?opendocument.) 
Valid SSNs can be determined by checking the SSA's website for the 
highest group issuance http://www.socialsecurity.gov/employer/
highgroup.txt. By selecting a recently issued SSN, and applying for 
credit, a criminal creates an identity with the Credit Reporting 
Bureaus (for which there will be no conflicting SSN information since 
the valid SSN holder is an infant).
    Since financial institutions and lenders don't have the ability to 
verify the SSN, name and date of birth combinations (other than the 
current Enumeration Verification System pilot in the mortgage industry 
which is not a robust, enterprise-strength, low cost, timely 
verification process and therefore narrowly used), the identity thief 
is unlikely to be caught. Restrictions on the sale and purchase of SSNs 
would do little to prevent this type of fraud. The fraud also doesn't 
rely on the theft of SSNs from their legitimate owner.
    BITS members would encourage the Subcommittee to remove the highest 
group issuance list from the public domain and make it available to 
financial institutions and others with a legitimate business need on a 
subscription basis as is currently done with SSA's Death Master File. 
While this list is an essential tool today to validate SSNs provided to 
financial institutions, its potential use by criminals is inconsistent 
with its availability to the general public.
    Another area of risk is that criminals in search of identities for 
committing true name fraud can readily obtain name, address, SSN and 
account number combinations by mail theft during January each year when 
millions of account holders and borrowers receive their 1099's or 1098. 
By statute, these tax forms are required to display the account 
holder's SSN, and, for mailing purposes, must have the recipient's name 
and address along with the account number to identify the account for 
which the form has been filed. These forms are mailed en masse by 
financial institutions at the beginning of the year for use in 
requisite income tax filing by the consumer thereby making for a 
target-rich environment for obtaining identities through mail theft.
Combating Identity Theft through SSN Verification
    For decades, financial institutions have required SSNs and identity 
documents to open accounts, make loans and accept transactions by their 
customers. However, the industry has been relegated to validation 
methods that do not, and cannot, validate the existence of, and their 
association with, a consumer's personal identifiers (such as name, date 
of birth and gender). For SSNs, financial institutions have relied on 
rules that determine if the SSN had been issued (the highest group 
issuance list referenced above available from SSA), that the SSN holder 
had not been reported deceased (SSA's Death Master File), and that the 
holder was not born after the issuance of the SSN by SSA (from 
historical highest group issuance lists). The single most important 
validation has been unavailable, that the consumer presenting the 
number is the holder of record in SSA's database.
    The proposed Consent-Based SSN Verification (CBSV) program recently 
published for public comment by the SSA is an extension of the 
Enumeration Verification System pilot and is a critical effort to allow 
financial institutions to verify SSNs. It will allow financial 
institutions to verify the SSN holder's name and date of birth against 
SSA's database. Establishing a system capable of high volume, low cost, 
real time verification direct to financial institutions and lenders 
would significantly reduce the incidence of synthetic identities. 
``True name'' identity theft would become more difficult with the 
validation of date of birth and the optional gender code by financial 
institutions utilizing a CBSV program.
    BITS' members strongly encourage the Subcommittee to support the 
CBSV program.\2\ We also request that the SSA evaluate the removal of 
restrictions on the daily volume of submissions by participants, work 
towards improving the proposed response times, eliminate requirements 
for a standalone consumer authorization allowing incorporation of the 
authorization into loan or account documents, and review the cost 
structure.
---------------------------------------------------------------------------
    \2\ Attached is the BITS/Financial Services Roundtable Comment 
Letter on the Social Security Administration's Consent-Based Social 
Security Verification Process (February 2006)
---------------------------------------------------------------------------
    Consumers would benefit from industry's ability to verify SSN 
information by reducing the incidence of fraud and errors. Erroneous 
data entry of consumer's SSNs would also be easily determined, reducing 
the incidence of erroneous tax reporting on interest earned and 
deductible interest expense and reducing the quantity of consumers 
required to be subjected to annual solicitation for a corrected SSN due 
to mismatches submitted to the IRS and misrepresentation.
    Further, the BITS members, due to the high perceived value of CBSV, 
would also encourage the consideration of federal legislation to 
mandate similar programs related to other governmental identity 
documents used in the financial industry to verify consumers including 
U.S. passports, alien registration documents (e.g. Non-Resident Alien 
card) and state driver's licenses. Financial institutions, while under 
obligations to know their customer under the USA Patriot Act, have not 
been afforded the tools to ensure the validity of the documents 
presented for identity verification. We have had to rely exclusively on 
the appearance of legitimacy (e.g. verification of security features, 
visual inspections or tests that validate the structure of a driver's 
license number but, again, not the name of the true license holder).
Unintended Consequences for Limiting Use of SSNs
    The critical roles of SSNs for use in financial institutions, 
investigations, public records, lending, account servicing, tax 
reporting and much more makes the availability and use of the SSN for 
legitimate business uses an imperative. It is important that additional 
proposed restrictions on the use, sale and purchase of SSNs be 
thoroughly evaluated to ensure that unintended consequences do not 
occur. This could include potential increases in fraud; economic 
impacts from increased lending costs; and decreased loan approval rates 
and other adverse implications to commerce.
Conclusion and Recommendations
    In summary, the use of SSNs is critically important to the 
financial services industry. They allow financial institutions to meet 
various statutory obligations such as knowing who their customers, 
employees, and business associates are; reporting earned interest 
income and deductible interest payments on mortgages; and satisfying 
due diligence expectations as set forth by statutory obligations. All 
of these functions are performed to keep our customers and their 
financial assets safe, and to ensure the security and reliability of 
the economy.
    On behalf of BITS and our member financial institutions, we 
encourage Congress to:

      Continue to allow financial institutions to use SSNs 
without additional restrictions and limitations;
      Exercise caution if changes are considered, to be 
especially alert to unintended consequences such as increased fraud;
      Support a verification program capable of high volume, 
low cost, real time verification in a manner consistent with customers' 
demands; and
      Review statutory obligations that require the printing of 
SSN's (e.g. 1098, 1099) to determine if the risk of compromise exceeds 
the value derived and, if so, enact changes to remove these 
obligations.

    Thank you for the opportunity to testify before you today. I would 
be happy to answer any questions.
                                 ______
                                 
February 26, 2006
Office of Management and Budget (OMB)
Attn: Desk Officer for SSA
Fax: 202-395-6974
Social Security Administration, DCFAM,
Attn: Reports Clearance Officer
Fax: 410-965-6400
E-mail: [email protected]
Re: Comment to Consent Based Social Security Number Verification (CBSV) 
Process

Dear Sirs and Madams:

    BITS and The Financial Services Roundtable appreciate the 
opportunity to participate in the Social Security Administration's 
(SSA) request for comment regarding the Consent Based Social Security 
Number Verification (CBSV) Process.
    BITS and The Financial Services Roundtable share membership and 
represent 100 of the largest integrated financial services companies 
providing banking, insurance, and investment products and services to 
the American consumer. Member companies participate through the Chief 
Executive Officer and other senior executives nominated by the CEO. 
BITS works to leverage the intellectual capital of its members, 
fostering collaboration to address emerging issues where financial 
services, technology, and commerce intersect. The Roundtable promotes 
the interests of member companies in legislative, regulatory and 
judicial forums. Roundtable member companies provide fuel for America's 
economic engine, accounting directly for $40.7 trillion in managed 
assets, $960 billion in revenue, and 2.3 million jobs.
    Our members have always been a favorite target for perpetrators of 
fraud. Institutions have long answered this challenge with reliable 
business controls, advanced technology, information sharing, and 
cooperative efforts with government and law enforcement agencies. While 
our members' foremost concern is to protect their customers and 
maintain their trust, they are also mindful of the need to comply with 
the regulations set forth by Section 326 of the Patriot Act. This 
section requires institutions to verify not only the identity of a 
customer, but also the accuracy of the information provided.
    In the interest of reducing fraud and complying with Section 326 of 
the Patriot Act, BITS members supported the initial pilot, the 
Enumeration Verification System (EVS), to allow institutions to 
affirmatively verify consumer's name, social security number and date 
of birth (DOB). This pilot provided a means to ensure accounts were 
opened for the legitimate consumer and not a ``fraudster'' and we 
applaud the SSA's efforts to provide enhancements in the form of the 
CBSV that would benefit our customers and our industry.
    After careful review of the information collection process outlined 
in the December 30, 2005 Federal Register, we respectfully offer the 
following comments:
``Valid Consent from Number Holders''
    There is concern that, since the CBSV is designed to verify a 
person's Social Security Number (SSN) to their name (and potentially 
DOB), there may be instances where financial institutions are misled 
and the consent is not from the true applicant as may be the case in 
identity theft or identity manipulation. There should be 
acknowledgement that while financial institutions have established a 
process for verification, there is still an opportunity for applicants 
to provide false information. This verification process is fundamental 
to ensuring the name, SSN, and DOB (optionally) match the authorizing 
consumer. While we understand the use of ``valid consent from number 
holders,'' we want to ensure that there are no consequential impacts to 
financial institutions from the fraudulent completion of consent 
authorizations.
Inclusion of Gender Code
    The public comment details the submission as consisting of a name, 
SSN and DOB (if available) and the results provide a match to name, 
SSN, date of birth and gender code (which is not part of the 
submission). Clarity needs to be provided on whether gender code is 
intended to be a submitted/verified field.
Full Name Matching
    While SSN, DOB (and possibly gender assuming it is used) are unique 
variables, one's name is subject to wide variation. It is suggested 
that the full first and full last be used for matching and that a 
secondary field be available for each that could include a nickname, 
shortened name (Jim vs. James) and last name. The use of a secondary 
field for name matching would reduce the incidence of re-running 
queries; improve match rates including where Soundex matching is 
utilized and the name variation is not conducive to such matching 
logic; and would accommodate name changes due to marriage, divorce, 
etc. which may not yet have been reported to SSA.
Real-time vs. Batch Submissions
    SSA had indicated its intention to continue the practice of EVS in 
providing the results of inquiries by Requesting Parties within 48 
hours while not guaranteeing such response time. Institutions believe 
there is strong value in having real-time capabilities and encourage 
the SSA to evaluate methods to provide this verification service in 
real-time as soon as feasible. If batch submissions remain exclusively 
available, members strongly encourage SSA to provide a response, to 
inquiries submitted before midnight, by no later than 5am the following 
business morning consistent with other batch jobs run by financial 
institutions for fraud detection, verification and posting.
Daily Limitation of Records and Expectation of Volume
    While strongly supportive of CBSV, we urge the SSA to reconsider 
the daily limitation of 5,000 records. One of the inherent values of an 
automated system of SSN verification is its scalability. With 
scalability in mind, we recommend the SSA remove the daily limitation.
    Should hardware limitations be reached by the overwhelming success 
and adoption of CBSV, the SSA should charge registered user businesses 
sufficient additional fees to allow the SSA to meet this demand. This 
linear scalability should also keep the cost per inquiry low. We 
believe that SSA's expectations of demand for CBSV are substantially 
below the industry's need for this verification solution. We encourage 
the SSA to revise its expectations and lower the cost of entry for 
business by reducing the initial fee of $40,288.10. While the basis for 
SSA's expectation of only 150 business users for CBSV is not explained 
in the publicly available documents, we believe that, with nearly 9,000 
FDIC-insured financial institutions alone in the U.S., 5,000 business 
users is both reasonable and sustainable. This would lower the initial 
cost of entry to $1,208.64. However, to both encourage maximum 
participation and guarantee SSA's financial support of the program, we 
recommend the initial fee be set at $10,000.
Document Requirements
SSA-89--Authorization for the Social Security Administration (SSA) To 
        Release Social Security Number (SSN) Verification
    Evidence of consumer authorization to verify their SSN is clearly 
both an obligation of the Requesting Party and a necessary privacy 
safeguard. However, the requirement for a standalone SSA-89 evidencing 
said authorization provides no additional safeguard over an obligation 
for equivalent language, approved by the SSA prior to usage, 
incorporated into account or loan documents. In addition, this document 
(SSA-89) cannot be incorporated into loan documents, account signature 
cards or any other documents. For efficiency and enhancement purposes, 
institutions must be able to incorporate the authorization language 
into existing documents that allows them to run the SSN which can then 
be retained for six years from the authorization date.
    The existing retention of these underlying documents already, in 
most cases, meets or exceeds the SSA minimum retention requirement. 
Where the existing document retention is shorter than SSA-89's 
retention requirement, Requesting Parties will voluntarily comply with 
modification of their retention schedules to achieve the efficiencies 
afforded by merging these documents with the CBSV authorization. The 
SSA should consider inclusion of specific authorization of the SSN 
owner for electronic signature in accordance with the Electronic 
Signatures in Global and National Commerce Act (ESIGN). SSA's existing 
allowance of storage of the SSA-89 electronically would be consistent 
with the use of ESIGN for electronification of the authorization 
process with inherent increased efficiency.
    SSA-89 cannot be modified by the Requesting Party. The defined term 
can be modified by agreement as specified in the User Agreement, by 
agreement of the parties executing the Authorization and documented 
therein. These two statements are mutually exclusive. We recommend SSA 
clearly delineate the method by which Authorization term extension is 
to be documented so the Requesting Party can ensure compliance with 
SSA's requirements.
SSA-88--Pre-Approval Form for CBSV
    The Requesting Party has a contractual obligation to protect the 
integrity of SSA's systems, utilize information requested only for 
authorized purposes, and to be authorized by the Requesting Party in 
accordance with their internal approval policies. The need for 
completion of form SSA-88 for each employee in a large company that has 
access to the results of the inquiry is overly burdensome and 
inefficient. We strongly encourage the SSA to make user administration 
for Requesting Parties an obligation of authorized employees of the 
Requesting Party and managed through a user interface in Business 
Services Online (BSO). All service providers to the financial services 
industry allow the participant to manage their employees' access. The 
BSO administrative user interface can be designed so as to require the 
data elements mandated by SSA (e.g. name, SSN, phone number, and email 
address of each employee) with appropriate electronic attestation by 
the authorized admin user during new user setup. Maintenance (e.g. 
changes to the existing information as a result of job status changes, 
phone or email changes) and deletion (e.g. termination of the employee 
or job status changes no longer requiring access) can likewise be 
accomplished through the BSO administrative user interface by the 
authorized employee of the Requesting Party. This process is much more 
conducive to large scale employers who may have thousands of employees 
authorized to access the information from SSA during the processing of 
accounts or loans.
SSA-1235--Agreement Covering Reimbursable Services
    SSA-1235 is ``effective upon signature of both parties and shall 
remain in effect until one or more of the following events occur. . . 
.'' While the Agreement is continuously in effect (barring one of the 
events listed), SSA requires an annual resubmission of the Agreement. 
The resubmission appears inconsistent with an Agreement with no defined 
term. We recommend the SSA eliminate the annual submission requirement 
for form SSA-1235. The provision of the annual fee as defined by SSA 
each year should be sufficient evidence of the Requesting Party's 
intent to continue the Agreement. The Conditions of Agreement, 
paragraph 6, stipulates that the Authorization ``must be presented 
within 60 days after its execution,'' however the Authorization itself 
indicates it ``is valid only for 90 days from the date signed. . . .'' 
These statements are incongruous and we recommend the SSA reconcile 
these documents to a consistent period of 90 days. The Conditions of 
Agreement, paragraph 8, stipulates the Agreement may be terminated ``by 
giving a 60 day advance written notice.'' However, Section XI. Duration 
of Agreement, Suspension of Services, Annual SSA-1235 of the User 
Agreement specifies ``the Agreement shall terminate 30 days after the 
date of the notice or at a later date specified in the notice.'' We 
recommend the SSA reconcile this discrepancy by establishing a 
consistent 30 day written notice requirement for termination.
Submission of Requests
    The CBSV User Guide establishes the file format for submission of 
requests by the Requesting Party to SSA. The file format contains a 
field for a ``Multiple Request Sequence Number''; however, the SSA 
limits the number of file submissions by a Requesting Party to one. 
Since only one file can be submitted daily, there would never be a need 
for this field. If the field is anticipated for future use when 
Requesting Parties may be allowed multiple daily file submissions, we 
suggest ``Future Use'' indicated in the description for this field to 
remove ambiguity.
    If you have any further questions or comments on this matter, 
please do not hesitate to contact us or Heather Wyson at (202) 289-
4322.
            Sincerely,
                                                 Catherine A. Allen
                                                          CEO, BITS

                                                 Richard M. Whiting
                             Executive Director and General Counsel

                                 

    Chairman MCCRERY. Thank you, Mr. Stein. Mr. Pratt?

  STATEMENT OF STUART K. PRATT, PRESIDENT AND CHIEF EXECUTIVE 
          OFFICER, CONSUMER DATA INDUSTRY ASSOCIATION

    Mr. PRATT. Mr. Chairman and Members of the Committee, thank 
you for this opportunity to appear before you today to discuss 
the importance of SSNs. For the record, my name is Stuart Pratt 
and I am President and CEO of the Consumer Data Industry 
Association.
    We applaud this Committee for the thoughtful and open 
dialog regarding how SSNs are used and to identify risks 
associated with such use. Before I discuss how our members' 
systems make use of the SSN, let us just consider how 
demographics in our society really explain why the SSN is so 
important.
    First, identifiers in everyday life do change and do so 
more often than we might think. Over 40 million addresses 
change every year in this country. More than three million last 
names change due to marriage and divorce. We use our 
identifiers inconsistently. We don't do so purposefully, but a 
simple example is our choice to use a nickname in some 
transactions but to use our full name in others. Our name is 
not as unique as we might think. There are millions and 
millions of Smiths and Joneses in this country, and, in fact, 
more than 13 million consumers have only one of ten very common 
last names. Another 57 million males have only one of ten 
common first names.
    We provide other examples of how personal information 
changes in our written testimony, and by taking into account 
all of these facts, it really does become very apparent why the 
SSN is the key to stabilizing consumers' identifying 
information in the context of databases. The SSN is truly a 
unique identifier.
    Let us discuss how the use of the SSN works within our 
members' systems. Our members design products for 
determinations of a consumer's eligibility for a product or 
service, to prevent fraud, and to aid in the location of 
consumers for a variety of reasons. These products bring great 
value to us as consumers every day. Eligibility products, such 
as a credit or employment report, for example, lead to 
definitive decisions.
    These reports are regulated under the Fair Credit Reporting 
Act (P.L. 91-508). The FCRA imposes a duty that consumer 
reporting agencies employ reasonable procedures to ensure the 
maximum possible accuracy of the information in the report, and 
the SSN plays a vital role in helping our members to achieve 
this maximum possible accuracy standard. Absent the use of the 
SSN as a key identifier, consumers would be harmed in many ways 
through the exclusion or inclusion of information.
    Our members also produce products regulated under other 
laws, such as the Gramm-Leach-Bliley Act. Fraud prevention 
systems, for example, employ a diversity of strategies. The SSN 
plays an important role. In 2004 alone, businesses conducted 
more than 2.6 billion searches to check for fraud. The largest 
users of fraud detection systems are, in fact, financial 
services companies, accounting for about 78 percent of the 
transactions, but there were others users. 5.5 million location 
searches were conducted by child support enforcement agencies, 
378 million searches to enforce contracts to pay, tens of 
millions of searches were used by pension funds, blood donor 
organizations, and by organizations focused on missing and 
exploited children. The availability and permitted use of the 
SSN remains vital across this entire spectrum of consumer data 
products.
    Consumers and media often assume that the SSN is fully 
unregulated and, of course, this is not the case. As we have 
discussed, laws such as the FCRA and the Gramm-Leach-Bliley Act 
do regulate our members' products. However, we recognize that 
similar protections don't exist for all, and the SSN is 
sensitive personal information that must be protected. We 
believe that a national uniform system to establish information 
safeguards should be enacted so that anyone possessing 
sensitive personal information, such as an SSN in combination 
with my name and address, that they would be obligated to 
protect that information. There are a number of House and 
Senate committees that are looking at proposals.
    I think standards like this would cause more American 
businesses to move to encrypt such information, which we think 
is the right direction. I think other businesses would decide 
whether or not they really should be gathering it in the first 
place. We think that is another good result, as well. Our 
members want to protect that information. We think every 
company and every business in this country that is going to 
gather that information should do the same.
    Public records also contain SSNs, and it is encouraging to 
hear the State court organizations discussing strategies to 
protect them. We support this effort unequivocally. However, 
CDIA does believe that the disclosure of the SSN to the general 
public, while it must be addressed, we also believe that public 
records must be made available, including SSNs, to those with 
appropriate needs. Public records play a vital role in our 
society and they bring value to consumer data industry products 
and services. Bankruptcy records, for example, and tax liens as 
well as judgments are used by lenders. Records of eviction are 
critical to a landlord, and these are just a few examples.
    The public sector agencies are taking actions and we are 
encouraged by SSA's efforts to explore the viability of a 
system by which a party may verify a particular SSN is 
associated with another. However, the system is cumbersome. It 
does not allow for real-time automated processing of SSN 
verification and it will render it very ineffective, in fact, 
in assisting victims of identity theft. We hope the SSA will 
move toward a more effective system in the future.
    In conclusion, we believe that enacting law that imposes 
national uniform information security regulations on all who 
possess the SSN is the right step to take and this is the right 
year in which to do it. In contrast, laws that overreach and 
attempt to limit the SSN's use are likely to merely take fraud 
prevention tools off the table and out of the hands of 
legitimate businesses and expose--and ultimately at the expense 
of consumers. We believe consumers expect us to protect the 
SSN. We also know consumers expect us to maintain accurate 
databases. Thank you, Mr. Chairman.
    [The prepared statement of Mr. Pratt follows:]
 Statement of Stuart K. Pratt, President and Chief Executive Officer, 
                   Consumer Data Industry Association
    Chairmen McCrery, Ranking Member Levin and members of the 
committee, thank you for this opportunity to appear before you today to 
discuss the importance of Social Security Numbers to our members' 
consumer data systems. For the record, my name is Stuart Pratt and I am 
president and CEO of the Consumer Data Industry Association.\1\ Our 
members applaud this committee for the thoughtful and open dialogue it 
has sought regarding how Social Security Numbers are used and to 
identify risks associated with such use.
---------------------------------------------------------------------------
    \1\ CDIA, as we are commonly known, is the international trade 
association representing over 300 consumer data companies that provide 
fraud prevention and risk management products, credit and mortgage 
reports, tenant and employment screening services, check fraud and 
verification services, systems for insurance underwriting and also 
collection services. As we will discuss below, the secure and protected 
use of the social security number (SSN) is an important key to the 
effectiveness of these systems and services.
---------------------------------------------------------------------------
OVERVIEW
    Before I discuss how our members' systems make use of the social 
security number, it is important to take into account key demographics 
about our society that help explain why the SSN so important.
Personal identifiers change:
    While it probably doesn't occur to most of us, the identifiers we 
use in everyday life do change and more often than most might think. 
For example, data from the U.S. Postal Service and the U.S. Census 
confirm that over 40 million addresses change every year. More than 
three million last names change due to marriage and divorce. While 
trends in naming conventions are changing, this fact is still far more 
often true for women than men.
We use our identifiers inconsistently:
    It is a fact that we use our identifiers inconsistently for a wide 
variety of reasons. First, many citizens choose to use nicknames rather 
than a given name However, there are times where, in some official 
transactions, a full name is required, Some consumers, when hurried, 
use an initial coupled with a last name, rather than their full name or 
nickname. Consumers are also inconsistent in the use of generational 
designations (e.g., III, or Sr.). Finally, there are times where 
consumers themselves do make mistakes when completing applications. 
Thus, a consumer's identifiers may be presented in different ways in 
different databases and, in some cases, the data may be partially 
incorrect.
Personal identifiers are not always unique:
    We think of our names as a very personal part of who we are. 
However, our names are less common and unique than we might think. For 
example, families carry forward family naming conventions leading to 
some consumers sharing entirely the same name. Further, U.S. Census 
data shows that both first and last names are, in some cases amazingly 
common. Fully 2.5 million consumers share the last name Smith. Another 
3 million share the name Jones and more than thirteen million consumers 
have one of ten common last names. First names are also used very 
commonly leading to common naming combinations. Eight million males 
have either the name James or John and a total of 57 million males have 
one of ten common first names. An additional 26 million females have 
one of ten common first names. Common naming conventions make it more 
difficult and in some cases impossible to depend on name alone to 
properly match consumer data.
Identifiers are shared:
    Our birthday is a unique day in our lives, but it is, nonetheless, 
a date shared with hundreds of thousands of others. Date of birth alone 
is not an effective identifier. Family members who live together end up 
sharing addresses and per our discussion above, where consumers share 
the same name due to family traditions and the address at which they 
live, distinguishing one consumer from another is complex.
Data entry errors do happen:
    Hundreds of millions of applications for credit, insurance, 
cellular phone services, and more are processed every year. There is no 
doubt that in the process of entering a consumer's identifying 
information errors can be made which carry forward into databases and 
into the reporting of data to consumer reporting agencies.
    By taking into account all of these facts about our identifying 
information, it becomes far more apparent why the SSN is key in 
stabilizing a consumer's identifying information in the context of 
databases. The SSN is a truly unique identifier.
USE OF THE SSN BY CDIA MEMBERS
    CDIA's members produce a range of critical consumer data products 
which bring great value to individual consumers, to society and the 
nation's economy. Our members design products used for determinations 
of a consumer's eligibility for a product or service, to prevent fraud 
and to aid in the location of consumers for a variety of reasons.
Consumer Data Products Used for Eligibility Decisions
    Many CDIA-member products are focused on helping consumers to gain 
access to the goods and services for which they apply. These 
transactions focus on a consumer's eligibility and, as such, the 
consumer data products used are regulated under the Fair Credit 
Reporting Act (15 U.S.C. 1681 et seq.) as ``consumer reports.'' 
Eligibility determinations include applications for any type of credit 
including unsecured credit, home purchases, auto financing, home equity 
loans, as well as for insurance of all types, employment, government 
benefits, apartment rentals, and for other business transactions 
initiated by the consumer.
    The FCRA, enacted in 1970, has been the focus of careful oversight 
by the Congress resulting in significant changes in both 1996 and again 
in 2003. There is no other law that is so current in ensuring consumer 
rights and protections are adequate.
    Of particular importance to our discussion here today, is the FCRA-
imposed duty on consumer reporting agencies by the FCRA (and similar 
state laws) that reasonable procedures be used to ensure the maximum 
possible accuracy of the information contained in all types of consumer 
reports. This duty is established for the protection of consumers. The 
SSN plays a vital role in helping our members to achieve the ``maximum 
possible accuracy'' standard.
    Absent use of the SSN as a key identifier, consumers would be 
harmed in many ways. Consider the following illustrative examples:

      Incomplete data harms consumers: There would be a likely 
increase in the inability of consumer reporting agencies to properly 
match incoming information to the correct consumer about whom the 
information relates. Think about the consequence to consumers of having 
a consumer ``credit'' report that does not contain all of the accounts 
that they pay on time and which makes them eligible for the lowest cost 
loans.
      Incomplete data harms our banking system: The absence of 
the SSN would also put at risk the safety and soundness of lending 
decisions due to less information being included in consumer ``credit'' 
reports due to data matching problems.
      Incomplete data prevents consumer access to goods and 
services: Think about the consequence for consumers when a consumer 
reporting agency cannot locate the proper file on a consumer and thus a 
lender, insurer or other service provider wanting to do business with 
the consumer has to deny the application.

    There is no doubt that consumer reporting agencies of all types 
provide tremendous benefits to consumers directly and to the nation's 
economy and the use of the SSN in the context of our members' systems 
helps bring forward these benefits. Consider the following:

      Access to home ownership: Every homeowner benefits from a 
credit reporting system that reduces the costs of all mortgage loans by 
a full two percentage points, thus putting literally thousands of 
dollars in disposable income into their pockets.\2\ Homeownership is no 
longer a luxury of the well-to-do, but is a truly democratized American 
dream enjoyed by nearly seventy percent of the population.\3\
---------------------------------------------------------------------------
    \2\ Kitchenman, Walter., U.S. Credit Reporting: Perceived Benefits 
Outweigh Privacy Concerns., Pp. 5 (1998).
    \3\ Turner, Michael., The Fair Credit Reporting Act: Access, 
Efficiency & Opportunity. Pp. 8 (2003).
---------------------------------------------------------------------------
      Check fraud prevention: Check fraud is reduced thanks to 
CDIA members' systems. It is estimated that more than 1.2 million 
worthless checks enter the payment system every day in the United 
States. This number speaks to the risks, but also the success of our 
members' systems which service as many as 40 billion check transactions 
a year.
      Tenant screening services: Tenant screening services help 
all landlords to make informed decisions, as well. Consider the 
circumstances of a retiree who owns a rental property on which he or 
she depends for income. A tenant screening service mitigates risks for 
literally millions of such individuals in a country where the majority 
of units for lease are owned by individuals and not by corporations.
      Employment/security screening: SSNs serve as vital links 
among disparate records that help businesses verify prospective 
employees' identities and conduct thorough, accurate background checks 
to ensure workplace safety and business security. Our members' systems 
and services help to ensure that hardened criminals and sex offenders 
do not end up working at daycare centers, schools, nuclear power 
plants, or secure-ID areas of airports.
      Small business B-to-B transactions: An SSN is the key 
business entity identifier to virtually all sole proprietorships or 
partnerships. As a result, SSNs are required to facilitate business-to-
business transactions between small businesses.
      Securitized credit markets: Confidence in the U.S. 
securities market is made possible by accurate financial histories 
compiled using the SSN as a key identifier. Restricting use of the SSN 
could undermine confidence in these securities, resulting in 
substantially higher consumer costs for credit, including mortgages and 
auto loans.
      Investigative services and insurance fraud: SSN access is 
an important tool for investigative services and insurance fraud 
investigation. Insurance fraud losses are estimated to exceed $79 
billion a year--$900 per family--in the U.S. Prohibiting use of SSNs 
for investigative purposes could drive those costs even higher.
Consumer data products used for fraud prevention and location
    Not all CDIA member products are used for an eligibility 
determination, but products regulated under other laws such as the 
Gramm-Leach-Bliley Act (Pub. L. 106-102, title V) are used in critical 
ways for the benefit of all consumers. CDIA's members represent the 
leading companies in the field of consumer identity verification, fraud 
prevention and location services.
Fraud prevention systems:
    Fraud prevention systems deploy a diversity of strategies, but 
clearly the SSN plays an important role. In fact, in 2004 alone, 
businesses conducted more than 2.6 billion searches to check for 
fraudulent transactions. As the fraud problem has grown, industry has 
been forced to increase the complexity and sophistication of the fraud 
detection tools they use. As the importance of fraud detection tools 
increases, the potentially negative consequences of allowing ``access 
and correction'' to these databases must be considered in order to 
protect the accuracy of the included data, and thus the overall 
integrity of these tools.
How do Fraud Detection Tools Work?
    Fraud detection tools are also known as Reference, Verification and 
Information services or RVI services. RVI services are used not only to 
identify fraud, but also to locate and verify information for public 
and private sector uses. While fraud detection tools may differ, there 
are four key models used.

      Fraud databases--check for possible suspicious elements 
of customer information. These databases include past identities and 
records that have been used in known frauds or are on terrorist watch 
lists, suspect phone numbers or addresses, and records of inconsistent 
issue dates of SSNs and the given birth years.
      Identity verification products--crosscheck for 
consistency in identifying information supplied by the consumer by 
utilizing other sources of known data about the consumer. Identity 
thieves must change pieces of information in their victim's files to 
avoid alerting others of their presence. Inconsistencies in name, 
address, or SSN associated with a name raise suspicions of possible 
fraud.
      Quantitative fraud prediction models--calculate fraud 
scores that predict the likelihood an application or proposed 
transaction is fraudulent. The power of these models is their ability 
to assess the cumulative significance of small inconsistencies or 
problems that may appear insignificant in isolation.
      Identity element approaches--use the analysis of pooled 
applications and other data to detect anomalies in typical business 
activity to identify potential fraudulent activity. These tools 
generally use anonymous consumer information to create macro-models of 
applications or credit card usage that deviates from normal information 
or spending patterns, as well as a series of applications with a common 
work number or address but under different names, or even the 
identification and further attention to geographical areas where there 
are spikes in what may be fraudulent activity.
Who uses Fraud Detection Tools?
    The largest users of fraud detection tools are financial 
businesses, accounting for approximately 78 percent of all users. 
However, there are many non-financial business uses for fraud detection 
tools. Users include:

      Governmental agencies--Fraud detection tools are used by 
the IRS to locate assets of tax evaders, state agencies to find 
individuals who owe child support, law enforcement to assist in 
investigations, and by various federal and state agencies for 
employment background checks.
      Private use--Journalists use fraud detection services to 
locate sources, attorneys to find witnesses, and individuals use them 
to do background checks on childcare providers.
Location services and products
    CDIA's members are also the leading location services providers in 
the United States. These services, which help locate individuals, are a 
key business-to-business tool that creates great value for consumers 
and business alike. Locator services depend on a variety of matching 
elements, but again, a key is the SSN. Consider the following examples 
of location service uses:

      There were 5.5 million location searches conducted by 
child support enforcement agencies to enforce court orders. Access to 
SSNs dramatically increases the ability of child support enforcement 
agencies to locate non-custodial, delinquent parents (often reported in 
the news with the moniker ``deadbeat dads''). For example, the 
Financial Institution Data Match program required by the Personal 
Responsibility and Work Opportunity Reconciliation Act of 1996 (PL 104-
193) led to the location of 700,000 delinquent individuals being linked 
to accounts worth nearly $2.5 billion.
      There were 378 million location searches used to enforce 
contractual obligations to pay debts.
      Tens of millions of searches were conducted by pension 
funds (location of beneficiaries), lawyers (witness location), blood 
donors organizations, as well as by organizations focused on missing 
and exploited children.

    Clearly location services bring great benefit to consumers and to 
businesses of all sizes. Availability and permitted use of the SSN 
remains vital to the effective operation of these services for both 
private and public sector purposes.
INFORMATION SECURITY AND THE SSN
    Because of recent media coverage regarding security breaches of 
sensitive personal information and also general concerns about identity 
theft, some consumers may well feel that data about them presents risks 
that outweigh benefits. But in reality as we have discussed above, 
there is clear and convincing value in the uses of such data, including 
the SSN, that bring direct value to consumers and our nation's economy, 
which must be preserved.
    Consumers and media often assume that use of the SSN is wholly 
unregulated and this is not the case. As we've discussed, the FCRA 
regulates SSNs in the context of consumer reports and our members' use 
of the SSN is also regulated under the restrictions of the GLB. Other 
laws such as the Fair Debt Collection Practices Act (15 U.S.C. 1601 et 
seq.), the Health Insurance Portability and Accountability Act (Pub. L. 
104-191), and the Drivers Privacy Protection Act (18 U.S.C. 2721 et 
seq.), also impose protections on sensitive information about consumers 
which in turn protects the SSN.
    However, CDIA's members recognize that the laws which cover them 
may not extend to all and clearly the SSN is sensitive personal 
information which must be protected. The following statement delivered 
during our testimony before the Senate Banking Committee on September 
22, 2005 continues to reflect our position on protecting sensitive data 
about consumers, including the SSN:
    ``The discussion of safeguarding sensitive personal information and 
notifying consumers when there is a substantial risk of identity theft 
has expanded beyond the boundaries of financial institutions. It is our 
view that rational and effective national standards should be enacted 
both for information security and consumer notification as it applies 
to sensitive personal information, regardless of whether the person is 
a `financial institution.' ''
    As this committee knows, there are a number of House and Senate 
committees that are focused on developing uniform national standards 
for ensuring the protection of sensitive personal information. We 
believe that enactment of national standards will ensure that the SSN 
is protected by all who possess it. New nationwide safeguards 
regulations authored by the Federal Trade Commission will compel all to 
deploy physical and technical strategies for the protection of 
sensitive information about consumers. Further they will likely cause 
American businesses to move to encrypt such information and finally 
some will question why they gather the SSN in the first place. Further, 
information safeguards rules would effectively bring into question the 
business model of operating publicly available websites that sell a 
consumer's SSN to virtually anyone who is willing to pay the price.
    Ultimately national standards for the safeguarding of the SSN and 
other sensitive personal information will address consumer concerns and 
perceptions. These are all good public policy results and CDIA remains 
committed to a constructive dialogue as various bills move through the 
House and Senate.
PUBLIC RECORDS AND THE SSN
    The historical debate about the presence of the SSN in public 
records has suggested a binary proposition of either providing everyone 
with access to all of a record, including the SSN, or to deny all 
access to the record with an SSN. We think that this paradigm is dated 
and today encouraging trends in the technologies used to make public 
records available to all citizens, particularly via the internet, are 
allowing state and federal agencies to employ far more sophistication 
in how and when an SSN will be disclosed.
    It is also encouraging to hear state court organizations discussing 
strategies for protecting SSNs and CDIA will continue to engage in 
these dialogues. However, while CDIA believes that disclosure of the 
SSN to the general public must be addressed, we also believe that 
public records must be made available, including SSNs, to those with an 
appropriate need. States are seeking out dialogue with the private 
sector about future access to public records which shows promise. 
Consider the following excerpt from CDIA's April 18, 2002 letter to the 
National Center for State Courts:
    ``. . . consider the example of the Maryland court access project 
that tried to create a limitation on bulk access to court records. The 
concerns raised at a public hearing in December 2000 `prompted [Chief] 
Judge Bell to appoint an expanded, more representative task force.' \4\ 
The expanded task force recently issued a final report and noted that 
requestors of bulk data sell that information `with value added' to 
their customers. The report also noted that registration agreements 
between the court and the bulk data requestors 1can provide a vehicle 
for reasonable safeguards concerning released data.' '' \5\
---------------------------------------------------------------------------
    \4\ Maryland Judiciary Website (visited March 20, 2002).
    \5\ Report of the Maryland Court of Appeals Committee on Access to 
Court Records 10 (Feb. 2002).
---------------------------------------------------------------------------
    Public records play a vital in our society and bring value to the 
consumer data industry's members. Bankruptcy records, tax liens and 
judgments are part of consumer ``credit'' reports used by lenders to 
make decisions that implicate safety and soundness. Records of eviction 
are critical to landlords who must themselves pay the bills and attempt 
to lease properties to consumers who will do the same. Validating 
professional licenses for employment screening agencies is yet another 
use of public records, as is accessing criminal histories.
    Through the development of nationwide databases of public record 
information, our members have solved the problems inherent in having to 
search through tens of thousands of federal and state court houses and 
agency databases. In this way, the SSN is as important an identifier in 
a public document as it is in a private-sector database. It is a 
critical identifier for all of the data management reasons we discuss 
above. Without an SSN, a consumer can simply alter a few items of 
information, such as moving to a new address, or even changing a name 
and thus separate himself/herself from a bankruptcy record, a tax lien, 
a record of eviction and even a criminal history, in some cases. 
Clearly this is not a positive outcome for consumers or for American 
businesses which are on the front lines of making, for example, fair 
and accurate risk-based lending and employment decisions, while at the 
same time fighting identity theft and fraud.
    Some federal proposals have suggested that state agencies must 
limit access to the SSN. The concern of the CDIA's members is that this 
apparent unfunded mandate will drive under-funded state agencies to 
either stop requesting the SSN when processing vital records, or to 
simply deny all access to the SSN for a variety of reasons including 
the fact that they cannot fund a bifurcated system of access to the SSN 
for some but not for others. Additionally, because some state public 
access laws appear to prohibit a bifurcated approach.
    Ultimately, dialogue with state and federal agencies coupled with 
the advancement of technologies will address concerns about public 
records which contain SSNs. An unfunded mandate will destabilize the 
system of public records which is so important to our democracy.
    In the context of discussing governmental agencies and the SSN, we 
do want to acknowledge and are encouraged by the Social Security 
Administration's efforts to explore the viability of a system by which 
a party may verify that a particular SSN is associated with a 
particular name. A discussion of this system can be found in the 
December 30, 2005 edition of the Federal Register, Vol. 70, No. 250. 
Entitled ``Consent Based Social Security Number Verification Process,'' 
the service will be available starting June 2006 and only a limited 
number of parties are allowed to enroll. As it currently stands, this 
system is very cumbersome and does not allow for a real-time automated 
process of SSN verification which will render it very ineffective for 
assisting victims of identity theft and also preventing the crime. We 
hope that the SSA will move towards a truly automated, system that 
meets the broader needs of the data industry.
CONCLUSION
    In conclusion, you can see that the underlying theme in the 
discussion of SSN uses is that of balance and ultimately ensuring the 
security of the number. Law that that imposes national uniform 
information security regulations on all who possesses the SSN in 
combination with a person's name and address, is the most responsible 
and constructive focus for Congress. In contrast, law that overreaches 
in attempting to limit use of the SSN is likely to merely take fraud 
prevention tools out of the hands of legitimate businesses at the 
expense of consumers. Ironically, to prevent fraud you must be able to 
crosscheck information. To maintain accurate databases, you must be 
able to maintain a range of identifying elements. Absent the 
availability of the SSN, we will be less able to build accurate data 
bases, to accurately identify records and to help prevent identity 
theft through the development of fraud prevention and authentication 
tools. Ultimately consumers expect us all to accomplish the goals of 
protecting and securing the SSN, and also ensuring the accuracy and 
effectiveness of databases which contain information about them.
    Thank you for this opportunity to testify.

                                 

    Chairman MCCRERY. Thank you, Mr. Pratt. Mr. Hulme?

STATEMENT OF BRUCE H. HULME, PRESIDENT, SPECIAL INVESTIGATIONS, 
      INC., AND LEGISLATIVE DIRECTOR, NATIONAL COUNCIL OF 
    INVESTIGATION AND SECURITY SERVICES, NEW YORK, NEW YORK

    Mr. HULME. Good afternoon, Mr. Chairman and Members of the 
Committee. My name is Bruce Hulme. I represent the National 
Council of Investigation and Security Services. I am a New York 
State licensed private investigator, having been so for 42 
years. My company is Special Investigations, Inc.
    As a profession that has been helping victims through the 
identity theft maze for years, our experience is that such 
thefts result from purloining of documents, files, charge 
slips, credit cards, and wallets, and according to the Javelin 
Strategy and Research survey, 47 percent of such theft is 
perpetrated by friends, neighbors, and employees.
    We agree that additional measures can be taken to further 
reduce incidents of theft. Our concern is that some measures, 
unless amended, will have unintended consequences that would 
help create a safe haven for criminals and do substantial 
damage to the judicial system. We support Congressional efforts 
to protect data breaches. We favor limiting the use of the SSN 
on government documents, student IDs, and health cards. 
Certainly we do not believe that such information should be 
sold over the Internet to anybody willing to pay a fee.
    However, we do have strong concerns with some provisions of 
H.R. 1745 and a Senate measure that would have direct and 
harmful effects on how our profession conducts lawful 
investigations by banning the sale of SSNs. The result would be 
that databases would not have accurate information about 
individuals and private investigators would be hampered in our 
efforts to locate individuals and perform many functions 
essential to the judicial system.
    There are 46,000 American men named Bill Jones. Many of 
them have the same or similar dates of birth. Private 
investigators and others, of course, need to be able to 
differentiate between subjects for many purposes, including 
evidence in court proceedings.
    One critical and effective tool used by private 
investigators is what is referred to as the credit header, that 
portion of a credit report that includes location and 
identifying information but discloses no credit data. That 
search is by far the most important one used by investigators 
when locating female witnesses. Women often change their names 
due to marriage and divorce, and it also helps to locate other 
individuals, particularly transients.
    Pending legislation provides exceptions for law 
enforcement. This creates an obvious issue of due process 
because prosecutors with the full resources of the State will 
always have use of this tool while the accused would not. 
Database searches led directly to a witness or witnesses who 
recanted testimony and helped free a man wrongly imprisoned for 
20 years. The same situation holds true in civil matters. 
Privacy legislation restricting the use of SSNs generally 
provides an exception for insurance companies, thereby creating 
an imbalance between insurance defense and plaintiffs' bars.
    Investigators do not have access to a central criminal 
history database, as does law enforcement, so it is essential 
to develop address information when seeking information about 
prior convictions so that we know what courthouses to go check 
out. In both civil and criminal trials, attorneys need to know 
the backgrounds of witnesses. We urge Congress that any 
restriction on the sale of SSN information include an exception 
to enable licensed private investigators and other State-
regulated persons to conduct lawful investigations, including 
but not limited to identifying or locating missing or abducted 
persons, witnesses, criminals and fugitives, parties to 
litigation, parents delinquent in child support payments, organ 
and bone marrow donors, pension fund beneficiaries, and missing 
heirs.
    Here are four quick examples of how we use SSNs. I was 
retained by the New York courts in a guardianship proceeding to 
recover $300,000 in assets stolen from a 97-year-old retired 
Army officer. It was a successful result. The suspect pled 
guilty, was sentenced 3 to 9 years in State prison and ordered 
to pay $360,000 in restitution and we got all the money back.
    In San Francisco, a businessowner started getting 
statements in the mail saying he owed tens of thousands of 
dollars on computers and other equipment he never purchased. 
Someone had hijacked his identity, opened credit cards, store 
accounts in his name, set up a similar-type website in his name 
and his company's name. The police said they would only take a 
report, they wouldn't investigate. They passed it off to the 
Secret Service. His loss was $80,000. The Secret Service said 
at that point, they had a $100,000 threshold. A private 
investigator came into the case and with the use of credit 
header information found that an ex-employee, checking things 
out, had been using three names or several different SSNs and 
birthdates.
    One of our association members reported a case that 
involved a woman who was left a sizeable inheritance by her 
uncle in the form of a trust. The investigator was able to 
eventually determine that she was recently married and living 
in Utah somewhere destitute, out of a pickup truck. That had a 
successful result.
    A former president of our council testified just several 
years ago, I think, about a similar case before this Committee 
regarding a custodial parent whose child had been abducted 2 
years prior. Her mother spent 2 years having a run-around with 
the police and politicians trying to get somebody to do the 
job. She went to this private investigator. Within basically 
minutes, running a credit header, determined enough leads as to 
where the husband might be, turned the information over to the 
police. They went there, got in, and the child was reunited 
with its mother.
    As detailed in our statement, the association of regulators 
which regulates our profession, they support granting an 
exception for our industry in this, and we stand ready to 
assist the Committee in any way we can and thank you for this 
opportunity, Mr. Chairman.
    [The prepared statement of Mr. Hulme follows:]
  Statement of Bruce Hulme, Legislative Director, National Council of 
        Investigation and Security Services, New York, New York
    Good afternoon Mr. Chairman and members of the subcommittee. My 
name is Bruce H. Hulme and I am appearing today on behalf of the 
National Council of Investigation and Security Services (NCISS) where I 
serve as Legislative Director. I am past president and chairman of the 
Council and serve as a member of the Board of Directors. I have been a 
licensed private investigator in New York for more than forty years and 
am president of Special Investigations, Inc.
    We appreciate the opportunity to discuss how Social Security 
numbers can be used by perpetrators of identity theft, what Congress 
can do to mitigate the risk of such fraud, and the impact of pending 
legislation.
    Social Security numbers (SSN's) have become the de facto identifier 
in the United States. The Social Security number is the single best way 
to distinguish among people of similar or identical names. That is why 
businesses have used SSN's on identity cards and customer records. It 
is also why SSN's are sought by those who wish to commit fraud, so they 
may attempt to establish an identity.
    When Congress created the Social Security System nearly three-
quarters of a century ago, it was not intended that the numbers issued 
to nearly every American would become the universal identifier for 
modern times. But that is what has occurred. An entire system of 
commerce is predicated on citizens being able to identify themselves 
based on this identifier. Unless each person has a viable substitute 
such as a password to take the place of the SSN, Congress should be 
very circumspect about eliminating the use of the SSN as an identifier.
    Just as most commerce uses the SSN, the civil and criminal justice 
systems also require a means of identifying parties and witnesses in 
lawsuits and the commonality of dates of birth makes the SSN a 
necessary tool to be sure the courts have positive identification. It 
is true that some abuses have occurred by the misuse of the SSN, but 
the percentage of misuses pale in comparison to the number of positive 
uses applied every day in our economic and justice systems.
    As a profession that has been trying to help victims through the 
identity theft maze for years, we applaud Congress' efforts to put 
additional laws on the books that will bring victims some relief. 
Recently enacted legislation should be of some assistance. The Fair and 
Accurate Credit Transactions Act included several identity theft 
provisions, and the 108th Congress adopted the Identity Theft Penalty 
Enhancement Act to increase sentences of convicted fraudsters. We were 
appalled to read recently that two caretakers who committed such fraud 
against their elderly patients received suspended sentences. Until the 
courts take the crime seriously, it will be difficult to deter such 
thieves.
    Although a percentage of identity thieves no doubt gather their 
victims' identities from the Internet, our experience is that most such 
thefts result from the purloining of documents, files, charge slips, 
credit cards, and wallets from restaurants, stores, trash bins, the 
mails and private property. In fact, according to the Javelin Strategy 
and Research survey 47 percent of such theft is perpetrated by friends, 
neighbors or employees.
    But we agree that additional measures can be taken to further 
reduce incidents of theft. Our concern is that some measures, unless 
amended, would have unintended consequences that could help create a 
safe haven for criminals and do substantial damage to the judicial 
system.
    Publicity over data breaches for the past year have led to numerous 
bills in Congress and state legislatures to require that sensitive 
personal information, including Social Security numbers, be protected 
by those who hold it. Such breaches have occurred not only from data 
providers, but universities, banks and other institutions. Breaches 
have also occurred at every level of government. These breaches have 
been caused by lost computers, hacking, misplaced files and other 
means.
    We support efforts to protect such sensitive personal data. 
Consumers should be informed when such data are divulged and should be 
provided assistance in order to protect themselves. And, businesses and 
other institutions holding such data have a responsibility to protect 
it.
    With regard to Social Security numbers, we support limiting their 
use on government documents, student id's, health cards and other means 
of identification that could fall into the wrong hands. And we 
certainly don't believe that such information should be sold on the 
Internet to anyone willing to pay a fee. Many of these provisions are 
found in HR 1745, the Social Security Number Privacy and Identity Theft 
Protection Act.
    We do, however, have strong concerns with provisions of HR 1745 and 
other measures that would have a direct and harmful effect on how our 
profession conducts lawful investigations. The Senate Committee on 
Commerce, Science and Transportation, for example, amended S 1408, the 
Identity Theft Protection Act, to effectively prohibit the sale of 
Social Security numbers with few exceptions. The result would be that 
databases would not have accurate information and private investigators 
would be hampered in our efforts to locate individuals and perform many 
of the functions essential to the judicial system.

                   How Private Investigators Use SSNs

    As indicated earlier, the Social Security number is critical for 
determining identity. In past hearings, Lexis-Nexis has testified that 
there are 46,000 men in America named Bill Jones. Many of them have the 
same or similar dates of birth. Licensed private investigators need to 
be able to positively differentiate between subjects when rendering 
reports which will be used for many purposes including evidence in 
court proceedings. Behind any civil or criminal court case of 
consequence, you will usually find a licensed private investigator 
assisting the attorneys involved in such cases. The investigators are 
also then bound by the attorney-client privilege which adds a further 
measure of security to the information developed on individuals during 
the course of an investigation. Contrary to popular belief, most 
investigators work for law firms, insurance companies and corporations, 
not the general public.
     One critical and effective tool used by private investigators is 
the ``credit header,'' that portion of a credit report that includes 
location and identifying information but discloses no credit data. That 
search is by far the most important one currently used by investigators 
when locating female witnesses. Since women often change surnames over 
the course of their lives due to marriage or divorce, it makes it even 
more critical to be able to identify them by their SSN. The SSN does 
not change and allows us to locate these otherwise difficult to find 
witnesses. In California recently, database searches led directly to 
witnesses who recanted testimony and helped free a man wrongly 
imprisoned for twenty years.
    In both civil and criminal trials, justice is served best by all 
parties getting access to all possible witnesses. Access to a fair 
trial is a fundamental right of American citizens. Without the ability 
to identify and locate all witnesses, that right is threatened.
    The address information is used routinely to locate witnesses, 
particularly when they may be transient. Legislation restricting the 
use of Social Security numbers always provides exceptions for law 
enforcement. This creates an obvious issue of due process because 
prosecutors, with the full resources of the state, would have use of 
this tool while the accused would not. The criminal justice system 
needs balance. . . . the private investigator provides a counterpoint 
to the investigators in the public sector.
    The same situation holds true in civil matters. Privacy legislation 
generally provides an exception for insurance companies, thereby 
creating an imbalance between the insurance defense and plaintiffs' 
bars in obtaining evidence in civil trials.
    Investigators do not have access to the central criminal history 
database that law enforcement officials do, so it is essential to have 
addresses when seeking information about prior convictions. With prior 
address data, investigators know which courthouse records to search. 
This information is important for more than pre-employment purposes. In 
both civil and criminal trials, attorneys need to know the backgrounds 
of witnesses and potential witnesses.
    Address information is valuable in locating stolen assets. I was 
retained by the New York courts in a guardianship proceeding to recover 
over $300,000 in assets stolen from a 97-year-old retired Army officer 
by a neighbor caregiver. Through the use of credit headers I was 
immediately able to determine the identities and locations of the 
wrongdoer's relatives, properties and eventually their assets that had 
been taken from the victim. It was the initial header check on the 
suspect that uncovered an address in Myrtle Beach, South Carolina. That 
information developed leads that the victim's assets had been used to 
purchase expensive automobiles, real property in South Carolina and 
increased the bank account balances of the suspect. All under the guise 
that the 97-year-old victim, who was suffering from dementia, had given 
his life savings as gifts to the suspect. The suspect eventually pled 
guilty and was sentenced to three to nine years in state prison for 
second-degree grand larceny and ordered to pay $360,000 in restitution 
to the estate of the victim, who, regrettably, died a month before 
sentencing of the defendant.
    In numerous cases, such data have led to recovery of funds from 
persons not meeting their child support obligations. And missing 
persons, including abducted children, have been located with leads 
generated from credit headers.
    It is no secret that law enforcement does not have the resources to 
respond effectively to most victims of identity theft. The crime is 
difficult to solve, and often involves several jurisdictions. So 
victims turn to private investigators for assistance.
    Congress must consider that many licensed private investigators are 
former law enforcement officers and can assist the overwhelmed public 
law enforcement sector in fraud and identity theft related cases. Law 
enforcement is often under-manned and ill--equipped to deal with 
identity theft and usually violent crime cases take precedence. The 
victims then must turn to investigators in the private sector to assist 
them in determining the extent of the fraud and the identity of the 
perpetrators. Investigators must have access to the necessary tools 
such as the credit header SSN search. Without access to this important 
investigative tool, it will become easier for criminals to shield 
themselves from discovery. They are fully aware of the limitations 
facing law enforcement.
    Here is how SSN information helped solve one case: In San 
Francisco, an investigator reports working a case for a successful 
business owner who started getting statements in the mail saying he 
owed tens of thousands of dollars on computers and other purchases, 
none of which he knew anything about. He found someone had hijacked his 
identity, opened credit card and store accounts in his name and had 
even opened a web page mirroring his web page and had an e-mail address 
similar to his. The San Francisco Police said they would take a report, 
but would not investigate and suggested he go to the Secret Service. 
Although losses approached $80,000, the Secret Service declined to take 
a report because losses had not reached a $100,000 threshhold. The 
victim hired a private agency. Using credit header information, they 
learned that the suspect, was an ex-employee with three aliases, three 
or four social security numbers, and three different dates of birth. 
The suspect was apprehended and prosecuted.
    Such information is also valuable for locating lost heirs. One of 
our association members reported a case that involved a woman who was 
left a sizeable inheritance by her uncle in the form of a trust. The 
family had not had any contact with her for a number of years, so the 
attorney handling the trust asked for assistance. By using header 
information, the investigator was able to eventually determine that she 
was recently married and was living someplace in Utah. He was able to 
locate her husband's relatives and learned that she and her husband 
were destitute and living out of a pick-up truck in Oregon. He sent the 
requisite documentation to her in care of her husband's relatives and 
she rightfully obtained her substantial inheritance. Without access to 
header information, the investigator would not have been able to locate 
her.
    A former president of our Council--NCISS--helped a custodial parent 
whose child had been abducted two years prior. The mother had spent 
those two years unsuccessfully trying to keep the police interested and 
writing various public officials seeking help. A credit header search 
revealed an address in Palm Beach, Florida, where the estranged husband 
had recently applied for credit. The police apprehended the husband and 
reunited the child with his mother.
    One of our Texas members reports using a Social Security number 
``trace'' to locate a female in need of assistance. A charitable fund 
had been set up to assist her with prenatal care and her childbirth. 
The credit header was an efficient means for the licensed investigator 
to quickly locate a needy person for charitable purposes at low cost.
    Last year, NCISS met with members of the Federal Trade Commission 
to apprise them of the many ways private investigators rely on the SSN. 
We presented a dozen actual case examples of the sixty we had brought 
with us to that meeting.
    We urge Congress to provide that any restriction on the sale of 
Social Security information include an exception to enable licensed 
private investigators and other state regulated persons to conduct 
lawful investigations, including, but not be limited to, identifying or 
locating missing or abducted persons, witnesses, criminals and 
fugitives, parties to litigation, parents delinquent in child support 
payments, organ and bone marrow donors, pension fund beneficiaries and 
missing heirs.
    It is ironic that the end result of such well-intentioned 
legislation would be to make it more difficult to assist victims of 
identity theft and other frauds. It would make it less likely that the 
courts would hear from all relevant witnesses in both civil and 
criminal trials and less likely that stolen funds are recovered.
    In conclusion, I would like to share with this committee the 
position of the International Association of Security and Investigative 
Regulators with respect to this issue. IASIR is an association of state 
and province regulatory agencies in the United States and Canada, 
having jurisdiction over a large part of the security industry and 
investigative profession. At their annual meeting last fall they passed 
the following motion:
    IASIR acknowledges that regulated investigators are an integral 
part of the effective administration of justice, civil as well as 
criminal. In addition, state licensed investigators provide an 
essential service to the public, to businesses and government, and to 
the legal community for the purpose of preventing or investigating 
fraud including identity theft; reducing business losses such as 
embezzlement, robberies, burglaries, thefts, fires and other casualty 
claims; investigating workplace allegations including harassment, 
discrimination and other workplace risks; locating missing and abducted 
persons, witnesses, heirs, and deadbeat parents; as well as assisting 
in uncovering significant misrepresentations or critical non-
disclosures in conducting due diligence.
    Since access to personally identifiable information is crucial to 
the welfare of many and often concerns not only individual physical 
safety but the protections of homeland security, IASIR recognizes and 
supports the necessity of those investigators, who are licensed and 
monitored by regulatory agencies, to maintain access to personal 
identifying information including but not limited to, social security 
numbers, dates of birth and driver's license numbers to assist in their 
important investigative mission.
    NCISS stands ready to assist the Committee in its endeavor to 
protect consumer privacy without causing unintended consequences.

                                 

    Chairman MCCRERY. Thank you, Mr. Hulme. Ms. Robinson, I am 
curious about one thing that we have discovered. According to 
the FTC, 61 percent of identity theft victims never contact the 
police department to report their identity theft. Do you have 
any idea why that is?
    Ms. ROBINSON. Well, from my experience in working with 
victims, victims feel like the police don't care, and like the 
gentleman just said, the police will only take a report. They 
won't actively investigate the crime. They won't actively 
pursue the perpetrator.
    Chairman MCCRERY. Does anybody else have a thought on that? 
Mr. Hulme?
    Mr. HULME. Well, it is multiple jurisdictions that present 
problems. Law enforcement basically is just now starting to 
come up to speed. I can tell you from testimony I heard on the 
first panel that I probably investigated more ID thefts than 
the two government agencies. I know many of our members 
certainly have. I think it is a question of passing the buck, 
but it is definitely a major problem that has to be addressed.
    Chairman MCCRERY. Thank you. Mr. Stein, you mentioned how 
financial institutions use SSNs as a tool to help verify the 
identity of their customers. Could you explain how, for 
example, a bank's customer identification program might work? 
What information do you request in addition to the SSN?
    Mr. STEIN. Identity documents are always requested to prove 
up identity. The SSN helps as a determinant of an individual. 
As my esteemed colleagues have all represented about the 
Smiths, the Jones, and so forth, the SSN serves to identify the 
specific Jones or Smith that you are dealing with and to be 
able to tie those relationships, for example, together within a 
financial institution, to ensure that when you pull credit 
reports to determine creditworthiness for a loan, a mortgage, a 
credit card, you are actually receiving the information about 
the specific applicant who has applied to you so that you can 
make that credit worthiness decision appropriately.
    Those are a number of ways in which that number is used. It 
is not used to verify identity per se. It is used to ensure 
that you are the Smith with whom we are dealing, and then we 
use your identity documents, typically a driver's license in 
today's society, and perhaps other pieces of identification, 
whether it be a passport, credit card, whatever, to confirm 
your identity.
    The SSN itself doesn't confirm your identity in the absence 
of a CBSV or its predecessor, the Enumeration Verification 
System, where we have the ability to actually go out to SSA's 
database and pull back or confirm the SSN, name, date of birth 
combination so that we know, in fact, we are dealing with the 
same person. In the absence of that, the number itself simply 
allows us to tie together disparate people using our disparate 
accounts that are using that same number as an identifier.
    Chairman MCCRERY. Let us take Ms. Robinson's case, for 
example. Another Ms. Robinson stole her SSN, or got it, started 
using it, and applied for loans, evidently, and got them. Why 
couldn't that financial institution have just done a couple of 
extra things that might have raised flags and made them 
question the person sitting before them? She probably had a 
driver's license, that had her name which was almost the same, 
and it may have left out her middle initial, and that is not 
unusual, and so the person at the bank or the financial 
institution said, okay. Maybe then he should have looked at the 
address on the driver's license, and then surely the financial 
institution did a credit check. Maybe they should have compared 
the address on the driver's license to the address on her 
credit report, and when those are not the same, a flag goes up 
and you just either ask her there at the desk or call her back 
and say, there is a discrepancy in the address in your credit 
report. What is the deal?
    Mr. STEIN. I have----
    Chairman MCCRERY. Just a couple things. Why shouldn't you 
do that?
    Mr. STEIN. I have two answers to that. The first one is, 
again, going back to the CBSV and the EVS system, had that been 
commercially available so that the financial institution could 
have verified the consumer's name along with the SSN and along 
with the date of birth, and assuming that the person who was 
misrepresenting her didn't have all three of those correct and 
documentation to support all three of those correct, the 
financial institution could have had an opportunity right there 
to have caught that. Number one, I would promote that the 
ability to verify that information is a key step in this entire 
process.
    Now, not knowing exactly what the financial institution 
saw, and so I am--you have sort of asked me to second-guess 
what they did or didn't do here--but with respect to the credit 
reports that would be pulled based on the SSN and the name, I 
think that Mr. Pratt here has indicated the volume of address 
changes that happen in a year and the information tends to lag 
what gets into the credit reports, and so it wouldn't 
necessarily in and of itself as the sole trigger. The fact that 
the address wasn't in that credit report that represented the 
person in front of them wouldn't necessarily by itself have 
been a key indicator.
    I also think that in a high-volume environment as card 
issuers deal with, it may also be difficult for them to find 
those really fine nuances between two people of the same name 
with the same SSN. I will tell you that had they been using a 
different name with her SSN, there would have been a warning 
that would have appeared on the credit report that would have 
indicated there is another name in the Bureau that is used 
sharing that same SSN. One of the problems is the very close 
similarity between the two names in this particular instance.
    Chairman MCCRERY. Okay. Mr. Hulme, you have stated that 
your organization agrees that additional measures can be taken 
to reduce identity theft. You undoubtedly have a lot of 
experience in dealing with information resellers. Do you have 
any recommendations as to how they can improve their protection 
of SSNs, these resellers?
    Mr. HULME. First of all, if there was a manner of getting a 
lot of the resellers--and I am not referring to the major ones, 
but two levels down or a level down--from selling this--pull 
this off the Internet and eliminate sales to the general public 
and you will eliminate 95 percent of the problems, in my 
opinion.
    Chairman MCCRERY. Say that again?
    Mr. HULME. I think one will eliminate 95 percent of the 
problems if sales of----
    Mr. BECERRA. Could you repeat the whole answer? Pull it 
from the Internet----
    Mr. HULME. Sure. Don't allow the sale of the SSN and 
personally identifiable information to be sold to the general 
public over the Internet. That would be my--I think that would 
be my first, strongest suggestion, and I heard one of the 
speakers earlier today say there were studies that maybe showed 
that. I can tell you that anecdotal information, and if you 
talk to most investigators and certainly our association, we 
think that if you pull down the sale of these items of personal 
information direct to the general public over the Internet, you 
will eliminate an awful lot of identity theft.
    Chairman MCCRERY. Thank you. Mr. Levin?
    Mr. LEVIN. Just one question. To sum up, how easy is it to 
steal identity?
    Mr. HULME. Well, I am not a thief, but I would say----
    [Laughter.]
    Mr. LEVIN. I said how easy, not how.
    Mr. HULME. Well, I think in some cases, the door is being 
left open. In some situations, I think there is the 
availability to get this information and it is being displayed 
often in areas where it shouldn't be displayed. The information 
obviously has to come off a lot of government documents, more 
than are necessary. The tons of mail that we get that get 
sometimes sent to the wrong place, even when it comes back to 
the Post Office, just check with the postal inspectors and you 
will find that they are now investigating quite a few crimes 
regarding what has been done with the mail that has been 
returned.
    Mr. LEVIN. You are saying it is easy?
    Mr. HULME. Yes.
    Mr. LEVIN. Does anybody disagree with that?
    Mr. PRATT. I don't think we disagree with that. I just want 
to emphasize, though, the point that has already been made, but 
just to drive it home, that fraud prevention systems are moving 
past the simple question of do you have a Social and a name 
that match up together. We discuss in our testimony different 
fraud prevention strategies that are being used today, and they 
really do have to do with bringing together disparate sets of 
information and attempting to foil the dilemma of having 
information which is far too openly sold out on the Internet, 
for example, by, for example, asking additional questions of 
the consumer that would probably not--that the ID thief would 
not necessarily know. In an online environment, it might be to 
ask consumers additional questions that the thief probably 
wouldn't even know even if he or she had stolen a wallet.
    Fraud prevention systems have clearly moved past the 
simple, do you have a set of data and have you matched it, yes 
or no, and we, too, agree that the SSA concept of matching 
information is a good one, but I suspect we would all agree 
that it is not the sum total of how you ultimately validate a 
consumer's identity. You may be able to validate that you have 
a real SSN, but then you are going to raise yellow flags. What 
about that address?
    The Fair Credit Reporting Act, by the way, was amended in 
2003 to obligate all lenders to have a system by which they 
will compare the old address or the address on the application 
with the address that you find in the credit report.
    What about fraud alerts? The Fair Credit Reporting Act was 
amended in 2003 to obligate a lender to pay attention to the 
fraud alert, to make sure that it was actually processed, so 
that if one was placed on the file, that there would be 
additional contact measures taken to further authenticate the 
identity of the individual and attempt to foil the criminal 
from opening up new accounts.
    I think those kinds of steps have been taken and that is 
why the world is a little different than even the last time I 
appeared before this Committee, when we talked about SSNs and 
the availability of them. Those are good steps along the 
continuum and the challenge is thieves become more clever and 
so, too, do the fraud prevention systems that have to stop 
them.
    Mr. LEVIN. Thank you.
    Chairman MCCRERY. Mr. Johnson?
    Mr. JOHNSON. Thank you, Mr. Chairman. Mr. Pratt and Mr. 
Stein, I guess, you all haven't talked about how some companies 
will use the last four digits and some of them the first five, 
maybe, to identify people. Does that have any validity at all?
    Mr. PRATT. From our perspective, again, Congressman, the 
Fair Credit Reporting Act stipulated that consumers could 
truncate SSNs when they order their credit report so that they 
could look at their credit report. For example, some laws 
attempt to do that.
    Yes, there can be some strategies where I suppose 
truncation works. There are risks any time you start to 
truncate the number. For example, we actually have run data to 
show that even with the last four digits of an SSN, you can 
match up as many as 90 different Joneses in this country. You 
have to be careful. You have to be careful about when and where 
to employ a truncation strategy. In some kinds of database 
management systems, that is good. In some, that might not be so 
good.
    Mr. STEIN. I think that one of the reasons that we use 
truncated SSNs is a layered approach for role-based access. If 
you segment a need around Social Security within a financial 
institution, there are three sets of needs. There are those 
people who don't ever need to see an SSN. You may have 
employees who, by virtue of their job role, have no need to 
ever see a customer's SSN, and by virtue of that role-based 
access, when they pull up information on the customer to 
respond to a question or whatever, they shouldn't see the 
customer's SSN at all.
    There may be others within the organization who have a need 
to verify that as a component of the identity verification 
process, but they have no need for the full SSN. They don't 
need to know the whole thing for that consumer. A customer 
service center, for example, gets a phone call from Mr. Jones 
and one of the ways they may verify Mr. Jones in a remote 
environment is by having Mr. Jones tell them, or alternatively 
key into a voice response unit the last four digits of their 
SSN as a means to uniquely identify that Mr. Jones is the one 
for whom I am going to pull their account records. Again they 
have no need to see the full thing.
    Then there are other employees within the organization who 
have clearly a need to work with the entire SSN, and that is a 
much, much smaller population. We are reducing the risk 
throughout that whole thing by taking it from the old world of 
financial institutions, where every employee saw every SSN, to 
a very small number who see a full SSN.
    Mr. JOHNSON. Now, we tried at one time to get the military 
to change their procedure, but all of them use the SSN as an ID 
and it is on their ID card. Not only that, but my wife's ID 
card has both our numbers on it, not just one. Have you got any 
suggestions about how we can fix that problem, because that is 
an easy theft, I think.
    Mr. PRATT. Congressman, all I can say is I think the world 
has changed enough that it is time to ask that question again 
of the military to see if they are willing to alter that system 
now.
    Mr. JOHNSON. Okay. We can make them do it, I guess.
    [Laughter.]
    Mr. PRATT. It is true that every time the SSN is used on a 
medical identification card, when it is used on all the 
different places that it can occur, those are all risks that I 
think my colleague to the left has expressed are potential 
risks.
    Mr. JOHNSON. Mr. Hulme, you are talking about people 
stealing your identity. I got stopped at the airport because 
they said I was a terrorist. Sam Johnson--there are a lot of 
them around.
    [Laughter.]
    They didn't have to have an SSN to verify who I was. They 
used other means. I think there is a way to get around that if 
we really want to and you all are probably doing as good a job 
as anybody. Have you got any suggestions on that?
    Mr. HULME. No. All I can say is that some people definitely 
need to have access to that SSN. Along the same line, in 
fairness, it doesn't need to be laid out for the world to have.
    Mr. JOHNSON. Yes. You are right. Thank you. Thank you, Mr. 
Chairman.
    Chairman MCCRERY. Mr. Becerra?
    Mr. BECERRA. Thank you all for your testimony. It is 
enlightening and also very disturbing. Ms. Robinson, let me ask 
you something. Have you cleared up your credit record yet?
    Ms. ROBINSON. No, sir. As a result of Nicole Robinson using 
my data, one of the credit reporting agencies is still 
reporting her bad debt as mine.
    Mr. BECERRA. Okay, stop. Mr. Pratt, you represent the 
credit bureaus.
    Mr. PRATT. I do.
    Mr. BECERRA. You hear Ms. Robinson saying that she has been 
going through this for years. Is there any reason why, if we 
contact you pretty soon, you can't tell us that the credit 
bureaus haven't taken care of Ms. Robinson's credit record?
    Mr. PRATT. None whatsoever.
    Mr. BECERRA. Okay. We will make sure that you get Mr. 
Pratt's phone number----
    [Laughter.]
    Mr. BECERRA. --and you will have----
    Ms. ROBINSON. May I also add, though, that I have been 
dealing with that particular credit reporting agency for the 
last 4 years over the same problem, and it prevented me from 
getting a mortgage last year because they were reporting 
$35,000 in bad debt that belonged to her.
    Mr. BECERRA. Stop. Mr. Pratt said that you won't worry 
about that.
    Ms. ROBINSON. Okay.
    Mr. BECERRA. We will be in touch, and certainly you will be 
in touch with----
    Ms. ROBINSON. Yes, I will be in touch.
    Mr. BECERRA. Thank you, and Mr. Pratt, thank you for that. 
Mr. Stein, let me ask a question. What does Countrywide do with 
customers who, for whatever reason, close their accounts and 
their relationship with Countrywide. What do you do, what does 
Countrywide do with that personal private data that it has for 
that individual?
    Mr. STEIN. There may be continuing obligations we have even 
after a relationship is closed, and let me speak more broadly 
for the financial industry in general because I think it is 
true whether lenders or financial institutions. There may be 
continuing obligations we may have with respect to that 
information that keeps it within the organization. That having 
been said, again, we talked about this role-based access and 
restricting the access to the information to those who have a 
true need so that you see only really that information which 
you have need by virtue of your job.
    Mr. BECERRA. I have a mortgage through Countrywide. I pay 
it off. I no longer owe Countrywide any money. You have my SSN 
through the fact that I took out a mortgage with you. I no 
longer have any banking activity with you. You still maintain a 
file with my SSN?
    Mr. STEIN. For our retention period, yes.
    Mr. BECERRA. Which is how long?
    Mr. STEIN. I believe it is probably either 5 or 7 years. 
Offhand, I don't----
    Mr. BECERRA. Who has access to that?
    Mr. STEIN. Again, it would depend on the specific job 
functions within an organization, but it would be those people 
who have, by virtue of their job function, a need to access it. 
For example----
    Mr. BECERRA. Let me, because I am going to run out of time, 
so I don't want to do that, but let me ask you this. Would it 
be feasible economically for a company, an industry, to try to 
do more to shut down access to that personal data sooner than 5 
to 7 years or make it much more restricted in terms of access 
to that information, once there is no need to have an ongoing 
review of that information because the accounts, in essence, 
have been closed?
    Mr. STEIN. Right, and I don't want to imply that once you 
close your relationship, the same people who have had access to 
that information when your relationship was open necessarily 
have it when your relationship is closed.
    Mr. BECERRA. Okay.
    Mr. STEIN. There is some population that does continue to 
have it, because you may call up a year later or 2 years later 
and have some question about your closed relationship that 
someone now needs to get access to.
    Mr. BECERRA. Well, let me ask you this. If I were to call 
your toll-free number to check on the status of my mortgage 2 
years after I have already finished and I punch in on the phone 
my old mortgage account number and I have some questions I need 
to have answered so I get an actual voice on the phone, would 
that person be able to pull up the information that would 
include the SSN?
    Mr. STEIN. The answer is, it depends.
    Mr. BECERRA. Okay. Don't go any further, because I will run 
out of time. If you can guide us on this, I think what we have 
heard is that we have got to try to limit the access as much as 
possible, but we also have to recognize that a lot of commerce 
depends on this information. Let us know what you are doing. 
What are the best practices that you are using to make sure 
that once you don't need it, you are not using it, and once you 
don't need it, others can't access it. It would be helpful to 
know who is doing a good job of making sure that we are closing 
the door on that information the quicker we can.
    Mr. STEIN. Right.
    Mr. BECERRA. That would be helpful. A hypothetical here. 
Social Security says, tomorrow, we are going to scrap the 
current SSN and the system that we have used. We are going to 
reinstate something totally different. Maybe it is with a 
number, but it is different. Everyone in America who has an 
SSN, you will be issued something else. At the same time, we 
pass a law saying we prohibit the use of this new Social 
Security identifier for anything other than Social Security. 
What do your industries, your agencies, what do you do?
    Mr. PRATT. Beyond panic, I guess, would be the question.
    [Laughter.]
    Mr. PRATT. I think there are several parts to that answer. 
One, clearly, biometrics are being used in certain contexts and 
so, yes, there are even today--again, it is very important to 
distinguish between how the number is used to create an 
accurate database to say, I have data associated with this 
number and with this name together, versus how I am going to 
identify you and make sure that you are 100 percent who you say 
you are. Even today, consumers' acceptance of concepts like 
biometrics is much greater than it was perhaps a decade ago.
    I think you would always find some sort of substitutes 
effect. I think the question is at what level of disruption in 
the system overall, between the time that you were to close off 
the system completely and then try to reinstate something else.
    There would be, by the way, a legacy effect. All the data 
that was currently mediated by SSNs would remain. Court records 
would remain associated with the SSN. You are really talking 
almost generationally, anyway. You are talking about very, very 
long periods of time as you move away. It does get into 
discussions of cards and whether cards will have algorithms on 
them and whether cards will store additional information and 
whether they are used for limited purposes or more extended 
purposes. These are very complicated issues that certainly go 
well beyond the pale of our industry or, I suspect, any of us 
here at the table.
    Mr. BECERRA. One way or the other, you will find some type 
of universal identifier that can help you keep tabs of the 
population.
    Mr. PRATT. Well, I would say two things could happen. 
Number one, you could have less data mediated, which means, for 
example, consumers today who already are unhappy when we don't 
have a certain account that they have been paying on time for 
many, many years that Countrywide wants to use to approve a 
loan, when it is not in their credit report, they are also 
unhappy with us, just as they are unhappy when there might be 
data in their credit report that they say is not theirs. What 
you do have with the removal of an identifying system or a 
single unique identifier like the SSN is potential 
disintermediating and disconnecting data which can be mediated 
and which can be used for good things, such as me getting the 
car loan on the weekend or getting the student loan for my kids 
and so on and so forth. There are effects like that that we 
probably can't entirely predict today.
    Even the FTC was asked to look at how SSNs interplayed with 
credit reports, and that was a study that was done during the 
2003 FACT Act, and they concluded that, really, you move away 
from a binary, good or bad, proposition and you are on a 
continuum, move one direction, and maybe there is less SSNs and 
so maybe certain types of risks are reduced, but maybe you have 
disintermediated data. It was all about do you move toward more 
inclusivity or do you move toward more exclusion or separation? 
That is the kind of database continuum our members tend to 
operate on. Which way do I go?
    Mr. BECERRA. Thank you.
    Mr. STEIN. If I may just take one moment, when you talk 
about things like biometrics and other kinds of identifiers to 
uniquely identify an individual and you compare it to the SSN 
issue, the one thing to keep in mind is that the SSN is a 
national unique identifier. In the absence of having a national 
registry of fingerprints, retinal scans, facial recognition, 
hand geometry, whatever you want it to be, there is no way to 
take those disparate pieces and put them all together into a 
credit report. In the absence of that, it is probably more 
likely rather than less likely that the Nicole Robinsons of the 
world get joined with someone who really isn't them.
    In this case, the person used her SSN with her same name. 
In other circumstances, you are going to have people, a whole 
bunch of Nicole Robinsons that may get joined together because 
there is not that unique identifier that puts them together.
    Mr. BECERRA. Thank you. Thank you, Mr. Chairman.
    Chairman MCCRERY. Thank you very much, gentlemen and 
ladies. We appreciate your testimony and your responses to our 
questions.
    That concludes today's hearing. The Subcommittee is 
adjourned.
    [Whereupon, at 4:40 p.m., the Subcommittee was adjourned.]
    [Submissions for the record follow:]

                                         Corona Del Mar, California
                                                     March 27, 2006
    Dear Members of the Subcommittee and Participants of this series of 
Hearings:
    My name is John Patrick Kenney. I earn my living as a real estate 
developer and I am licensed as a real estate broker in California. I am 
a former recipient of Long Term Social Security of Disability Benefits. 
I am recent recipient of the National Republican Congressional 
Committee Ronald Reagan Medal and 2005 Businessman of the year Award. I 
am also the plaintiff in a Federal District Court Lawsuit against the 
commissioner of Social Security, currently awaiting a decision in case 
#SACV 05-00426 (MAN). John P. Kenney Vrs. Commissioner of Social 
Security. The agency misused my Social Security Number, identifying me 
as the recipient of a mistaken overpayment decision. This resulted in 
damages similar to those incurred in identity theft and was a violation 
of the bill of rights in the constitution of the United States. As I 
expect tot win this case, actual damages today are approximately 12.5 
million daollars and increasing at a rate of about $30,000.00 per 
calendar day. Patrick O'Carroll, the SSA Inspector General has recently 
in this series and through reports, informed you, that the SSA may have 
made: 600,000 errors of overpayments and underpayments of the Social 
Security Benefits, has put you on notice of this, I'm sorry to say, 
error prone agency. The problem is that you, the congress, has backed 
this error prone agency with police powers to collect erroneous debts 
with minimal if any oversight. For example, the Federal Trade 
Commission is not permitted to enforce fair credit reporting or fair 
debt collection laws you enacted for our protection against the SSA. 
The president's management agenda is I believe correct . . . get our 
money out of the hands of this poorly managed bureaucracy. So, as a 
consequence of the above I legitimately expect a ``Social Security'' 
check soon between $12,000,000.00 and $20,000,000.00 depending on how 
long this agency wants to fight by withholding evidence, slandering my 
character in the public court record, appealing to the 9th circuit or 
whatever failure prone tactic they may want to attempt. So . . . this 
error prone agency should not of and by itself and without real 
oversight possess the police powers have given it. I expect to prevail 
in my case and expect some public notice in the media to precipitate 
many an angry or scared taxpayer to contact you. What would happen to 
the general fund if 600,000 individuals had the opportunity, the 
inclination, the resources to sue the Social Security Administration 
for violating the privacy act as I have done? Please call on me if you 
need some help, even though I've missed meals and been forced by the 
above to try to relocate my business out of the country. I'm willing to 
help this subcommittee any way I am able.
                                                     John P. Kenney

                                 

           Statement of J. Michelle Sybesma, Fishers, Indiana
    You may find it hard to believe that once upon a time I carried an 
affidavit from the United States Postal Inspection Service verifying 
was indeed who I professed to be. From the looks of my photo, you might 
find it amusing to read my most recent state registered identification 
had said that I was not only Male, but of a Latin American heritage, 2 
inches shorter, and about 15 lbs heavier than when I stood in front on 
you.
    The truth was, before I figured out what happened I had a house in 
the low-income projects in Danville, IL and another just outside my 
hometown in Indianapolis, IN. Someone was utilizing my personal 
information and morphing it into someone that was in no way aligned 
with the principles of good ethics.
    This was over ten years ago. I now know better than most what it 
takes to establish new social security number and have to spend years 
in the fighting to reclaim your identity. However, I am no victim. I am 
inclined to believe things happen for a reason and this happened to me 
so I might teach others how to prevent it. The experience left me 
smarter, credit wiser and fighting mad to make sure it does not happen 
to others.
    The most recent Federal Trade Commission statistics show that 12.7% 
of individuals surveyed have been personally touch by some sort of 
credit card fraud or identity theft.
    As a consultant and professional speaker who covers topic to teach 
groups the importance of proper precautions to risk factors of Identity 
theft, I can tell you a more accurate statistic never stood.
    If requested to testify, I can tell you a great deal about the 
inherent risk in business using our SSNs a primary identifier. Most 
people do not understand the long term impact this can have on the rise 
of this epidemic. Please consider contacting me to speak for your sub-
committee. Not since the Fair Credit Reporting Act of 1996 has there 
been a piece of potential legislation that had such impact on that of 
Identity Theft. Thank you.

                                  

```