```

[House Hearing, 107 Congress]
[From the U.S. Government Publishing Office]

 
         PREVENTING IDENTITY THEFT BY TERRORISTS AND CRIMINALS

=======================================================================

                             JOINT HEARING

                               BEFORE THE

                            SUBCOMMITTEE ON
                      OVERSIGHT AND INVESTIGATIONS

                                 OF THE

                    COMMITTEE ON FINANCIAL SERVICES

                                AND THE

                    SUBCOMMITTEE ON SOCIAL SECURITY

                                 OF THE

                      COMMITTEE ON WAYS AND MEANS

                                 OF THE

                     U.S. HOUSE OF REPRESENTATIVES

                      ONE HUNDRED SEVENTH CONGRESS

                             FIRST SESSION
                               __________

                            NOVEMBER 8, 2001
                               __________

    Printed for the use of the Committee on Financial Services and 
                    the Committee on Ways and Means

                           Serial No. 107-50
                   (Committee on Financial Services)

                           Serial No. 107-51
                     (Committee on Ways and Means)

                        U.S. GOVERNMENT PRINTING OFFICE
                                WASHINGTON : 2002
_____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512-1800  
Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001

                 HOUSE COMMITTEE ON FINANCIAL SERVICES

                    MICHAEL G. OXLEY, Ohio, Chairman

JAMES A. LEACH, Iowa                 JOHN J. LaFALCE, New York
MARGE ROUKEMA, New Jersey, Vice      BARNEY FRANK, Massachusetts
    Chair                            PAUL E. KANJORSKI, Pennsylvania
DOUG BEREUTER, Nebraska              MAXINE WATERS, California
RICHARD H. BAKER, Louisiana          CAROLYN B. MALONEY, New York
SPENCER BACHUS, Alabama              LUIS V. GUTIERREZ, Illinois
MICHAEL N. CASTLE, Delaware          NYDIA M. VELAZQUEZ, New York
PETER T. KING, New York              MELVIN L. WATT, North Carolina
EDWARD R. ROYCE, California          GARY L. ACKERMAN, New York
FRANK D. LUCAS, Oklahoma             KEN BENTSEN, Texas
ROBERT W. NEY, Texas                 JAMES H. MALONEY, Connecticut
BOB BARR, Georgia                    DARLENE HOOLEY, Oregon
SUE W. KELLY, New York               JULIA CARSON, Indiana
RON PAUL, Texas                      BRAD SHERMAN, California
PAUL E. GILLMOR, Ohio                MAX SANDLIN, Texas
CHRISTOPHER COX, California          GREGORY W. MEEKS, New York
DAVE WELDON, Florida                 BARBARA LEE, California
JIM RYUN, Kansas                     FRANK MASCARA, Pennsylvania
BOB RILEY, Alabama                   JAY INSLEE, Washington
STEVEN C. LaTOURETTE, Ohio           JANICE D. SCHAKOWSKY, Illinois
DONALD A. MANZULLO, Illinois         DENNIS MOORE, Kansas
WALTER B. JONES, North Carolina      CHARLES A. GONZALEZ, Texas
DOUG OSE, California                 STEPHANIE TUBBS JONES, Ohio
JUDY BIGGERT, Illinois               MICHAEL E. CAPUANO, Massachusetts
MARK GREEN, Wisconsin                HAROLD E. FORD Jr., Tennessee
PATRICK J. TOOMEY, Pennsylvania      RUBEN HINOJOSA, Texas
CHRISTOPHER SHAYS, Connecticut       KEN LUCAS, Kentucky
JOHN B. SHADEGG, Arizona             RONNIE SHOWS, Mississippi
VITO FOSSELLA, New York              JOSEPH CROWLEY, New York
GARY G. MILLER, California           WILLIAM LACY CLAY, Missouri
ERIC CANTOR, Virginia                STEVE ISRAEL, New York
FELIX J. GRUCCI, Jr., New York       MIKE ROSS, Arizona
MELISSA A. HART, Pennsylvania         
SHELLEY MOORE CAPITO, West Virginia  BERNARD SANDERS, Vermont
MIKE FERGUSON, New Jersey
MIKE ROGERS, Michigan
PATRICK J. TIBERI, Ohio

             Terry Haines, Chief Counsel and Staff Director
                                 ------                                

              Subcommittee on Oversight and Investigations

                     SUE W. KELLY, New York, Chair

RON PAUL, Ohio, Vice Chairman        LUIS V. GUTIERREZ, Illinois
PETER T. KING, New York              KEN BENTSEN, Texas
ROBERT W. NEY, Texas                 JAY INSLEE, Washington
CHRISTOPHER COX, California          JANICE D. SCHAKOWSKY, Illinois
DAVE WELDON, Florida                 DENNIS MOORE, Kansas
WALTER B. JONES, North Carolina      MICHAEL CAPUANO, Massachusetts
JOHN B. SHADEGG, Arizona             RONNIE SHOWS, Mississippi
VITO FOSSELLA, New York              JOSEPH CROWLEY, New York
ERIC CANTOR, Virginia                WILLIAM LACY CLAY, Missouri
PATRICK J. TIBERI, Ohio

                   HOUSE COMMITTEE ON WAYS AND MEANS

                   BILL THOMAS, California, Chairman

PHILIP M. CRANE, Illinois,           CHARLES B. RANGEL, New York
E. CLAY SHAW, Jr., Florida           FORTNEY PETE STARK, California
NANCY L. JOHNSON, Connecticut        ROBERT T. MATSUI, California
AMO HOUGHTON, New York               WILLIAM J. COYNE, Pennsylvania
WALLY HERGER, California             SANDER LEVIN, Michigan
JIM McCRERY, Louisiana               BENJAMIN L. CARDIN, Maryland
DAVE CAMP, Michigan                  JIM McDERMOTT, Washington
JIM RAMSTAD, Minnesota               GERALD D. KLECZKA, Wisconsin
JIM NUSSLE, Iowa                     JOHN LEWIS, Georgia
SAM JOHNSON, Texas                   RICHARD E. NEAL, Massachusetts
JENNIFER DUNN, Washington            MICHAEL R. McNULTY, New York
MAC COLLINS, Georgia                 WILLIAM J. JEFFERSON, Louisiana
ROB PORTMAN, Ohio                    JOHN S. TANNER, Tennessee
PHILIP S. ENGLISH, Pennsylvania      XAVIER BECERRA, California
WES WATKINS, Oklahoma                KAREN L. THURMAN, Florida
J.D. HAYWORTH, Arizona               LLOYD DOGGETT, Texas
JERRY WELLER, Illinois               EARL POMEROY, North Dakota
KENNY HULSHOF, Missouri
SCOTT McINNIS, Colorado
RON LEWIS, Kentucky
MARK FOLEY, Florida
KEVIN BRADY, Texas
PAUL RYAN, Wisconsin

                                 ------                                

                    Subcommittee on Social Security

                  E. CLAY SHAW, Jr., Florida, Chairman

SAM JOHNSON, Texas                   ROBERT T. MATSUI, California
MAC COLLINS, Georgia                 LLOYD DOGGETT, Texas
J.D. HAYWORTH, Arizona               BENJAMIN L. CARDIN, Maryland
KENNY HULSHOF, Missouri              EARL POMEROY, North Dakota
RON LEWIS, Kentucky                  XAVIER BECERRA, California
KEVIN BRADY, Texas
PAUL RYAN, Wisconsin

                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on:
    November 8, 2001.............................................     1
Appendix:
    November 8, 2001.............................................    45

                               WITNESSES
                       Thursday, November 8, 2001

Bond, Hon. Philip J., Under Secretary for Technology, Department 
  of 
  Commerce.......................................................     7
Bovbjerg, Barbara D., Director, Education, Workforce and Income 
  Security Issues, U.S. General Accounting Office................    13
Dugan, John C., Partner, Covington & Burling, on behalf of the 
  Financial Services Coordinating Council........................    32
Hillman, Richard J., Director, Financial Markets and Community 
  Investment Issues, U.S. General Accounting Office..............    13
Hendricks, Evan, Editor and Publisher, Privacy Times.............    36
Huse, Hon. James G., Jr., Inspector General, Social Security 
  Administration.................................................     9
Lehner, Thomas J., Executive Vice President, American Financial 
  Services Association...........................................    28
Pratt, Stuart K., Vice President, Government Relations, 
  Associated Credit Bureaus......................................    26
Rotenberg, Marc, Executive Director, Electronic Privacy 
  Information Center; Adjunct Professor, Georgetown University 
  Law Center.....................................................    34
Sadaka, Thomas A., Special Counsel for Computer Crime and 
  Identity Theft Prosecutions, Florida Office of Statewide 
  Prosecution....................................................    30
Streckewald, Fritz, Acting Assistant Deputy Commissioner for 
  Disability and Income Security Programs, Social Security 
  Administration.................................................    11

                                APPENDIX

Prepared statements:
    Kelly, Hon. Sue W............................................    47
    Shaw, Hon. E. Clay Jr........................................    49
    Oxley, Hon. Michael G........................................    46
    Cardin, Hon. Benjamin L......................................    51
    Gutierrez, Hon. Luis V.......................................    53
    Paul, Hon. Ron...............................................    54
    Schakowsky, Hon. Janice D....................................    56
    Bond, Hon. Philip J..........................................    57
    Bovbjerg, Barbara D., and Richard J. Hillman, joint statement    87
    Dugan, John C................................................   113
    Hendricks, Evan..............................................   131
    Huse, Hon. James G., Jr......................................    62
    Lehner, Thomas J.............................................   107
    Pratt, Stuart K..............................................   100
    Rotenberg, Marc..............................................   126
    Sadaka, Thomas A.............................................   110
    Streckewald, Fritz...........................................    73
              Additional Material Submitted for the Record

Bovbjerg, Barbara D., and Richard J. Hillman:
    Written response to questions from Congressman Gutierrez and 
      the 
      Subcommittee on Social Security............................    96
Dugan, John C.:
    Written response to questions from Congressman Gutierrez and 
      the 
      Subcommittee on Social Security............................   123
Hendricks, Evan:
    Written response to questions from Congressman Gutierrez and 
      the 
      Subcommittee on Social Security............................   135
Huse, Hon. James G., Jr.:
    Written response to questions from Congressman Gutierrez and 
      the 
      Subcommittee on Social Security............................    67
Streckewald, Fritz:
    Response to an inquiry from Congresswoman Kelly..............    82
    Response to an inquiry from Congressman Shaw.................    83
    Written response to questions from Congressman Gutierrez and 
      the 
      Subcommittee on Social Security............................    84
Comserv, Inc., prepared statement................................   137
Erisa Industry Committee, prepared statement.....................   140
National Council on Teacher Retirement, prepared statement.......   142

  JOINT HEARING: PREVENTING IDENTITY THEFT BY TERRORISTS AND CRIMINALS

                              ----------                              

                       THURSDAY, NOVEMBER 8, 2001

             U.S. House of Representatives,
     Subcommittee on Oversight and Investigations, 
                   Committee on Financial Services,
                                            and the
                          Subcommittee on Social Security, 
                               Committee on Ways and Means,
                                                    Washington, DC.
    The subcommittees met, pursuant to call, at 10:10 a.m., in 
room 2128, Rayburn House Office Building, Hon. Sue W. Kelly, 
[chairwoman of the Subcommittee on Oversight and 
Investigations], and E. Clay Shaw, Jr., [chairman of the 
Subcommittee on Social Security], presiding.
    Present from Subcommittee on Oversight and Investigations: 
Chairwoman Kelly; Representatives Weldon, Inslee, Tiberi, 
Jones, Shows and Clay.
    Present from Subcommittee on Social Security: Chairman 
Shaw; Representatives Matsui, Cardin, Becerra, Doggett, 
Collins, Brady, and Ryan.
    Also attending was Congresswoman Hooley.
    Chairwoman Kelly. This joint hearing of the Committee on 
Financial Services Subcommittee on Oversight and 
Investigations, and Committee on Ways and Means Subcommittee on 
Social Security, will now come to order.
    I welcome today my colleagues, Clay Shaw, and Ben Cardin. 
I'm delighted that we also have other colleagues here--Darlene 
Hooley. Thank you very much.
    I look forward to hearing what the witnesses have to say.
    We're here this morning to see how we can prevent the awful 
crime and terrible tragedy of identity theft by terrorists and 
criminals. Our special intention is to protect the families of 
the deceased from such theft and financial fraud at their most 
vulnerable moment--when they are grieving from the shock of 
their loss.
    Through the rapid transmittal of the information in the 
Death Master File from the Social Security Administration to 
the financial services industry and the immediate use of that 
information by the industry, we can prevent these crimes and 
spare the families pain.
    James Jackson and Derek Cunningham stole hundreds of 
thousands of dollars in gems and watches from deceased 
executives of our major corporations before being caught by law 
enforcement. They stole the identity of the late CEO of Wendy's 
International within days after his death and were not arrested 
until about 2 months later.
    In the past 2 months, we learned that identity theft could 
be a tool of the hijackers who murdered thousands of our fellow 
citizens, and of their accomplices as well.
    Last week, the Inspector General of the Social Security 
Administration testified that some of the 19 hijackers used 
phony Social Security numbers to perpetrate their murders. And 
we know that Lofti Raisi, an Algerian held on suspicion that he 
trained four of the hijackers how to fly, used the Social 
Security number of a New Jersey woman who has been dead for 10 
years.
    Even after these events, and after three of us serving on 
the Financial Services Committee requested the SSA to ensure 
the rapid transmission of the Death Master File, we've received 
no commitment from the SSA to take any specific action.
    The file is still physically shipped to an agency at the 
Commerce Department, where copies are made and physically 
shipped to subscribers.
    In other words, ``snail-mail.''
    There has been no reduction for years in the time that it 
takes for the SSA to officially notify the financial services 
industry of a death. Identity theft is now part of the first 
war of the 21st Century, but the Federal Government is still 
treating it in a 1960s way.
    That must end. That is why we asked the General Accounting 
Office to study the matter and report their findings to the 
committee. That is why we're so pleased that the Ways and Means 
Subcommittee on Social Security, chaired by my colleague, 
Representative Clay Shaw, can join us in holding a joint 
hearing today.
    We need the Social Security Administration to take bold and 
immediate action to get the information to the financial 
services industry. We will hear from the SSA, the Commerce 
Department, the General Accounting Office, and we expect an 
innovative and effective solution.
    We also need the financial services industry to ensure that 
the information is immediately integrated into databases and 
available for permanently deactivating Social Security numbers 
of the deceased.
    Moreover, with the passage of the USA Patriot Act, there 
will soon be Treasury Department regulations requiring them to 
verify the identification of new account-holders and for 
customers to provide the identification requested by the 
companies.
    We know that the SSA and financial institutions can meet 
this challenge. In the past 3 years, they've already met two 
difficult challenges--the Y2K conversion and the aftermath of 
the terrorist attacks.
    The SSA was a leader among Government agencies in 
successfully avoiding the Y2K glitch and the financial 
institutions breezed through the turn of the millennium without 
a single major problem.
    As the acting SSA commissioner testified last week before 
Representative Shaw's subcommittee, the SSA regional offices in 
the New York and Pennsylvania area reacted with fortitude and 
compassion to assist the victims and their families, and I want 
to thank the Social Security Administration for their wonderful 
assistance to New Yorkers, including the many of those in my 
district.
    After the horrendous destruction in New York City 
interrupted the financial markets and killed many, financial 
institutions there and across the country picked themselves up, 
dusted off, and got back to work with an amazing speed and 
grace, even while mourning their compatriots.
    And all of them did all of that, the Y2K conversion and the 
recovery from the attacks, without any specific mandate in 
Federal law.
    Surely, we can work together to meet this challenge before 
us now. I urge all parties to get together and, based on the 
GAO's findings, leapfrog over the antiquated system now used, 
and stop identity theft of the deceased.
    Representative Shaw will chair the hearing for the first 
panel of witnesses. I will chair the hearing for the second 
panel.
    Thank you.
    [The prepared statement of Hon. Sue W. Kelly can be found 
on page 47 in the appendix.]
    Chairman Shaw. Thank you, Ms. Kelly. We appreciate being 
here in your committee room and being able to join with you in 
this hearing this morning.
    Today, our two subcommittees join together to examine ways 
to prevent identity theft by terrorists and criminals. When 
Social Security numbers were created 65 years ago, their only 
purpose was to track a worker's earnings so that Social 
Security benefits could be calculated. But today, use of the 
Social Security number is pervasive.
    Our culture is hooked on Social Security numbers. 
Businesses and Government use the number as their primary 
source of identifying individuals. You can't even conduct the 
most frivolous transaction, like renting a video at your local 
store, without someone asking you first to render your 9-digit 
Social Security ID.
    Interestingly enough, I had a doctor's appointment last 
Friday. It was a doctor I had never been to before. And I 
noticed when I was signing in, my Social Security number was 
required.
    I mentioned that to him back in the examining room and I 
told him, I said, the time is going to come when you're not 
going to be able to get that number. And he said, well, I hope 
it does, because he had been a victim of identity theft and it 
took him many years through the various layers of collection 
agencies to finally show that he was not the one that ran the 
tremendous debt up on the credit cards.
    Your Social Security number is a key that unlocks the doors 
to your identity for any unscrupulous individual who gains 
access to it. Once the door is unlocked, the criminal or 
terrorist has at their fingertips all the essential elements 
needed to carry out whatever dastardly act that they conceive.
    We now know that some terrorists involved in the September 
11th attacks illegally obtained Social Security numbers and 
used them to steal identities and obtain false documents, thus 
hiding their true identities and their motives. These 
unspeakable acts shine an intense spotlight on the need for the 
Government and the private industry to be vigilant in 
protecting identities. It also demands that safeguards to 
prevent identity theft are put in place and put in place now.
    Earlier this year, I, along with several of my Ways and 
Means colleagues, introduced H.R. 2036, the Social Security 
Number Privacy and Identity Theft Prevention Act of 2001. This 
bipartisan bill represents a balanced approach to protecting 
the privacy of Social Security numbers, while allowing for 
their legitimate uses.
    Because of its broad scope, the bill has also been referred 
to the Committee on Energy and Commerce and the Committee on 
Financial Services, in addition to Ways and Means. I urge 
prompt action by all three committees so that we may bring this 
important legislation to the floor as quickly as possible.
    It is a needed part of our Nation's response to terrorism.
    Sadly, identity theft is a crime not perpetrated just 
against the living. A Washington Post article on Saturday, 
September 29th, reported that a man detained in Great Britain 
and suspected of training the terrorists who hijacked the 
airliners on September 11th, used the Social Security number of 
a New Jersey woman who died in 1991.
    The Associated Press reported on October 31st, that an 
individual from North Carolina had been indicted on charges he 
tried to steal the identity of someone killed in the terrorist 
attack at the World Trade Center.
    Therefore, today, we will take a hard look at the sharing 
of death information. The Social Security Administration 
maintains the most comprehensive file of death information in 
the Federal Government. How this information is compiled, its 
accuracy, and the speed with which it is shared with the public 
will be explored.
    Because the financial services industry relies 
fundamentally on Social Security numbers as the common 
identifier to assemble accurate financial information, they are 
in a unique position to assist in the prevention of Social 
Security number fraud and abuse. Their timely receipt of death 
information and prompt updating of financial data is key in 
preventing identity theft.
    In the past, some businesses have not been enthusiastic 
about further restricting the use of Social Security numbers. 
It is my hope they will rethink their resistance in light of 
September 11th.
    Identity theft is a national security threat involving life 
and property. Safeguards will be made and I predict sooner 
rather than later.
    Mr. Cardin.
    [The prepared statement of Hon. E. Clay Shaw Jr. can be 
found on page 49 in the appendix.]
    Mr. Cardin. Thank you, Mr. Shaw. Let me thank both Chairman 
Shaw and Chairwoman Kelly for convening this joint hearing 
today.
    This is an extremely important subject. We're working in a 
very bipartisan way to do everything we can to prevent identity 
theft.
    The FBI considers identity theft to be one of the fastest-
growing crimes in the United States. 350,000 cases a year.
    We can do better.
    The focus of today's hearing is going to spend a lot of 
time on the SSA's Death Master File, where it compiles the 
names and Social Security numbers of those individuals who have 
recently died.
    Questions have been raised as to whether those files are as 
up-to-date as they need to be and whether that information is 
being shared, particularly with financial institutions, in the 
most effective way in order to reduce the amount of identity 
fraud.
    I think there's a joint responsibility here and when the 
panel presents their testimony, I hope that they will deal with 
this. There's clearly a responsibility by SSA to have the 
information available so that we can prevent identity theft.
    But there's also responsibility in the private sector, 
particularly of financial institutions, as to how they deal 
with identity in the use of fraudulent or false information.
    Both need to work together in order to accomplish it.
    The Chairmen have given us examples that should chill all 
of us. The fact that several of the hijackers had fraudulent SS 
numbers, that is something that is unacceptable. The fact that 
a terrorist apprehended in Britain had a Social Security number 
that was from a deceased person that was 10 years old is 
unacceptable. We can do better than that.
    There is now, of course, a ring of thefts involving 
recently-deceased business executives. Ms. Kelly mentioned the 
Wendy's executive.
    We need to be wiser in how we deal with the Social Security 
numbers and updating the data bank at the public level, sharing 
with the private sector, to avoid these types of crimes.
    I think the questions being raised is whether we can update 
these Death Master Files in a more effective way, would that 
have prevented some of these ID thefts?
    But I must at least raise some additional questions here as 
we go through this hearing.
    We have the question that the primary purpose, the primary 
mission of the SSA's use of the Social Security card is to 
maintain earnings records and pay benefits in the case of 
death, retirement and disability.
    I have concern about making the list more up-to-date and 
easier to use, could compromise individual privacy and have the 
unintended consequence of making it easier, rather than more 
difficult, for people to steal and use false SSNs.
    So there are tradeoffs here.
    We also have the challenge of joint accounts, where one 
person dies and you have another person account. If we all of a 
sudden freeze those assets, in a way, we may be causing 
unintended problems for our constituents.
    So these are not easy issues.
    But the bottom line is we cannot accept the number of 
thefts that are occurring today through the use of Social 
Security numbers. We need to do a better job. And we look 
forward to working with the people who will be here today on 
our panel and others so that we can effectively combat this 
criminal activity.
    Thank you, Mr. Chairman.
    Chairman Shaw. Thank you.
    Mr. Weldon, do you have a statement?
    Mr. Weldon. No, thank you, Mr. Chairman.
    Chairman Shaw. Mr. Inslee.
    Mr. Inslee. No statement, Mr. Chairman.
    Chairman Shaw. Mr. Tiberi.
    Mr. Tiberi. No, thank you, Mr. Chairman.
    Chairman Shaw. Ms. Hooley.
    Ms. Hooley. Thank you, Chairman Shaw, and Chairwoman Kelly.
    We've heard numerous times today identity theft is an equal 
opportunity crime. It affects victims of all ages, all incomes, 
and all ethnic backgrounds.
    Ms. Kelly told us about Wendy's CEO. But more often than 
not, identity theft is something that affects the ordinary 
citizen, the person who is working hard, paying their taxes, 
and trying to do their best in life.
    For example, a little over a year ago, a young man from 
Oregon named Sean Bolden, appeared before the full Banking 
Committee to testify about his personal nightmare with identity 
theft.
    In Sean's case, identity thieves had opened dozens of 
financial accounts with his Social Security number and, as a 
result, at age 23, he was unable to obtain any credit 
whatsoever, including student loans.
    And then there's the case of the little boy in Salem, 
Oregon, named Tyler Bales. Tyler was 16 months old when he lost 
his battle with a rare genetic disease called Hurler's 
Syndrome.
    Now there's nothing more tragic than losing a child. 
Unfortunately, the heartache of Tyler's loss hasn't been eased 
for his parents.
    Not only isn't it hard enough losing a 16-month-old child, 
but last spring, the Bales learned, courtesy of the Internal 
Revenue Service, that someone claimed Tyler as a dependent on 
their 2000 income tax return and, as a result, the Bales' 
income tax return was rejected.
    As disturbing as that is, it gets worse.
    Because of Federal disclosure issues, the IRS cannot give 
out the name of the identity theft to the Salem Police 
Department, even though identity theft is a felony offense in 
Oregon. The thief could live right down the street or 3000 
miles away. But because of a loophole in the IRS, the Bales and 
the police department will never know who stole their son's 
personal information.
    Mr. Chair, I submit that Tyler Bales and Sean Bolden are 
more than a name, a date of birth, or a Social Security number, 
and that's why I've been a strong advocate of stamping out the 
crime of identity theft.
    In Tyler's case, I introduced H.R. 2077, the ID Theft 
Loophole Closure bill. It is in the Ways and Means Committee. 
It is a very simple bill that says the IRS, in fact, can give 
out the information to the local police.
    I know our economy in a large degree depends on the flow of 
free information. However, it's imperative that we recognize 
that private information is just that--private--and not a 
salable commodity or something to be exposed by unscrupulous 
individuals.
    Literally, this is the fastest-growing crime there is. The 
numbers are outrageous. And I could spend some times with 
numbers, but I don't want to do that. What I want to express 
today is this is happening more and more frequently. It's 
happening with people who are committing other crimes.
    In Salem, the police department has said that in the last 2 
years, ID theft has increased by over 38 percent and much of 
that is related to also methamphetamine abuse, is the 
motivating factor.
    We need to close some of these loopholes. We need to do 
something with identity theft, instead of just talk about it. 
And I think today's hearing is a good start and I yield back my 
time.
    Chairman Shaw. Thank you very much.
    Now I'd like to introduce our first panel this morning.
    We first have:
    The Honorable Philip Bond, who is the Undersecretary of 
Technology at the United States Department of Commerce;
    Jim Huse is no stranger to the subcommittees, he is the 
Inspector General of the Social Security Administration;
    Fritz Streckewald, Acting Assistant Deputy Commissioner for 
Disability and Income Security Programs of the Social Security 
Administration;
    Barbara Bovbjerg, the Director--Barbara, if I ever fail to 
mispronounce your name, would you please call me down on it?
    [Laughter.]
    Ms. Bovbjerg. It's ``Bo-berg,'' and everyone has trouble 
with it.
    Chairman Shaw. And it seems, as long as I've known you, I'd 
have gotten it right by now.
    [Laughter.]
    But you certainly are no stranger to the subcommittees, 
because you're the Director of Education, Workforce and Income 
Security of the General Accounting Office.
    And Richard Hillman, who is the Director of the Financial 
Markets and Community Investment of the General Accounting 
Office.
    Welcome to all the witnesses. We have your full statements 
and they'll be made a part of the record. You may proceed as 
you see fit.
    Mr. Bond.

     STATEMENT OF HON. PHILIP J. BOND, UNDER SECRETARY FOR 
            TECHNOLOGY, U.S. DEPARTMENT OF COMMERCE

    Mr. Bond. Thank you, Mr. Chairman, Chairwoman Kelly, 
Members of both subcommittees. I want to thank you for inviting 
me here to address an important issue, obviously of combatting 
fraudulent use of Social Security numbers of decreased 
individuals.
    The National Technical Information Service, NTIS, is a 
component of the Department of Commerce. It's involved in this 
issue because it makes available to the public the Social 
Security Administration's Death Master File extract.
    Let me just say by way of preface that as someone who spent 
7 years working in the people's house, sitting back there in 
the staff row, it's a special and deep honor for me to come 
back here and work with you in trying to work toward a solution 
and improvement in the system in this regard.
    Obviously, September 11th has caused all of us to revisit 
and reassess what we're doing in every branch of Government, 
and certainly that is true at the Department of Commerce, where 
Secretary Evans has us involved deeply in that reassessment.
    So I want to commend you for holding this hearing, for the 
leadership, and for bringing some attention to this matter. And 
I'm confident that as the subcommittees look into this, that 
they'll find that technology is part of the solution.
    First, very quickly, a bit about NTIS.
    For over 50 years, NTIS has collected, organized and 
permanently preserved most of the research and technical 
reports of the Federal Government. There are today about 3 
million information products in its permanent collection.
    NTIS, I want to stress, received no appropriated funds. It 
is self-sustaining, basically on the sale of these largely 
technical manuals and reports.
    Many agencies in the Federal Government work with NTIS 
because they know the agency has the ability to make their 
information products more widely available, beyond their normal 
constituency, and in different formats.
    Clearly, it would be more expensive if all of the agencies 
tried to replicate this infrastructure.
    A quick example. The Defense Technical Information Center 
provides its technical reports directly to the folks in their 
community. But they turn to the NTIS for the release of 
unclassified research to the public at large.
    Similarly, the Social Security Administration distributes 
the Death Master File to Federal agencies, some State and local 
agencies, but they turn to the NTIS to make it available to 
others, in part because SSA does not currently have the 
capacity or the distribution networks.
    Very quickly, my principal comments here will address what 
NTIS does with the files once we receive them and I'll defer to 
that agency on a description of the preparation of the files, 
other than to say that, on a quarterly basis, they do the full 
Master File and then monthly updates beyond that.
    The Death Master File contains only basic information--
Social Security number, last name, first name, date of death, 
date of birth, State or county of residence, zip code for the 
last residence, and last lump-sum payment.
    Obviously, the Death Master File can be a great help for 
detecting erroneous or fraudulent payments.
    Accordingly, SSA makes it available directly to a number of 
agencies that pay benefits or have other needs for this 
information, such as preparing statistical studies and to 
States which use the list to detect fraud or administrative 
errors, including fraudulent or erroneous food stamp payments, 
for example.
    At the same time, SSA makes the Death Master File available 
to these Federal agencies, they make it available to NTIS for 
reproduction and distribution to others.
    We receive this information on a cartridge via overnight 
mail and copy the information onto magnetic tape or cartridge 
or CD, depending on what our end-user has requested.
    And I want to stress that NTIS will of course be pleased to 
consider other formats.
    It typically takes 1 to 3 days for NTIS to complete this 
production process, having received the cartridge and then 
turning it around.
    We send the file to more than one hundred subscribers, 
either via overnight mail or first-class mail, if that is their 
preference. All formats are sent out at the same time.
    The turn-around time does depend in part on the size of the 
file, but it is not generally a function of the fact that NTIS 
offers it in various formats.
    That is not the source of delay.
    We understand that the Social Security Administration is 
exploring new approaches to making the file available in a more 
timely technological manner. These include sending the file to 
NTIS electronically and sending updates on a weekly, rather 
than monthly, basis.
    Clearly, electronic transfer would certainly reduce the 
turn-around time. Subscribers would probably find it easier to 
obtain just the updates electronically rather than the massive 
Master File.
    In any event, we are committed to working with SSA to 
improve the delivery of this important product.
    Finally, let me express--I understand there's a desire in 
the financial community for a web-based search capability. That 
is an interesting proposal that we will certainly look at.
    And again, NTIS is pleased to look at that further. If 
there's anything that we can or should do to expedite the 
process, we want to do it as soon as possible.
    Thank you, Mr. Chairman.
    [The prepared statement of Hon. Philip J. Bond can be found 
on page 57 in the appendix.]
    Chairman Shaw. Thank you, Mr. Bond.
    Mr. Huse.

STATEMENT OF HON. JAMES G. HUSE, JR., INSPECTOR GENERAL, SOCIAL 
                    SECURITY ADMINISTRATION

    Mr. Huse. Good morning, Mr. Chairman. Thank you for having 
me. Chairwoman Kelly.
    While I have testified on the issue of identity theft 
before various committees in both the House and Senate, the 
issues of September 11th lend a renewed urgency to this issue.
    Identity theft was already a significant problem facing law 
enforcement, the financial industry, and the American public 
before September 11th. In the weeks since that terrible day, it 
has become increasingly apparent that improperly obtained 
Social Security numbers were a factor in the terrorists' 
ability to assimilate themselves into our society while they 
planned their attacks.
    While this has heightened the urgency of the need for 
Congress, the Social Security Administration, and my office to 
take additional steps to protect the integrity of the Social 
Security number, it has not altered the nature of the steps 
that must be taken.
    The Social Security number, no matter how much we avoid 
labeling it as such, is our national identifier. As such, it is 
incumbent upon those of us gathered here to do all in our power 
to protect it and the people to whom it is issued. There are 
three stages at which protections must be in place: upon 
issuance, during the life of the number holder, and upon that 
individual's death.
    With respect to the issuance of SSNs, or what the Social 
Security Administration refers to as the enumeration process, 
our audit and investigative work has revealed a number of 
vulnerabilities and resulted in a number of recommendations.
    The most critical of these recommendations centers around 
the authentication of documents presented by the individual 
applying for an SSN or a replacement Social Security card.
    If we are to preserve the integrity of the SSN, birth 
records, immigration records, and other identification 
documents presented to SSA must be independently verified as 
authentic before an SSN is issued.
    Further, if immigration records are to be relied upon, the 
Immigration and Naturalization Service must be required to 
authenticate those records.
    Regrettably, this will subject the enumeration process to 
delays. But just as we must endure lengthy waits at airports in 
the name of higher security, so must we now sacrifice a degree 
of customer service in the name of SSN integrity.
    H.R.2036, introduced by the Social Security Subcommittee, 
moves us closer to these protections, the importance of which 
cannot be overstated. If we cannot stop the improper issuance 
of SSNs by the Federal Government, then no degree of protection 
after the fact will have any significant effect.
    It would merely be closing the barn door after the horse 
has gone.
    The second and most difficult stage of protecting the SSN 
comes during the life of the number-holder. Because the SSN has 
become so integral a part of our lives, particularly with 
respect to financial transactions, it is difficult to give the 
number the degree of privacy it requires, but there are 
important steps we can take.
    We can limit the SSN's public availability to the greatest 
extent practicable, without unduly limiting commerce. We can 
prohibit the sale of SSNs, prohibit their display on public 
records, and limit their use to valid transactions. And we can 
put in place enforcement mechanisms and stiff penalties to 
further discourage identity theft.
    Finally, we must do more to protect the SSN after the 
number-holder's death. The Social Security Administration 
receives death information from a wide variety of sources and 
compiles a Death Master File, which is updated monthly and 
transmitted to various Federal agencies. It is also required to 
be offered for sale to the public and can be accessed over the 
internet through a number of sources, as we've already heard.
    My concern under the current system is with the accuracy of 
the death information. Accuracy in this area is critical to SSA 
in the administration of its programs, to the financial 
services industry, and to the American people. Our audit work 
has revealed systemic errors in the Death Master File and we 
have recommended steps that SSA can take to improve the 
reliability of this critical data.
    Among these recommendations were matching the Death Master 
File against auxiliary benefit records to ensure that 
individuals receiving benefits in one system are not listed as 
deceased in another, and reconciling 1.3 million deaths 
recorded in SSA's benefit payment files that do not appear in 
the Death Master File.
    We are faced with striking a balance between speed and 
convenience, on the one hand, and accuracy and security on the 
other. This is true in the case of the Death Master File, just 
as it is true in the enumeration process.
    At all three of these stages of an SSN's existence, 
improvement is needed. H.R. 2036 addresses many of these 
concerns. The Social Security Administration, my office, the 
Congress, and the American people must act together to accord 
the SSN the protections appropriate to the power it wields.
    Thank you very much.
    [The prepared statement of Hon. James G. Huse, Jr. can be 
found on page 62 in the appendix.]
    Chairman Shaw. Thank you, Mr. Huse.
    Mr. Streckewald.

    STATEMENT OF FRITZ STRECKEWALD, ACTING ASSISTANT DEPUTY 
   COMMISSIONER FOR DISABILITY AND INCOME SECURITY PROGRAMS, 
                 SOCIAL SECURITY ADMINISTRATION

    Mr. Streckewald. Chairman Shaw, Chairwoman Kelly, Members 
of the subcommittees, thank you for asking me to appear before 
you today to discuss the Social Security Administration's 
collection, maintenance and distribution of death information.
    We use this information for a number of important program 
purposes and the integrity of this information is of utmost 
importance to us.
    SSA's Death Master File was created because of a 1980 
Consent Judgement resulting from a lawsuit brought by a private 
citizen. Under the Freedom of Information Act, we are required 
to disclose the Death Master File to members of the public.
    SSA obtains death reports from many sources, with 90 
percent of the reports obtained from family members and funeral 
homes. The remainder of the information comes from States and 
other Federal agencies through data exchanges and reports from 
postal authorities and financial institutions. We match death 
reports of the approximately 2.5 million people who die 
annually against our payment records and terminate benefits for 
those individuals who are deceased. We annotate the deaths on 
our master Social Security and Supplemental Security Income 
beneficiary records and on the Social Security number record 
file for beneficiaries and non-beneficiaries.
    Since studies have shown that death reports from family 
members and from funeral homes are over 99 percent accurate, we 
do not verify these reports. For our beneficiaries, we are 
currently verifying reports from financial institutions and 
postal authorities after terminating benefits. However, we are 
changing our policy to verify these reports before taking any 
action.
    Reports obtained through data exchange require verification 
through our field offices before an individual's death is 
posted to our payment records and their benefit is terminated. 
This includes death data received from the States.
    We do not verify death reports on persons who don't receive 
Social Security benefits, and it would be difficult for us to 
do so since we do not have addresses or other identifying 
information on these individuals.
    The Death Master File is updated daily based upon reports 
SSA receives and contains approximately 70 million records, 
including Social Security beneficiaries and non-beneficiaries, 
with verified and unverified reports of death.
    If available, the file contains the deceased's SSN, first 
name, middle name, surname, date of death, date of birth, 
State, county, zip code of the last address on our records, and 
the zip code of the lump-sum death payment. The record is also 
annotated to indicate where the report was verified.
    Federal agencies, State and local government, and the 
private sector use the national death data file, and we are 
reimbursed for the cost of providing this information. 
Currently, as required by law, SSA shares the full Death Master 
File with Federal benefit-paying agencies that use the data to 
conduct matches against their own beneficiary rolls, such as 
the Department of Defense and the Office of Personnel 
Management.
    Under the matching agreement with SSA, these agencies are 
required to independently verify the fact of death before 
taking any adverse action.
    The publicly available Death Master File is provided 
monthly to the Department of Commerce, National Technical 
Information Service, or NTIS, which in turn makes it available 
to the public under the Freedom of Information Act. NTIS 
distributes it to subscribers by either tape file or CD-ROM 
version. Some of these private companies, including 
genealogical publishing companies, create their own files from 
the Death Master File. Some private websites have these files 
on line.
    In response to issues raised by the subcommittee Members, 
we are exploring electronically transmitting our Death Master 
File to the NTIS, rather than sending them through Federal 
Express.
    We are prepared to do that immediately, as soon as NTIS is 
ready to receive it. Transmitting the data more frequently is 
also possible, perhaps on a weekly or bi-weekly basis.
    SSA also has an electronic data exchange of all States and 
a large number of Federal agencies. This is an electronic 
overnight query process that enables requesters to enter a 
query for any individual. Using this process, State agencies 
can access our death records so they can ensure that benefits 
are not paid to deceased individuals.
    Finally, I'd like to briefly mention recent initiatives to 
strengthen the enumeration process.
    In response to the events of September 11th and the 
indication that some terrorists had Social Security numbers and 
cards, some of which may have been fraudulently obtained, SSA 
formed a high-level response team to re-examine the enumeration 
process.
    The response team, which includes representatives of SSA's 
Office of the Inspector General, will help determine what 
changes need to be made to ensure that we are taking all 
necessary precautions to prevent those of criminal intent from 
using Social Security numbers and cards to advance their 
operations.
    Thank you again for the opportunity to discuss with your 
committees how SSA gathers and distributes death information.
    I will be glad to answer any questions.
    [The prepared statement of Fritz Streckewald can be found 
on page 73 in the appendix.]
    Chairman Shaw. Thank you.
    Mrs. Bovbjerg.

    STATEMENT OF BARBARA D. BOVBJERG, DIRECTOR, EDUCATION, 
 WORKFORCE AND INCOME SECURITY ISSUES; AND RICHARD J. HILLMAN, 
 DIRECTOR, FINANCIAL MARKETS AND COMMUNITY INVESTMENT ISSUES, 
                   GENERAL ACCOUNTING OFFICE

    Ms. Bovbjerg. Thank you, Mr. Chairman, Members of the 
subcommittees.
    I'm really pleased to be here before the subcommittee again 
and to meet a new subcommittee to me, with my colleague, 
Richard Hillman, to discuss the distribution of death 
information to financial institutions.
    As we've heard, the Social Security Administration collects 
and records the names and Social Security numbers of the more 
than two million Americans who die each year. This information 
is critical to the integrity of the Federal benefit system.
    Properly used and distributed, death information can also 
help prevent the fraudulent use of Social Security numbers to 
steal identities, to obtain false identification documents, and 
to commit financial fraud.
    In light of the recent terrorist attacks, it is more 
important than ever to safeguard Social Security numbers from 
criminal use.
    Accordingly, our testimony today addresses three points. 
First, how death information is collected and distributed and 
how long this takes. Second, how the financial services 
industry uses such information. And third, possible steps to 
improve timeliness of distribution.
    Our observations are based on prior GAO work, preliminary 
work at the SSA and the National Technical Information Service, 
and our discussions with financial services institutions.
    First, let me describe the collection and distribution 
process.
    As we've heard, SSA receives about 90 percent of its death 
information from funeral homes and relatives of the deceased, 
and most of this information reaches SSA within a week of 
death. SSA takes another week to process the information and 
add it to individual Social Security records.
    At the beginning of each month, SSA extracts this death 
information from its records to the Death Master File, and 
sends it to the NTIS. NTIS receives this information by the 
fourth or fifth day of each month and mails it to subscribers 
on tape or on CD-ROM within another 2 to 4 days.
    Overall, most death information reaches these subscribers 
within 1 to 2 months of death, depending on when the death 
notice first reaches Social Security.
    The remaining ten percent of death information comes to SSA 
from other Federal agencies that learn of deaths through data 
matches or undelivered benefit checks and from State vital 
statistics bureaus. However, these death reports are less 
timely than those sent directly from families and funeral 
directors to SSA, and require verification by SSA before they 
can be added to the Master File and distributed.
    Death information may not reach SSA from State reports 
until 3 to 4 months after the date of death and is not 
available to private subscribers.
    Let me now turn to how financial services institutions use 
this information.
    Representatives of such institutions told us they did not 
use a formal process or a central data source to identify 
deceased customers, although most receive death information 
either from family members or, in the case of Social Security 
beneficiaries with direct deposit, from SSA directly.
    However, most also told us that they subscribe to fraud 
prevention products or services offered by credit reporting 
agencies for evaluating new credit applications. All three 
credit reporting agencies subscribe to the Master File and make 
this information available to their customers through these 
proprietary fraud prevention products.
    Most institutions we contacted expressed an interest in 
receiving timely death information with frequent updates. Some 
of these institutions were aware of the Master File, but 
unfamiliar with the information they provide, or of the ability 
to subscribe, while others were not aware of it at all.
    Finally, let me turn to possible steps for improving the 
distribution and use of death information.
    As you've heard, SSA is exploring ways to speed up this 
process and has stated that it would be relatively easy to 
produce updates on a weekly, rather than a monthly, basis. SSA 
and NTIS officials have stated that it should also be possible 
for SSA to transmit updates to NTIS electronically and that 
NTIS could transmit the information to subscribers 
electronically as well.
    SSA is also piloting the electronic death registration 
system, which would enable States to collect and report deaths 
electronically to SSA, both streamlining and centralizing the 
collection reporting of such information.
    However, existing restrictions on distribution of State-
provided data could complicate adoption of such an approach.
    In conclusion, most death information is available to the 
public within 2 months and improvements to the collection and 
transmission processes could make this information more 
complete and more timely. Educating the financial services 
industry about the availability and contents of the Master File 
would also be helpful.
    Such measures are tangible steps that could act to narrow 
the window of time in which a criminal can open new accounts 
using a deceased person's identity and would raise the 
likelihood that such behavior would be detected.
    However, improving the use and timeliness of death 
information will not by itself eliminate identity theft and is 
not a panacea for addressing the larger issue of criminal 
misuse of Social Security numbers.
    That concludes my statement, Madam Chairwoman. Mr. Hillman 
and I would be happy to answer any questions you have.
    Chairwoman Kelly. Thank you very much.
    Mr. Hillman, have you a statement, or is yours the same? 
It's a joint statement?
    Mr. Hillman. Yes, Madam Chairwoman.
    [The prepared joint statement of Barbara D. Bovbjerg and 
Richard J. Hillman can be found on page 87 in the appendix.]
    Chairwoman Kelly. All right. Thank you very much.
    I appreciate you all indulging us up here as some of us are 
leaving to vote. This way, we can keep the hearing going 
without keeping you all in your seats for too long a period of 
time. I'm going to open the questioning.
    Mr. Streckewald, I have a question for you. Actually, I 
have a couple of questions for you.
    On page 6, in your testimony, you describe the State 
verification and exchange system that allows some States and 
some Federal agencies to verify a death within one day. Have 
you considered whether to open it to access by the financial 
services industry?
    Mr. Streckewald. We use that for, as you said, the State 
governments. We have, as far as I know, not looked into using 
it for financial institutions.
    We do have the ability for employers to verify Social 
Security numbers in a batch mode, which is like an overnight 
type of mode as well. And so, employers can send us batches or 
individual Social Security numbers, so that we can verify for 
them.
    I'm not aware that we have specifically looked at the 
financial services' access to the information.
    Chairwoman Kelly. I think that looks like the basis for a 
system that's needed by the financial institutions, so that 
they could do rapid verification.
    Since the Patriot Act requires them to verify the identity 
of any new account-holder, I don't understand why the SSA can't 
commit to allowing that system to be used as part of 
verification procedures.
    Mr. Streckewald. We can certainly take a look at that and 
get back to the subcommittees on what we find.
    [The information referred to can be found on page 82 in the 
appendix.]
    Chairwoman Kelly. I wish you would, please. And to that 
effect, I'm going to send a letter to the Secretary of the 
Treasury with that recommendation to put into their 
regulations, because I think that that's a way of rapidly 
helping our financial institutions.
    I also wondered if the SSA and the NTIS had ever 
collaborated on a study to determine a faster means of getting 
the information to the financial services industry, including 
this one, and including sending it electronically or even 
perhaps, that difficult word, contracting out the entire 
process, from extraction to dissemination.
    Mr. Streckewald. I think with recent events, we've come to 
the conclusion with NTIS that we do need to get this 
information to them quicker and that they need to be able to 
distribute it quicker.
    I think what remains to be worked out is just the details 
of that. It's certainly technologically feasible and as we've 
heard this morning, it seems like both agencies are willing to 
move to perhaps a weekly or biweekly update of the information 
and to transmit electronically rather than through overnight 
mail.
    Chairwoman Kelly. That I read in the testimony. My question 
is, I really want to know how rapidly you're doing that, but 
also there's another piece of this.
    There's a victim. I had my credit card stolen. I think 
there's a lot of people who have had things like that go on. I 
want to know with regard to the Social Security number what 
you're doing to help the victims who have their identity 
stolen, or the families of victims.
    Mr. Streckewald. We have a series of actions that kick into 
place when we hear about this type of event. First of all, we 
refer them to the inspector general hotline because it's 
perhaps a criminal event that needs to be investigated.
    But we also work very closely with the person. We give them 
pamphlets that explain who they can contact. We give them 
referrals to some of the national financial services 
organizations so they can clarify and correct their credit 
ratings.
    So we do have procedures in place for referrals to hotlines 
and other services that can help correct the problem.
    Chairwoman Kelly. It's been my experience in working with 
those that they are not terribly rapid. It takes a while. And 
it takes going through several people to get it done.
    I'm going to ask you this, Mr. Bond, and I would like you 
both to answer both those questions, the prior question and 
this one.
    What's the possibility of allowing people to do this kind 
of thing, to do it perhaps electronically with something as a 
follow-up that would be a verification.
    Mr. Bond. I'm sorry? Just to understand, a verification of 
the receipt of the information or a verification of falsely 
secured numbers?
    Chairwoman Kelly. I'm extending this to the people who are 
the victims of identity theft from the Social Security 
Administration numbers.
    Those people would have to, when you have that happen, if 
it's in your family, you have to deal with a lot of different 
people. What's the electronic possibilities of letting people 
do that electronically, deal with people and do it rapidly, 
rather than having to make a lot of telephone calls?
    Mr. Huse. If I may be permitted, Chairwoman Kelly.
    Chairwoman Kelly. By all means.
    Mr. Huse. The Federal Trade Commission and our office of 
the inspector general have a reciprocal information exchange 
that going forward will only get better. But in the last 2 
years, has rapidly improved the transmission of victim 
information so that it gets to the credit-reporting bureaus 
better than it used to.
    Can it be improved? Yes. Like many other things in 
Government, it is based on this application of resources and 
we're certainly changing our approach to the amount of 
resources we apply to this as this crisis has developed over 
the last 5 years.
    But that's the way it's done. It's better today, and does 
use, by the way, e-mail and electronic transmission, if victims 
have that available to them, to get the information to us.
    From that clearinghouse, then, this information becomes 
available to local, county and State law enforcement.
    Again, I'm not trying to paint a rosy picture here, but at 
least we have the dots on the paper and we're connecting them a 
little bit better than we used to.
    Chairwoman Kelly. What's the timeline on that?
    Mr. Huse. It all depends on the application of resources. 
We work in our budget submission process to try and gain those 
to do this.
    The technology is already there. It really is a matter of 
adjusting IT resources and the human capital that you need to 
make this happen.
    We're just learning that this is an issue that the people 
care about a great deal.
    Mr. Bond. Madam Chairwoman, if I could add to that, too.
    Technologically, of course, there's no reason you can't 
expedite things via the internet and secure communications and 
so forth. It really becomes part of a very fundamental e-
government initiative that both the Congress and the 
Administration have to join hands on.
    The Administration has sent up an aggressive proposal in 
that regard and appointed people at OMB to oversee it, to try 
to really push the agencies more toward quicker, more rapid 
response for our shared constituents.
    But it's going to be a very fundamental effort to apply 
technology to the service of constituents.
    Chairwoman Kelly. What's your timeline?
    Mr. Bond. There is a multi-year plan out of OMB which does 
require some significant funding here on the Hill. And that 
will be one of the many issues in final appropriations 
discussions for this year because the request was not fully 
funded coming out of the two chambers.
    Chairwoman Kelly. So it's a matter of appropriated funds 
from Congress.
    Is that correct?
    Mr. Bond. Absolutely, to upgrade the IT capabilities in 
many of the Federal agencies.
    Mr. Streckewald. If I could, I would reinforce Mr. Bond's 
comments that the Federal Government as a whole, through the 
leadership of OMB and through individual agencies' initiatives, 
is looking at customer-oriented electronic services.
    In some ways, SSA has been providing this with our online 
applications. But this particular example that you're using, 
which is to help people correct identity theft problems, would 
have to be a broad spectrum of stakeholders, financial 
services, Government agencies, States, would have to come 
together and plan this out and construct the communications 
lines and the procedures for solving this.
    But it is technologically feasible and OMB is trying to 
lead us to a more electronically-focused, customer-oriented 
Government.
    Chairwoman Kelly. Mr. Huse.
    Mr. Huse. One more thought on all of this.
    I think we understand now, with this identity fraud crisis 
issue and victim assistance as a key part of it, we've learned 
a lot the last few years that our traditional approaches to 
this just don't cut it. They don't work.
    We have advanced a proposal in the budget process for 
innovative ways to change this model, so that law enforcement, 
Federal law enforcement integrates itself better with local law 
enforcement because it's a total issue. It just can't be 
relegated to the Federal Government or a burden on local 
governments.
    And this model means non-traditional approaches. The key to 
it is rapid and effective information exchange. The work is 
there and the ideas are there.
    In fact, some of this is in 2036. Some of the pieces that 
we need to get this done is in 2036. But I really want to 
assure you, Madam Chairwoman, that we are committed to trying 
to do this.
    But, as I said, as in everything in Government, it is 
resource-dependent.
    Chairwoman Kelly. Most people who come before these 
subcommittees ask for resources. That's not a surprise.
    Mr. Huse. No.
    Chairwoman Kelly. But we're essentially in a terrorist war 
situation.
    One of the things that America has always had is ingenuity. 
This may be the time to do more with less. And I'm not saying 
that you can't get the resources. What I'm simply saying is 
that we have a limited budget. We all know that. And ingenuity 
is going to have to be the order of the day for all of us.
    This may be the time, when you need to have that larger 
meeting, discuss how it's going to go and do it sooner rather 
than later, so you can get help from the financial institutions 
as well as from anyone else who is an interested stakeholder in 
this.
    I want to ask the GAO, since there's no one else who has 
come back from the vote yet, I want to ask you, Barbara, if you 
don't mind, have you considered whether the Social Security 
Administration can open the State verification and exchange 
system to the financial services industry to allow the 
companies to verify?
    Is that something that you've thought about?
    Ms. Bovbjerg. GAO has done a lot of work on data sharing 
and the importance, on the one hand, of sharing information 
that allows you to safeguard benefits and safeguard identity 
and, on the other hand, being concerned about privacy and 
retention of personal information.
    The death records are already public information, at least 
for the most part. What remains to be worked out with the 
States is this question of State restrictions on information 
that they provide that is not verified by SSA. That seems to be 
one of the sticking points. And we do hear about a resource 
question.
    I think we have been interested and have asked about the 
feasibility of doing some sort of online look-up, web-based 
approach that financial institutions could go to directly. And 
we're not in a position to make any recommendations. We would 
have to look at the cost versus benefits. But we thought that 
that might show promise.
    Chairwoman Kelly. Perhaps we should ask for a cost/benefit 
analysis of something like that.
    Ms. Bovbjerg. Well, may I add something?
    Chairwoman Kelly. Yes.
    Ms. Bovbjerg. Excuse me, Ms. Chairwoman.
    We are doing some work that I wanted to call to your 
attention for Congressman Johnson on the Social Security 
Subcommittee that looks at law enforcement and identity theft 
across governments.
    And one of the questions that he has us addressing is 
looking at the lead Federal and State law enforcement agencies 
with responsibilities in identity theft investigation and 
looking at how they cooperate across jurisdiction, including 
across Federal agencies.
    I'm not sure when that work will be published. That's being 
done in another team. But I think that that will help get at 
some of the issues that have been raised this morning.
    Chairwoman Kelly. Thank you, and thank you for volunteering 
that.
    What exposure did you find that financial institutions 
have? If a name is in the Master File and the institution 
processes a payment any way?
    Mr. Hillman, do you want to answer that?
    Mr. Hillman. I'm not exactly sure what the exposure may be 
to a financial institution who processes information and maybe 
provides funds out to an individual of a deceased person.
    But we could find that out for you and let you know.
    Chairwoman Kelly. I would appreciate your taking a look at 
that because that goes to the next question. And that is 
whether or not--I'm trying to get the acronym here--the FFIEC, 
the exam procedures, perhaps should take that into account.
    I don't know if it does or not, but I think it's worth 
taking a look at.
    I'm concerned also with the education of financial 
institutions with regard to what their exposure is and the 
appropriate usage of the Death Master File.
    So perhaps you could take a look at look at that also.
    Mr. Hillman. We'd be happy to do that. We have looked at 
the examination procedures, as you might expect, that financial 
Federal regulators follow in looking at the financial services 
industry.
    And in general, those examination procedures look to the 
safety and soundness of those depository institutions to ensure 
that they have sufficient funds to conduct their businesses.
    They haven't in all cases looked at other important areas 
such as concerns with individuals or constituents. And I agree 
with you that that would be an important topic to further 
study.
    Chairwoman Kelly. Thank you very much.
    Mr. Brady, do you have any questions?
    Mr. Brady. Thank you, Madam Chairwoman. I'm sorry I missed 
the last part of the testimony. But, obviously, to solve this 
problem will take a combination of prevention and enforcement 
in the process.
    We need to do all we can in prevention of identity theft. 
But I think what everyone understands is that, in this open 
society, it will be difficult to close that barn door 
completely, in this open, information-based society.
    So focusing a bit on the enforcement and the punishment 
side of it, what are the chances someone engaging in identity 
theft is going to get caught? What are the consequences in real 
life when they do?
    Who's the best responsible and available to do that, State 
or Federal Government? What role can the business community 
play in catching them?
    And the bottom line, what would it take to make the 
consequences harsher to be a real deterrent to people engaging 
in it?
    And I'll open it up to anyone who's got an opinion.
    Mr. Huse. I'll take the first cut at an answer, Mr. Brady.
    Mr. Brady. All right.
    Mr. Huse. We don't do a great job from a criminal justice 
perspective with identity thieves because it's a relatively new 
crime.
    We have a mixed result if you look across the Federal 
judicial system in terms of sentencing on these crimes. We need 
to do better.
    One of the outreach efforts I think we need to make now 
with the post-9/11 consciousness that we have is to educate 
United States attorneys to the fact that these crimes need to 
be a priority concern in each of the 94 judicial districts.
    That may or may not be the case depending upon where you 
are in the United States. Other trendier crimes get priority.
    Most States have very vigorous and good identity crime 
statutes themselves. So we need to cooperate more with local 
and State law enforcement to prosecute there where we can.
    Clearly, though, the key to identity fraud because it 
transcends all boundaries is there has to be a better 
information-sharing mechanism. And the Congress, when it passed 
the Identity Theft Deterrence Act several years ago, an 
Assumption Deterrence Act several years ago, and established 
the clearing house in the FTC, I assure you that that is 
working and will only get better as we engage it more.
    So that's my first try at an answer.
    Mr. Streckewald. If I could just elaborate a little bit. 
That particular law that was passed in 1998, which for the 
first time made it a Federal crime to fraudulently obtain 
identification, sell identification, or misrepresent yourself 
on obtaining any type of identification.
    And for the first time, the Social Security number was 
included as a means of identification. So that did provide law 
enforcement with an added tool for enforcement.
    Mr. Brady. How many prosecutions have there been?
    Mr. Huse. We can get that for you and follow that up. One 
thing I want to add, Mr. Brady, is one of the provisions of 
2036, if it's passed, gives us some great civil money penalty 
tools.
    Also, for those identity crimes that fall maybe under the 
prosecutorial thresholds in a given judicial district, but 
still have a fact pattern that supports an offense, we can 
sting those people with some money penalties, and I think 
that's a good thing, too.
    Mr. Brady. In real life, what are the consequences for 
getting caught? What's an average sentence, punishment, for 
identity theft?
    Mr. Huse. Well, with sentencing guidelines, probably for a 
first offender, it is several years of confinement. It depends 
on the criminal history involved.
    Mr. Brady. Sure.
    Mr. Huse. But it's a 10-year felony, the misuse is a basic 
Federal felony.
    Mr. Brady. Is there a feel for what first-time, second-time 
offenders, what they traditionally get? I'm not pushing. I'm 
just curious.
    We all know what guidelines are. We all know what happens 
in real life.
    Mr. Huse. As I said, it's confinement for several years. It 
hasn't reached the point, even though the violation is just as 
bad, of having, for example, the emotion involved of a bank 
robbery or something like that. But it's just as pernicious.
    Mr. Brady. What role--can I keep, while I'm on a roll?
    Two questions, really. How can Washington help? Is it to 
create more resources here at the Federal level, or to 
complement better State prosecution efforts?
    Second, what role can the business community play in 
helping us catch and enforce this?
    Mr. Huse. I'll let Barbara answer that.
    Ms. Bovbjerg. I'll step into the breech.
    We have talked in GAO about the need for both prevention 
and for law enforcement. One of the things that we're doing 
right now at the request of Chairman Shaw is looking at uses in 
Government at all levels--Federal agencies, various departments 
in State government, local government, and the courts, looking 
at uses of the number and looking at how the number is being 
safeguarded and developing options that could be considered for 
safeguarding.
    So my answer to your question is more in a prevention side 
and working with SSA as they try to have the balance of making 
information available, but at the same time safeguarding it.
    That's always an issue with some of these web-based----
    Mr. Brady. And clearly, we need to do both. I'm not 
discounting either. I was just focusing on that side because 
I'm not as aware of it.
    And second, it just seems, when you look at the number of 
people who have been hurt by identity theft and fraud, the 
average time it takes to try and clear their name, the costs to 
them, and then on September 11th, we had people who stole 
identities and then stole thousands of people's lives as a 
result of it.
    So the obvious question is, what can we do to punish them 
to the fullest extent, or to deter the next person who has that 
in mind?
    That was my focus.
    Ms. Bovbjerg. And then I turn it over to the law 
enforcement end of the table.
    Mr. Huse. Well, I just wanted to take the piece of the 
question, is it all about resources? And that goes to 
Chairwoman Kelly's earlier comment.
    It doesn't necessarily just mean resources, although some 
modest adjustments are needed here and there because you're 
short some capacity.
    But basically, the key to this is rethinking this 
particular crime top to bottom, and rethinking how we focus on 
this crime.
    We're trying to apply an old model to this that just 
doesn't work. If we could just understand how serious it is, 
that's a big, huge step, and then work with ways to, using the 
magnificent technology that we have, to communicate better.
    I think that's really the answer, rather than some new 
agency or the like.
    Mr. Brady. Thank you. Thank you all very much.
    Chairman Shaw. Before I go to Ms. Hooley, I do have a 
question for you, Mr. Huse.
    Does the law distinguish in the case of identity theft 
between a living person's identity who has been stolen or a 
deceased person?
    Mr. Huse. I don't believe it does. I think the law deals 
with the identity theft. I do know that a deceased person has 
no rights because they're not here to have them. But in terms 
of the identity theft, it still stays the same under the law.
    Again, my staff----
    Mr. Bond. I want to add, my understanding on that is that 
an individual under law is considered to be a living 
individual. And so the rights do not extend to the deceased.
    So when you talk about privacy laws, those are applied to 
living individuals and that is a fine point that I think some 
of the Executive agency lawyers would want to talk to the 
committee staff about in doing forward on your legislation.
    Chairman Shaw. OK. If that answer needs sharpening up, let 
us know.
    Mr. Bond. OK.
    Chairman Shaw. Ms. Hooley.
    Ms. Hooley. Thank you, Mr. Chair.
    In the case of Tyler Bales, you could not give the 
information to local law enforcement agencies, even though 
identity theft is a crime in Oregon.
    So I want to know, do we need to as a body fix that?
    Mr. Huse. Congresswoman, when you were speaking, I jotted 
down on a card that case and I passed it back to our chief 
investigator and I said, we should look at this case.
    I don't know why under the IRS rules they didn't disclose. 
And that may be some arcane rule. I mean, they're governed by 
rules. We are at Social Security.
    But, usually, I'd like to see if there wasn't a way that 
the Social Security Administration might not be able to work 
with that case and take it forward.
    And I'm not criticizing IRS. I'm just not sure.
    Ms. Hooley. What I'm looking for is if we can do that, in 
the case of Oregon where identity theft is a crime.
    Mr. Huse. Right.
    Ms. Hooley. And I'm just trying to figure out, do we need 
to fix it or if it's some rule that can be fixed.
    Mr. Huse. That's why I'd like to look at that.
    Ms. Hooley. OK.
    Mr. Huse. And we'd be glad to talk to your staff about that 
and look into that case and then get back to you, if that's OK.
    Ms. Hooley. OK. I have a couple of other questions.
    The Death Master File, it contains everything that a thief 
would need to get up and running. It's now being transmitted, I 
understand, to 104 customers, up from about 51 in 1999.
    Is that correct?
    Mr. Bond. Yes, that's about right.
    Ms. Hooley. And all of the customers are paying for the 
information.
    Mr. Bond. Correct.
    Ms. Hooley. And do they use it for the purpose to flag 
financial holdings of the deceased individuals or is the 
information being used for other purposes? And if so, what are 
the other purposes?
    Mr. Bond. It is a wide variety of purposes, from security 
to checking for fraud, obviously. I'm just flipping through 
here to try to see, because I had asked that question myself. 
Having just been sworn in on October 30th, I'm trying to find 
out everything I can quickly.
    Ms. Hooley. I think sort of the irony of this thing is----
    Mr. Bond. There are a couple of things that you need to 
know about. One is just the private genealogy sites that people 
talked about. That is one that is used, that you can go to. I 
did my own search and found that the Jasper County Public 
Library in Indiana has got the full Death Master File available 
there.
    So there's a variety of uses out there.
    But the private sector is checking mostly for fraud in 
financial transactions.
    Ms. Hooley. I guess sort of for me the irony is that the 
Internal Revenue Service can't pass the information on to law 
enforcement, but they can sell it to other organizations to be 
used.
    And I just have a bit of a problem with that. Should I?
    Mr. Huse. I don't think any of us here are tax experts. We 
won't even go near there.
    Mr. Bond. All I can add is that by the time it gets to 
NTIS, it is, as was explained, considered subject to the FOIA 
laws, and so it's out there.
    Mr. Streckewald. I have a little more information on the 
uses of that, at least in terms of the customers.
    About 20 percent of the purchasers of the Death Master File 
are public sector groups. Some colleges use it, perhaps for 
research or checking against their databases of students. In 
addition, several private insurance companies use it 
extensively, along with a few banks.
    But there are not a lot of financial institutions on the 
list.
    Mr. Bond. Here's the actual breakdown from NTIS, 
Congresswoman. It's 20 percent State and local, 20 percent 
information brokers, 15 percent insurance companies. Medical 
and cancer research organizations make up 15 percent. Security 
providers, five. Marketing companies, around five percent. 
Credit reporting bureaus and agencies, five percent. Pension 
funds, five percent. Banks and financial institutions, three. 
And genealogy, three.
    Ms. Hooley. Thank you. Thank you and I yield back my time.
    Chairman Shaw. Thank you.
    I want to pursue the question of Ms. Hooley. I want to 
know, those death files, when they're put out, the Social 
Security numbers are on them. And I guess they're readily 
obtainable.
    We know from experience and testimony before these 
subcommittees that they still have value to those that would 
attempt identity theft.
    At the hearing that we had last week, we found that those 
numbers do survive the decedent and have a real purpose in 
State tax returns and things of this nature as an identifier.
    And we also found that the numbers stay exactly the same. 
There's no D for decedent or something put after the number. So 
those numbers are still out there and for the layman looking at 
it, wouldn't know whether that was a decedent or somebody who 
was very much alive.
    What is the suggestion--and I open this to any member of 
the panel, that any of you might have--with how we could 
safeguard those numbers and yet, release them for legitimate 
purposes?
    Obviously, insurance companies need them and some public 
officials need them--public agencies need them, rather.
    Are there any thoughts on that?
    Mr. Streckewald. Yes. Let me see if I can give a couple 
thoughts on that.
    I think it goes to the whole purpose of the Death Master 
File. Originally, it was a court settlement that required us to 
do this under the Freedom of Information Act law. But we sell 
the Death Master File for commercial purposes through NTIS, so 
that those with a reason to know individuals' Social Security 
numbers will know which numbers belong to deceased individuals. 
If a number comes through their system and it matches up with a 
number on the Death Master File, there's a problem.
    So, in fact, the number is flagged. It is annotated when 
you compare it against our Death Master File.
    If the Death Master File is not used extensively, then, of 
course, people won't have awareness of it.
    So, on the one hand, if it's out there, anybody can use it 
and try to take a number from it and create an identity or use 
it to apply for a credit card. But if the financial services 
and insurance companies and others make greater use of the 
Death Master File, then they'll know which numbers belong to 
deceased individuals.
    Chairman Shaw. How can we safeguard that, those lists being 
misused?
    We have to assume that if they're out there, they're being 
marketed, that they are available to the bad guys.
    Mr. Streckewald. From Social Security's perspective, if a 
person uses a Social Security fraudulently to work--sometimes 
numbers are used fraudulently for working--if earnings are 
reported on that number the year after the real number-holder 
dies, then we automatically investigate because we know that 
number belongs to a person who is shown as deceased on our 
records.
    We issue an alert to the field office and they call the 
employer and ask who is this person that's giving these wages 
under this number. On our records, it shows that the number 
belongs to deceased individuals.
    So, again, from the original purposes, earnings 
recordation, we do track back and see if it belongs to a dead 
person and if so, why are earnings being recorded.
    Chairman Shaw. It takes a year. You know the person is 
dead, money is coming in, it is going into his account. Why 
wouldn't it be kicked out in the first----
    Mr. Streckewald. Well, if a person works in January, 
February and dies in March, those earnings are reported to us 
after the end of the year. So we know that we haven't heard 
from the IRS yet until the year is over.
    The next year, if we receive earnings from that person, 
that's suspicious and that triggers an alert.
    Chairman Shaw. Yes, that would be suspicious. How do we 
handle death in foreign countries? Someone has retired in a 
foreign country, their money is being electronically 
transferred to a bank down in Mexico. How is that dealt with?
    Mr. Streckewald. I believe that we receive from embassies 
lists of deceased beneficiaries in foreign countries--they have 
Social Security numbers--so we would annotate our records and 
we would terminate their benefits.
    Chairman Shaw. How do the embassies accumulate that? Now 
here, the funeral home turns them in. The death record is 
required on that.
    So where is it in countries that don't have that process in 
place?
    Mr. Huse. To get to a bottom line here, it's not a perfect 
system and it's totally dependent on cooperation in those 
countries to give that information back to the benefit officers 
that we have in foreign stations.
    So what happens is, periodically, the agency does send out 
a survey team based on ages of beneficiaries--I think they set 
the number in the 1990s, but they're take a look to see if 
those people are still alive in the foreign population areas.
    And those are done on a cycle basis by the international 
operations.
    Mr. Streckewald. It's the international operations. And in 
fact, for countries that are considered to be high risk, such 
as Yemen, they send a team out there.
    Not only do they look at the elderly people, they ask to 
see in person every beneficiary in Yemen. That's one example. 
But we also go to the Philippines regularly and other 
countries.
    Chairman Shaw. Would it help if we actually sent checks to 
foreign countries that required signatures, or is the expense 
of doing that more than the savings on electronic transfer?
    Mr. Streckewald. I think we'd have to take a look at that 
and get back to you. I'm not sure. It certainly would be an 
issue.
    [The information referred to can be found on page 83 in the 
appendix.]
    Chairman Shaw. And actually ask for an endorsement on the 
check. I think people would be a little less likely to endorse 
or forge somebody's name than they would be to just simply let 
the thing slide and let the money continue to accumulate in the 
bank account.
    That's my off-hand opinion.
    Anyway, any further questions? The gentleman from 
Wisconsin?
    Mr. Ryan. No questions.
    Chairman Shaw. OK. Well, at this point, I turn the gavel 
over to Ms. Kelly, who will preside over the next panel.
    Chairwoman Kelly. Let me make the introductions of the 
second panel.
    We have: Mr. Stuart Pratt, Vice President for Government 
Relations, Associated Credit Bureaus;
    Tom Lehner, Executive Vice President for Government 
Affairs, American Financial Services Association;
    Tom Sadaka, Special Counsel, Office of Statewide 
Prosecution, Orlando, Florida. We welcome you, Mr. Sadaka. Am I 
pronouncing that correctly?
    Mr. Sadaka. Sadaka.
    Chairwoman Kelly. John Dugan, Covington & Burling, 
representing the Financial Services Coordinating Council.
    Mark Rotenberg, Executive Director, Electronic Privacy 
Information Center.
    And Evan Hendricks, Editor and Publisher of Privacy Times.
    We welcome you all. We look forward to your testimony. And 
I'd like to advise all Members and witnesses, I intend to keep 
to the 5-minute rule. So I'm going to remind witnesses when 
they have a minute remaining. Please check the clock.
    I will also ask unanimous consent that all Members' 
questions be included in the record. I'd like to begin with 
you, Mr. Pratt.

  STATEMENT OF STUART K. PRATT, VICE PRESIDENT FOR GOVERNMENT 
           RELATIONS, ASSOCIATED CREDIT BUREAUS, INC.

    Mr. Pratt. Thank you both very much for this opportunity to 
appear before this joint hearing today.
    For the record, my name is Stuart Pratt and I am the Vice 
President of Government Relations for the Associated Credit 
Bureaus.
    By way of background, the ACB, as we're commonly known, 
represents more than 500 consumer information companies and 
produce a wide range of products, including fraud prevention, 
risk management, credit reports, mortgage reports, tenant 
employment screening services, check fraud, and verification 
services.
    And so the subject matter here today is obviously very 
relevant to us and all of our members.
    I think it's clear, perhaps more than ever before, that how 
we authenticate, how we verify, and how we ensure the 
authenticity of information in various types of applications is 
an essential need in this country. Unfortunately, I think we've 
learned that for all of the wrong reasons.
    But at the core of this need is also the availability of 
information to be used and deployed in the authentication of 
application processes. And at the core of all of that, in many 
cases still, is the need for the availability of the Social 
Security number, which plays a particularly important role in 
our ability and our members' ability to build authentication 
and fraud prevention products, which then in turn allow us to 
mediate disparate sets of information and bring them back 
together in order to partner with our financial services 
customer bases, insurance and so on, in ensuring that they are, 
in fact, opening up lines of credit, depository accounts and so 
on, for legitimate individuals and for legitimate purposes.
    I want to applaud your subcommittee, of course, and the 
Congress as a whole for the enactment of the USA Patriot Act 
and the very fact that this Act itself recognizes the need to 
have a robust system of authentication, and in turn 
specifically directs the Secretary of the Treasury to establish 
minimum standards for financial institutions to verify account 
applicant information.
    I think, further, Chairman Shaw, in your hearing last week, 
we heard additional challenges in terms of even the enumeration 
process, how do we authenticate and verify information about 
individuals who are making applications for Social Security 
numbers.
    And in fact, I think we heard information in your hearing 
last week about the challenges even the States will face on a 
go-forward basis in authenticating and verifying individuals 
who make applications for something as simple, but as 
consequential, as a driver's license.
    So it's a changed world in which we live.
    The ACB was asked to address some questions or some areas 
in our testimony and I thought I would attempt to do that very 
quickly. And then of course we can amplify on that in questions 
and answers that you may have.
    You first asked how we, as consumer-reporting agencies, use 
the Social Security Administration's Death Master File. And let 
me start by discussing something about the scope of the 
industry that we represent.
    Our three major credit reporting system members--Equifax, 
Experian, and TransUnion--each maintain databases of 
approximately 200 million files on credit-active consumers in 
this country.
    In addition to that, members such as E-funds and Dole & 
Media, maintain Nationwide systems as well that help prevent 
checking account fraud and check fraud at the point of sale and 
further.
    In fact, we estimate, easily, that more than a billion 
consumer reports are sold every year in this country. And those 
consumer reports can carry forward and do carry forward in most 
cases a notification where there is a Death Master File record 
that we have been able to obtain.
    There are many members within our association who are, in 
fact, on that subscriber list. And I thought I would clarify 
one point that I think was lost perhaps in the previous round 
of testimony.
    And that is that, when we say there were not many financial 
institutions on that listing of subscribers, that's in part, 
because the channel of distribution through which the DMF data 
is made available to a majority of the financial institution 
market place is through companies like the ones that we 
represent here with the ACB.
    You've asked about technical problems with the current 
system and I think a lot of that has been covered in previous 
testimony. I think our members are also encouraged by the fact 
that there may be new and different technologies that could be 
brought to bear. There could be greater efficiencies achieved.
    And I think those are the right questions and I think we'll 
have to work toward achieving the right answers.
    Regarding other means of obtaining information, really, the 
only other way that the Associated Credit Bureau's members 
would be aware of an individual having died is through 
notifications that come through the systems directly from 
credit lenders.
    When a credit lender is notified through a trustee of an 
estate, they in turn will notify through coding back to us the 
fact that that consumer's credit account is now associated with 
a deceased individual. And that would be a code that would then 
be included in a statement that would be included and 
referenced on that account in subsequent credit reports issued 
on that individual.
    You've asked about outlining ways in which sources of 
information can be better integrated. And let me just say that 
today, integration is something that we achieve through the 
systems that we have.
    Unfortunately, I do want to state that the FTC's rules 
under GLB restrain us significantly in terms of building fraud 
prevention products outside of the Gramm-Leach-Bliley Act or 
the Fair Credit Reporting Act.
    And let me close by making just a couple of announcements. 
I see I'm slowly losing time here.
    Chairwoman Kelly. Mr. Pratt, you've lost time.
    [Laughter.]
    So if you could sum up, that would be great.
    Mr. Pratt. Two announcements. Number one, we've asked all 
of our DMF subscriber members of the Associated Credit Bureaus 
to convert to monthly receipt. All members will convert to 
monthly subscriptions with the DMF Master File, which I think 
will help escalate and help make information available.
    And number two, our members have established and will work 
with a task force to work with the Social Security 
Administration in working through technology and legal issues 
that might be associated with escalating availability of 
information from the Administration.
    [The prepared statement of Stuart K. Pratt can be found on 
page 100 in the appendix.]
    Chairwoman Kelly. Thank you very much, Mr. Pratt.
    We move now to Mr. Lehner.

  STATEMENT OF THOMAS J. LEHNER, EXECUTIVE VICE PRESIDENT FOR 
  GOVERNMENT AFFAIRS, AMERICAN FINANCIAL SERVICES ASSOCIATION

    Mr. Lehner. Thank you, Chairwoman Kelly, Chairman Shaw, 
Members of the subcommittees. Thank you for inviting me to 
testify today.
    I'm Tom Lehner. I'm the executive vice president of the 
American Financial Services Association. AFSA is the leading 
trade association for market-funded financial services 
companies.
    Our 400 member companies include consumer and commercial 
finance companies, auto finance/leasing companies, mortgage 
lenders, credit card issuers, and industry suppliers.
    I'm here to address the issue of identify theft using 
Social Security numbers and, specifically, the industry's use 
of the Social Security Administration's Death Master File.
    Social Security numbers are the most unique identifier of 
individuals in the United States. The financial services 
industry uses these identifiers for a variety of reasons, such 
as customer verification, credit checks, bankruptcy filings, 
and monetary judgments such as tax liens.
    The use of Social Security numbers is not generally secure. 
They are readily available and, indeed, used by companies, 
State and local governments, motor vehicle departments, 
colleges, and even by consumers who willingly print the numbers 
on the face of their checks.
    Thieves often steal Social Security numbers and ultimately 
the identity of individuals, both living and dead. Financial 
institutions such as credit card companies and banks have also 
incurred significant losses resulting from misuse of Social 
Security numbers.
    Consumers have also experienced monetary losses, impaired 
credit and legal problems because others have amassed debts 
using their identities.
    Financial firms have an obvious interest in making sure 
that individuals who open accounts are who they say they are. 
Companies rely on the Social Security Death Master File to 
protect against theft.
    In most cases, firms do not directly subscribe to the Death 
Master File, but access it indirectly through credit reporting 
agencies or other vendors who do subscribe to it.
    This is both more efficient and less costly to the 
consumer.
    For example, bank issuers of credit cards routinely obtain 
consumer reports on card applicants from credit reporting 
agencies. Because the credit bureaus periodically update their 
files by comparing information to the Death Master File, the 
credit report will contain an indicator if the individual has 
been reported as deceased. And the bank can use this 
information to decline the application or investigate the 
circumstances.
    Other financial firms such as securities broker/dealers 
also access the Death Master File as part of the account-
opening process. This screening is typically done by third-
party vendors who utilize Death Master File information.
    Consumer lenders regularly use information from credit-
reporting agencies to review and adjust the status of existing 
accounts as well. It also helps to verify customers seeking to 
refinance existing mortgages or those who are interested in 
other services offered by the financial institution.
    Naturally, financial firms have other sources of 
information that might indicate that a customer has died and 
that access to the account should be frozen or terminated. The 
principal source is family members who called to notify the 
institution of the death of the customer and may request 
changes in the name on the account or the address where 
statements are sent.
    Lawyers and estate executors are another source of this 
information.
    Whether financial institutions obtain information about 
deceased individuals directly from the Death Master File or 
indirectly from other subscribers, they have an interest in 
obtaining information and data that is accurate and current. 
Delays between the date on which an individual dies and the 
date on which this information is made available to the public 
through the Death Master File increases the opportunity for 
identity thieves to defraud survivors, beneficiaries and 
financial institutions.
    One of the disadvantages of the current Social Security 
numbering system is that the agency is not always immediately 
notified upon the death of an individual. There appears to be 
no requirement for local officials to notify the Social 
Security Administration when someone dies.
    Despite their best intentions, having incomplete and 
incorrect information makes it very difficult for the Social 
Security Administration to issue an accurate Death Master File.
    Many companies have established internal processes that 
deal with fraud and identity theft. In addition, companies work 
with customers who are victims of identity theft and they also 
work with prosecutors to pursue those responsible.
    AFSA supports the efforts to encourage the Social Security 
Administration to obtain death information promptly and report 
it more frequently. We also support the continued dialogue 
between credit-reporting agencies and financial institutions to 
facilitate the flow of the Death Master File information and 
bureau files.
    For example, there may need to be a change in procedures so 
that when creditors report account status information to 
credit-reporting agencies, and this information is placed in a 
file of a customer about whom the bureau has received death 
information, the creditor is made aware of this fact on a 
timely basis.
    We believe that more financial institutions would consider 
subscribing to the data directly if the information provided 
was in real time and more accurate. Whether financial 
institutions obtain information about deceased individuals 
directly from the DMF or indirectly from other subscribers, 
it's in our interest and that of the consumer that we obtain 
correct information.
    We've hopeful that the Social Security Administration will 
make both the procedural and policy changes necessary to ensure 
the security of our individual unique identifiers, our Social 
Security numbers.
    Thank you.
    [The prepared statement of Thomas J. Lehner can be found on 
page 107 in the appendix.]
    Chairwoman Kelly. Thank you very much and thank you for 
limiting your testimony to the time.
    We now move to Mr. Thomas Sadaka.

   STATEMENT OF THOMAS A. SADAKA, SPECIAL COUNSEL, OFFICE OF 
               STATEWIDE PROSECUTION, ORLANDO, FL

    Mr. Sadaka. Chairwoman Kelly, Chairman Shaw, I truly thank 
you for the opportunity to be here today.
    For the record, my name is Thomas Sadaka and I am Special 
Counsel to the Statewide Prosecutor of Florida for computer 
crime and identity theft prosecutions.
    As the only representative of State government, as well as 
State law enforcement, I think a bit of a background is in 
order.
    Florida ranks third in the Nation currently in identity 
theft complaints, according to the FTC. As such, we have 
embarked on a rather strenuous effort to combat and to curb the 
epidemic of identity theft.
    At the request of Gov. Bush and as a result of the Privacy 
Technology Task Force, which addressed issues of Social 
Security abuse, public records abuse, and identity theft in 
general, we have impaneled a State-wide grand jury and have 
partnered with the Florida Department of Law Enforcement to 
focus specifically on identity theft cases as well as what 
Florida can do to minimize the effects of identity theft and 
the victimization of her citizens.
    As such, the use of the Social Security number and the use 
of other public records information has become apparent. It is 
the constant in all of the crimes that we have currently 
investigated.
    The State of Florida, through my office, was instrumental 
in passing an identity theft statute. In 1999, the statute went 
into effect, and at that time, we were one of only three States 
in the Nation to actually criminalize identity theft on the 
local level.
    That is improving. State law enforcement and legislatures 
are quick to enact these laws and are quick to operate on them.
    As such, the investigation and the prosecution of these 
cases is moving along slowly. So while we've addressed the 
after-the-fact dealings of identity theft, we now need to turn 
to the issues of prevention of identity theft.
    The use of the Social Security number and the use of other 
public records information is vitally important to the identity 
thief, as well as to the terrorists and others who want to 
shelter from society who they truly are.
    From the law enforcement encounter with the individual on 
the street to the airport security checker who is relying on 
the State-issued identification card, identity theft has a very 
broad base, both public safety concern as well as financial 
industry concern.
    Our public safety issues are much more in the forefront now 
since September 11th. But we've been addressing these issues 
over the past year to try to develop fraud-proof identification 
as well as uniform identifiers throughout the country so that 
we can rely on information that's provided from other States.
    State driver's license offices rely heavily on the Social 
Security number. Every State requires a Social Security number 
to be provided. Yet, the States don't avail themselves of the 
information available from the Social Security Administration, 
nor the other required information that would be available.
    Several of the States do check the Master Death File. The 
Florida legislature commissioned us in July to conduct a study 
on developing a fraud-proof Florida DL.
    So as part of that, I have been researching what other 
States do in the issuance process of identification cards.
    Of those that do some type of independent verification, 
only a select number of them interact with the death index on a 
real-time basis. And although the Social Security 
Administration has made limited availability for online data 
verification of Social Security, name and geographical region, 
there are no States currently that avail themselves of that 
ability.
    The State of Florida is currently looking into the ability 
to expand their infrastructure such that they can rely on the 
information from the Social Security Administration.
    There are two issues that face Congress. One is, the Social 
Security number has become basically our de facto national 
identifier. There are two subissues to that.
    Do we want that to be the case? And if the Congress' 
decision is that, yes, that is to be the case, then there need 
to be laws and initiatives in place that can basically back up 
the integrity of that number.
    There needs to be the ability of both the financial 
industry as well as State and local governments to verify that 
the Social Security number that's provided by the citizen or by 
the customer is truly that individual's Social Security number.
    We need to confirm that the identify of that person is 
their true identity.
    We rely heavily on breeder documents. There are currently 
262 different birth certificates in circulation in the United 
States. Those linked with Social Security numbers and passports 
and documents that are available from other countries create an 
daunting task on the part of the administrator, who is issuing 
this identification card.
    The Social Security Administration has within its grasp and 
within the other agencies of the Federal Government all of the 
information that is necessary to both the State and local 
governments, as well as the financial industry, to confirm the 
identity of the person who is before them. That information 
needs to be streamlined in its distribution and needs to be 
made available.
    If the other alternative is to not allow the Social 
Security number to be used for that purpose, then we face 
another undaunting task of developing some other unique 
identifier, such that all of our citizens can be comfortable 
that the information that is represented to financial 
industries and to State and local governments is correct and 
accurate information.
    Again, I want to thank you very much for the opportunity to 
be here today and I'd be more than willing to answer any 
questions at the close of the testimony.
    [The prepared statement of Thomas A. Sadaka can be found on 
page 110 in the appendix.]
    Chairwoman Kelly. Thank you very much.
    We now move to Mr. Dugan.

 STATEMENT OF JOHN C. DUGAN, PARTNER, COVINGTON & BURLING, ON 
     BEHALF OF THE FINANCIAL SERVICES COORDINATING COUNCIL

    Mr. Dugan. Thank you very much, Madam Chairwoman, Mr. 
Chairman. It's a pleasure to be here today.
    I'm testifying today on behalf of the Financial Services 
Coordinating Council, or FSCC, whose members are the American 
Bankers Association, the American Council of Life Insurers, the 
American Insurance Association, the Investment Company 
Institute, and the Securities Industry Association.
    The FSCC represents the largest and most diverse group of 
financial institutions in the country, consisting of thousands 
of large and small banks, insurance companies, investment 
companies, and securities firms.
    Together, these financial institutions provide financial 
services to virtually very household in the United States.
    The FSCC continues to believe that the Social Security 
number plays a central role in deterring and detecting fraud 
and identity theft because Social Security numbers are the best 
unique identifier that financial institutions can use to 
determine whether an individual really is who he or she says he 
or she is.
    To that end, the FSCC welcomes the attention the 
subcommittees are giving to the misuse of Social Security 
numbers of deceased individuals.
    My testimony today makes three fundamental points. First, 
Social Security numbers are key unique identifiers that are 
essential to guard against identity theft.
    Second, the SSA's Death Master File is a comprehensive 
record of deceased individuals' Social Security numbers, but 
delays in updating and disseminating this list can create 
opportunities for fraud and identity theft.
    Third, because financial institutions ultimately rely, 
usually indirectly, almost exclusively on the Death Master File 
to determine whether a Social Security number belongs to a 
deceased individual, the more frequently the DMF is updated and 
disseminated and the more accessible that information is, then 
the more effective the list will be as a tool to detect and 
deter fraud and identity theft.
    On the first fundamental point, following the lead of the 
Federal Government, the financial services industry has used 
the Social Security number for many decades as a unique 
identifier for a broad range of responsible purposes.
    For example, our Nation's remarkably efficient credit-
reporting system relies fundamentally on the Social Security 
number as a common identifier to compile disparate information 
from many different sources into a reliable credit report.
    The banking, insurance and securities industries each use 
SSNs as unique identifiers for a variety of important 
regulatory and business transactions, primarily to ensure again 
that the person with whom the financial institution is dealing 
really is that person.
    It's that essential need to verify a person's identity 
using a common unique identifier--the Social Security number--
that leads financial institutions to rely on the reporting of 
deceased individual's SSNs to guard against identity theft.
    We believe there are two keys to preventing the misuse of 
Social Security numbers of deceased individuals.
    First, the list of such numbers must be kept current. 
Second, the current list must be widely accessible and easy to 
search and cross-hatch against a given Social Security number.
    Unfortunately, while the current DMF is used to accomplish 
both these goals, there's clearly room for improvement.
    On the first point, with respect to the currency of 
information in the DMF, there can be significant delays in 
updating the list. These are delays caused by the time taken 
for deaths to be reported to the SSA, delays caused by the 
entry of inaccurate information, and delays caused by the fact 
that the SSA releases comprehensive updates on only a monthly 
basis.
    On the second point, the DMF is not provided in a form that 
is readily searchable. As a result, because it contains such a 
large amount of information, the most practical way to use the 
list, at least for financial institutions, is through 
intermediaries that convert the DMF into a searchable database 
that can be used by financial institutions and others.
    This service by third-party vendors is valuable, but it can 
be costly, and cost can thus be a deterrent to the widespread 
use of the DMF.
    Obviously, if a centralized, searchable database containing 
the DMF were widely available at a reasonable price, it's 
likely that the DMF would be used more routinely for a wider 
variety of authentication checks.
    Let me now conclude by talking about financial 
institutions' use of the Death Master File.
    Although the main purpose of the DMF is to inform the SSA 
that an individual has died, it's also purchased by private 
information vendors. Financial institutions ultimately rely on 
these vendors for accurate information about the status of 
individuals' SSNs.
    Therefore, while the accuracy of the DMF is crucial to 
saving the SSA money, it's equally crucial to financial 
institutions who seek to prevent fraud and identity theft.
    For example, many large banks contract with information 
vendors to compare the bank's list of individuals who have been 
approved for credit cards against the DMF.
    Similarly, banks, securities broker/dealers, mutual fund 
transfer agents, and insurance companies frequently use these 
information vendors to conduct the same kind of search with new 
account openings, changes in parties on accounts, to determine 
whether to allow a client to maintain a margin account, to 
locate lost shareholders, and for other purposes.
    Simply put, the more current the DMF is, then the more 
current the vendor's data is, and the better financial 
institutions can be at uncovering identity theft and other 
fraud.
    And with that, I would conclude. We certainly welcome 
suggestions for achieving both of the goals I've outlined in 
the testimony and we'd be happy to work with the subcommittees 
and their staffs to facilitate these efforts.
    Thank you very much.
    [The prepared statement of John C. Dugan can be found on 
page 113 in the appendix.]
    Chairwoman Kelly. Thank you, Mr. Dugan.
    We move next to Mr. Rotenberg. Mr. Rotenberg, I'm sorry I 
did not have your testimony before we had this hearing. 
Usually, I like to have a chance to read it before.
    But I'm going to be very interested in what you have to say 
today.

  STATEMENT OF MARC ROTENBERG, EXECUTIVE DIRECTOR, ELECTRONIC 
   PRIVACY INFORMATION CENTER; ADJUNCT PROFESSOR, GEORGETOWN 
                     UNIVERSITY LAW CENTER

    Mr. Rotenberg. Well, thank you, Chairwoman Kelly, and 
Chairman Shaw. I would ask that my statement be entered into 
the record and I will briefly summarize the points that I'm 
going to make this morning.
    I appreciate the opportunity to be here. I'm the Director 
of the Electronic Privacy Information Center. We are a public 
interest research group in Washington concerned with privacy 
issues relating to American consumers.
    I have also been on the faculty at Georgetown for more than 
10 years, where I teach the law of information privacy.
    I think it's critical to make clear at the outset for the 
purposes of this hearing that there's a long-standing effort by 
Congress and by the courts to protect the privacy of the Social 
Security number in law. And this has been done from the outset 
out of recognition that the particular status of this number, 
which can be used in so many different contexts, is ripe for 
misuse and abuse and, as we've seen in the last few years, the 
growing crime of identity theft.
    So, for example, Section 7 of the Privacy Act of 1974 makes 
very clear in the collection and use of the SSN that Federal 
agencies may only use the number for certain statutory 
purposes.
    And I'd like to say at the outset that the efforts of 
Chairman Shaw and other Members of the subcommittees to move 
forward legislation, H.R. 2036, which would extend similar 
protections to the private sector and strengthen as well the 
protections in the public sector, is a very important measure 
that I hope you will move quickly in this session.
    Now the second part of the problem to understand is that 
the ID theft problem results from the growing dependence of the 
Social Security number as a general form of identification 
unrelated to the original purpose, which was of course the 
management of SSA benefits.
    And if I may, Chairwoman Kelly, to pick up on your opening 
statement, I'd like to make a brief observation about this case 
involving Lahfti Raisi, who is the Algerian who may be 
responsible, in fact, for training the hijackers in the great 
tragedy of September 11th.
    Now it has been reported that Raisi took advantage of the 
Social Security number of a deceased person in the State of New 
Jersey, presumably to obtain access to facilities in other 
places that he would not otherwise be able to go.
    But it's not clear, at least from the reports that we have 
reviewed, that Raisi sought the Social Security number of a 
deceased person.
    In other words, this may have just been a nine-digit number 
pulled from the air that turned out, in fact, to be the number 
of a person who was deceased.
    And I make this point because it's critical to understand 
that in the area of identity theft, there are many ways to 
create Social Security numbers that are not one's own that 
don't require access to a deceased's SSN.
    You can spoof SSNs in a number of different ways. I can 
look at a Social Security number and probably determine whether 
it's accurate--in fact, a real Social Security number, computer 
programs and financial institutions do this on a regular basis.
    But my point here is I think we need to understand that it 
is the growing dependence on the use of the Social Security 
number and whether that number comes from a person who's 
deceased or whether it's simply made up, is going to be an 
ongoing problem in systems of identification going forward.
    Now this then relates to my third point about the expanded 
use of the Death Master File. And I fully appreciate the 
interest of the financial institutions in having more timely, 
more accurate information on an ongoing basis. So that when 
they are making these determinations about whether or not an 
SSN is the SSN of the person who represents it, they have 
better information on which to make that decision.
    But in expanding the use of the DMF, I'm concerned also 
that it will create new opportunities for misuse and abuse by 
others, who will use that information for other purposes. 
Because, of course, now you will have access to a very 
convenient file in electronic format that will give the public 
a great deal of detailed personal information.
    And so I think an assessment needs to be done. How do you 
ensure that that information will be used only by the financial 
institutions for the appropriate purpose and not by others for 
ill-intended purpose?
    I'd like to conclude, then, with three recommendations.
    The first recommendation, having worked on this issue now 
for more than 10 years, is to urge you once again to think 
about systems of identification that are not solely dependent 
on the Social Security number. It is the SSN that contributes 
to ID theft and our growing use of the SSN leads to more ID 
theft.
    Second, as I suggested at the outset, I think the 
legislation before the subcommittees is excellent.
    And finally, if you do go forward with the proposal to make 
the DMF readily available in electronic format, I urge you to 
create some mechanism of oversight, some way to evaluate, maybe 
a year out, how that information is being used, because it 
could well be the case that that file will become a new source 
of identity theft, and that could simply compound the tragedy.
    Thank you.
    [The prepared statement of Marc Rotenberg can be found on 
page 126 in the appendix.]
    Chairwoman Kelly. Thank you very much.
    We now move to Mr. Hendricks.

  STATEMENT OF EVAN HENDRICKS, EDITOR AND PUBLISHER, PRIVACY 
                             TIMES

    Mr. Hendricks. Thank you, Madam Chairwoman, and Mr. 
Chairman. My name is Evan Hendricks, Editor and Publisher of 
Privacy Times.
    I've been qualified as an expert in identity theft cases by 
the Federal courts and I realize I'm the last witness between 
not only you and lunch, but the lunch of my son, Daniel, who 
has accompanied me here today.
    Chairwoman Kelly. We welcome your son.
    Mr. Hendricks. Yes, thank you.
    Chairwoman Kelly. Welcome, Daniel.
    Mr. Hendricks. Thank you. This is an important issue. I'm 
grateful to follow my colleague, Marc Rotenberg, because I 
concur in his remarks and incorporate them.
    What we've seen in this terrible tragedy is that not only 
has identity theft figured in the use for passport and visa 
purposes, but also the terrorists supported themselves by 
committing identity theft and credit fraud.
    We followed this in my newsletter, Privacy Times, which is 
in its 21st year; there is an excellent article in the November 
4th, Chicago Tribune which summarizes many of the activities 
they did, including skimming, which is using a machine to swipe 
a card and steal all the information and then make a 
counterfeit card out of it.
    There are two things that fraudsters want in this day and 
age: either a Social Security number so that they can do 
identity theft, or a credit card number and an expiration date.
    We also know that the fraudsters are using stolen credit 
card numbers to buy people's Social Security numbers so that 
then they can commit more identity theft.
    So it's becoming a vicious circle.
    When the World Trade Center tragedy hit, unfortunately, it 
became somewhat like when there's a black-out in New York: the 
thieves know they can break into buildings because there's no 
electronic burglar alarms any more.
    And unfortunately, one of the World Trade victim's friends 
took her credit card and went on a credit joyride, and I'm told 
by my friends at the Privacy Rights Clearinghouse and the 
Identity Theft Resource Center that a plane crash victim was 
going to be picked up by a limo driver who had all his 
information and then went on to commit identity theft.
    As indicated by Congresswoman Hooley's opening remarks, 
there are some really sick people out there and a lot of them 
are now gravitating toward identity theft.
    I come here to say that, like Mr. Rotenberg, the goal of 
privacy laws is to give people control over their personal 
information. And some of the gaps and the weaknesses in our 
current privacy laws help the fraudsters get control over other 
people's information.
    One of the fundamental principles of privacy laws is the 
information collected for one purpose should not be used for 
another purpose without your knowledge and consent. And this is 
at the heart of the Fair Credit Reporting Act, which is one of 
the first privacy laws enacted in 1971, amended by Congress in 
1996.
    It's a good law and it recognizes in practice that there 
are other purposes. And so, the Fair Credit Reporting Act 
defines permissible purposes. And it also gives people 
remedies, private right of action, penalties.
    And I think even my colleague down the table, Mr. Pratt, 
will agree, this privacy law has made the credit-reporting 
industry a better industry. They do a better job handling data. 
They have to be more responsive. And if things go wrong, people 
have a remedy.
    And so I'm also here to dispel the myth because there is 
really not much of a conflict between privacy law and security: 
all of our existing privacy laws make exceptions for law 
enforcement, for health and safety, and for intelligence 
purposes.
    I think if you get into an honest discussion with the 
investigators, you'll see that the privacy law has not impeded 
the investigations here.
    But that's why we look for solutions, as Mr. Rotenberg 
said, we need to take advantage of information technology. We 
need automated exchanges of data.
    Just as the Fair Credit Reporting Act defines purposes and 
gives people a degree of confidence that data will be used for 
permissible purposes, so we need to expand that concept to our 
larger society, including automating any sort of a Master Death 
File that will be shared with the banks on an instant basis, or 
with the credit-reporting agencies, too.
    I also want to agree with Mr. Rotenberg that we need to 
have a national oversight office. Every other western country 
has an independent privacy commissioner that answers to the 
legislative branch.
    We need one, too.
    In terms of three practical solutions, the first is that, 
conceptually, people need to be plugged into their credit 
report. The technology allows for it today, and actually, we're 
gravitating toward this and we need to accelerate it. So if 
there's activity on your credit report, you should receive some 
sort of electronic alert.
    This is not that difficult to set up and it would be one of 
the best ways to guard against identity theft.
    Second of all, though the credit reporting agencies sell a 
service where they can do a trace on SSNs, it's not clear to me 
that they do an audit of their own systems to see how many 
names and addresses are associated with one SSN.
    And if they did that simple audit function, they would 
guard against some real problems and help clean up the 
integrity of their databases.
    The final thing I'd like to mention is something that's 
called single-use credit card numbers. And Ms. Chairwoman, I 
heard that you had your credit card number stolen. I don't know 
if it was by skimming or through a database.
    One company that I work with, called Privasys, has 
developed these prototype cards. You punch your pin number into 
the credit card so it can issue you a single-use number that is 
only good for one purchase.
    So if later that number is stolen, it's worthless.
    And so, there are solutions that we need in law, in 
organizational practice, and in technology.
    Thanks very much. I'd be happy to answer any questions.
    [The prepared statement of Evan Hendricks can be found on 
page 131 in the appendix.]
    Chairwoman Kelly. Thank you, Mr. Hendricks. I'm going to 
ask just a couple of questions.
    Mr. Rotenberg, on page 2 of your statement, I have to say, 
I was multi-tasking up here and reading it at the same time.
    I find this a fascinating statement. It is the financial 
services industry's misplaced reliance on the SSN, lacks 
verification procedures and aggressive marketing, that are 
responsible for the financial consequences of identity theft.
    I want you to enlarge on that.
    Mr. Rotenberg. Well, my point, Chairwoman, is simply that 
the SSN has been moved from the realm of processing Social 
Security benefits within the Federal Government and the purpose 
of tax identification when it become recognized by Congress for 
that purpose in 1961, to a generalized identifier across the 
financial services sector.
    Chairwoman Kelly. Yes, sir, I do understand that. My 
question is why you are blaming--it appears you're blaming the 
financial service industry's use and reliance on that Social 
Security number for some of the fraud.
    As a matter of fact, that integrates with a comment by Mr. 
Pratt when he talks about the Gramm-Leach-Bliley effect on the 
FTC rules.
    I'm wondering if the two of you can tell me--if what my 
interpretation is is a correct one. Are you saying that the 
Gramm-Leach-Bliley bill has had an effect on the use of the SSN 
by the financial services industry that would increase the 
ability for fraud to exist?
    Mr. Pratt. If I may, from our perspective, the point we 
wanted to make in the testimony was simply that the Gramm-
Leach-Bliley Act did take into account that there would be a 
series of exceptions to a consumer's choice for how non-public 
personal information could be transferred. And one of those 
exceptions was for purposes under the Fair Credit Reporting 
Act.
    But the FTC's interpretation appears to foreclose on a 
consumer reporting agency's ability once they have that 
information to then build fraud prevention products that might 
apply to other exceptions within the GLB 502[e] exceptions.
    And clearly, to foreclose on our ability to build a fraud 
prevention or a verification product which would use 
identifying information outside of GLB and outside of the Fair 
Credit Reporting Act.
    So, in that case, the law seems to have tightened down the 
screws a little too tightly on some information that we might 
be able to use.
    Chairwoman Kelly. Do you agree with that, Mr. Rotenberg? 
Anyone is welcome to join in, but I want to ask that 
specifically of Mr. Rotenberg.
    Mr. Rotenberg. Well, I don't agree that one of the 
consequences of GLB was to make the Social Security number more 
widely available to financial institutions. I understand the 
point that it in some ways may restrict certain verification 
procedures.
    But I do want to be clear about the point in my statement 
here. Clearly, the theft itself is not committed by the 
institutions. That's not what I said.
    What I said, that the use of the SSN to link financial 
records across institutions means that when the theft has 
occurred, the damages are amplified.
    And so, when I said earlier that we need to think about 
systems of identification that are not so dependent on the SSN, 
it is very much based on the experience that victims of ID 
theft have had. When their Social Security numbers get out, 
then they lose control of their bank account, their credit 
account, and the other accounts that they may have with 
financial institutions.
    Mr. Hendricks. Madam Chairwoman, can I respond to that?
    Chairwoman Kelly. Mr. Hendricks.
    Mr. Hendricks. I'll give you one example.
    Identity thieves are in the business of getting credit 
fraudulently. They're able to do that because they apply for 
credit in somebody else's name and Social Security number.
    The first problem is the credit-reporting agencies are too 
liberal in disclosing the innocent victim's credit report in 
response to an application made by an imposter. In many of 
these cases, I've seen that the city is different, the address 
is different, and the spelling is different. Yet, they err on 
the side of maximum disclosure from the credit-reporting agency 
to the credit granter, and that's the first problem.
    The second problem is that, if the imposter simply has your 
Social Security number, I've seen cases--if you write these two 
names down--Myra Coleman and Maria Gaten. If you have the same 
Social Security number, their algorithms work so, since there's 
an M and an R and another letter in the first name, that it's 
similar enough to go ahead and disclose the information, even 
though the names are completely different.
    So there are some real application problems that were built 
from earlier days when they were thinking--well, women get 
married, they change their last name. People move a lot. As 
opposed to now, where we have a clear threat of identity theft 
and they need to update their rules for disclosing consumers' 
credit reports.
    Mr. Dugan. Madam Chairwoman, I'd just like to make two 
points.
    Number one, we think the Gramm-Leach-Bliley Act, in fact, 
makes the misuse of Social Security numbers much more unlikely 
because it gives individuals more control over the ability of a 
financial institution to share that information with any non-
affiliated third party, number one.
    And number two, to the extent that information is provided 
for permissible purposes under the Gramm-Leach-Bliley Act, like 
fraud prevention, then the law specifically prohibits the 
recipient from using it for any other purpose.
    So we think that that goes to that point particularly.
    The second point I wanted to make was, it's nice to say 
that it's easy to steal a Social Security number, and, 
therefore, it's easy to steal someone's identity. But think 
what it would be like if you did not have a Social Security 
number used at all for identification purposes.
    What Mr. Sadaka was saying earlier, you have to have some 
way to have a common, unique identifier in many circumstances, 
which is precisely what financial institutions use it for, to 
make sure that they know you are the Madam Sue Kelly that comes 
in the door and not a different Sue Kelly.
    There have to be ways to link that up. And the use of the 
Social Security number is the way we do that. Without it, and 
with improper restrictions on its use, it would increase the 
occurrence of identity theft, not decrease it.
    Chairwoman Kelly. Thank you very much. I have just one 
follow-up for Mr. Pratt.
    What percent of your membership gets the DMF?
    Mr. Pratt. I actually don't have a good answer for you, but 
I'll be happy to follow up.
    Chairwoman Kelly. I wish you would, please.
    Mr. Pratt. And I think your question is in terms of the 
total customer base, how many customers are using the DMF 
product that our members produce.
    Is that it?
    Chairwoman Kelly. I'm going to withhold any of my further 
questions because I've run out of time, and go to Chairman 
Shaw.
    Chairman Shaw. I'd like to direct my question to Mr. Pratt 
again.
    Our subcommittee has heard from many victims of identity 
theft over the last 2 years and there are stories that raise 
some very troubling issues pertaining to harassment and other 
matters.
    First of all, fraudulent accounts were opened using their 
Social Security numbers, even though all of the information on 
the application was actually incorrect, including their names, 
addresses, and even their birthdays. And the Social Security 
number was the only piece of information that was correct on 
these applications.
    A second troubling issue is that credit-reporting agencies 
verified this incorrect information. Verifications of a name, 
address, place of employment, age, or spouse's name were not 
questioned. If the Social Security number matched up, the 
information was verified and the fraudulent application was 
approved.
    First of all, can you explain how these fraudulent 
applications could have been verified or accepted?
    Mr. Pratt. Well, let me go to, if I could break out your 
question into some parts.
    Chairman Shaw. Maybe you could start just by telling us, 
what is the process and what are the checkpoints?
    Mr. Pratt. The checkpoints that we use are the Social 
Security number, the name, the address, and, when available, we 
may be also able to cross-check previous address. Those would 
be the principle cross-checks.
    Clearly, where we have 3 million consumers each year with 
last names changing, our cross-checks try to accommodate the 
fact that marriage and divorce occur and names can change in 
cycle.
    Date of birth, some of the other identifying elements that 
you've indicated might have been on the application are not 
transmitted to the consumer reporting systems.
    These may be issues that are addressed today differently 
than they may have been previously, but the cross-checks we use 
today are Social Security number, name and address.
    In terms of why an application was approved, I'm not trying 
to put the monkey on someone's else back, but of course I can't 
tell you why the application was approved.
    We transmit the information. We show the lender what 
information we believe in our file matches----
    Chairman Shaw. Do you have any indication of where the 
system failed in this event?
    Mr. Pratt. Well, no, sir, I really don't, because I don't 
have the facts in front of me specific to those particular 
situations.
    I'd have to look at those, I suppose, to better understand 
where the failure occurred.
    Chairman Shaw. Let me ask the question of liability 
because, from your previous answer, it sounds like it's nothing 
but negligence on the part of whoever is putting this 
information together.
    Under the current law, are creditors and credit-reporting 
agencies accountable when their negligence contributes to 
identity theft and to other Social Security number misuses?
    Mr. Pratt. Well, I have to resist the industry being 
characterized as negligent under the Fair Credit Reporting Act.
    Chairman Shaw. I'm not characterizing the industry. I'm 
just saying, in the event of negligence, are they liable?
    That's a simple, straightforward question.
    Mr. Pratt. The answer to the question would be, under the 
Fair Credit Reporting Act, we're liable for being accurate. And 
therefore, if we're not accurate and a lender in turn is also 
liable as a user and as a furnisher under the same Fair Credit 
Reporting Act.
    Chairman Shaw. So it's your testimony that they would be 
liable in the cases of negligence.
    Mr. Pratt. There is negligence, there are willful and 
negligent standards under the Fair Credit Reporting Act and 
there are liabilities associated with the accuracy of the 
information and the use of the information.
    Chairman Shaw. I'll have to go to the Act and see exactly 
what it says. What does it say--willful negligence, or do you 
know?
    Mr. Pratt. There are two standards of civil liability, for 
example, and then of course there's administrative enforcement 
through the Federal Trade Commission and other functional 
regulators under the Act.
    But the civil liability standards are willful and 
negligence.
    Chairman Shaw. Ordinary negligence.
    Mr. Pratt. Yes.
    Chairman Shaw. And that makes them liable.
    Mr. Pratt. Those are two standards of liability depending 
on the fact pattern, depending on how the suit is brought, 
against any one of the parties that is regulated under the Act.
    Chairman Shaw. Do you think the creditors and credit-
reporting agencies should be liable for these kinds of 
mistakes?
    Mr. Pratt. Well, I think we're on the same side of this 
along with you. We don't want these mistakes to happen and we 
want accurate information in our files, sir, really.
    Chairman Shaw. If we weren't on the same side, I wouldn't 
be here listening to you.
    Mr. Pratt. I appreciate that.
    Chairman Shaw. We're trying to figure this thing out so 
that we don't disrupt a system of a national identifier that, 
for good reason or bad reason, has been in place now for a 
number of years.
    But we do know that there's been serious misuse. We do know 
that this is the fastest-growing crime in the country today.
    And I personally believe and I think many other people 
personally believe, and I think Mr. Sadaka would agree with me 
on this--Mr. Sadaka, I think you agree that failure to do 
something is going to create a snowball effect and that this 
thing will be totally out of control after a reasonable period 
of time.
    Do you agree with that?
    Mr. Sadaka. Yes, sir, I do.
    Chairman Shaw. Thank you. I yield back my time.
    Chairwoman Kelly. Thank you.
    We go to Mr. Hooley.
    Ms. Hooley. Thank you, Just a couple of quick questions.
    Anyone from the industry side can answer the first 
question. And that is, I understand the need for the industry 
to have this master list, so you can flag your files to prevent 
compromise by an identity thief.
    What else do you do with the information? I mean, you use 
it to flag your files. What else do you do with the 
information?
    Any one of you.
    Mr. Lehner. Well, as I mentioned in my testimony, it's 
oftentimes used to verify information on existing accounts, if 
people change the status of their account for some of our 
mortgage lenders. If a customer is refinancing their home, 
they're changing credit products within a company.
    Usually, that information is asked as a means to verify 
that they are who they say they are.
    Mr. Pratt. Our members as subscribers are using it 
principally for fraud prevention.
    Ms. Hooley. That's what I assume, all of you are using it 
for fraud prevention.
    Mr. Dugan. There are other reasons to use the information: 
to track down or locate lost shareholders, or to review loan 
applications. But principally, it's to make sure that the 
person is who they say they are.
    Ms. Hooley. Would you have any opposition to having it in 
law that the information is solely used to flag the file of a 
deceased individual or for fraud prevention?
    Mr. Pratt. Like all good trade associations, I'd have to go 
back and talk to the members, I guess, and find out whether 
there's anything out there that I'm just not aware of here 
today.
    Ms. Hooley. OK. By the way, Mr. Pratt, thank you very much 
for clearing up the file of Sean. I really appreciate your 
doing that.
    Mr. Pratt. Thank you.
    Ms. Hooley. For either Evan or Marc Rotenberg, are you 
aware of any instances where information from the Death Master 
File has been intercepted by identity thieves?
    Are you aware of that at all?
    Mr. Hendricks. No, not per se. The cases that I've heard 
of, the identity is just doing straight to the local government 
agency and getting information off death certificates. I've 
heard about cases like that and I've asked for more 
documentation of that.
    Ms. Hooley. Do you think we should use it solely for 
flagging the files, using the Death Master list solely for 
flagging the files or for fraud?
    Mr. Hendricks. Yes. You create an automated information 
exchange here and you specify what those purposes are and you 
create penalties for people that violate that and remedies for 
individuals whose privacy is violated.
    I think that's the way to go. And I think if you look at 
the kind of privilege that goes between a lawyer and a client 
or a doctor and a patient, the privacy privilege is not so 
people can hide or keep data secret. It's to allow for the open 
exchange of information for the purposes you need--better 
health care, better legal advice.
    And I want to take that concept and expand it to everything 
in our society. So privacy is protected within certain spheres, 
but that allows for open data exchange within the approves 
spheres.
    Ms. Hooley. Thank you. That's all the questions I have.
    Chairwoman Kelly. Thank you very much. I have a couple of 
other questions. One for all of you as panel members.
    I'd like to know if you can commit to participating on a 
task force with the SSA to solve this problem.
    I think that if we put together--if there's a task force of 
the SSA, the GAO, the Commerce Department, and all of you, we 
could probably get to the root of the problem and get it solved 
much more quickly than every agency acting without consulting 
the others.
    So I'd like to ask for a commitment from all of you to 
being a part of that task force. Can you commit to that?
    Mr. Dugan. Madam Chairwoman, we'd be delighted to commit to 
do that.
    Chairwoman Kelly. Am I hearing that from all of you?
    Mr. Pratt. Our testimony already indicates we support doing 
that.
    Mr. Sadaka. Absolutely, yes.
    Mr. Lehner. Absolutely.
    Mr. Hendricks. Yes.
    Mr. Rotenberg. Yes.
    Mr. Sadaka. We'd be very willing to commit as well.
    Chairwoman Kelly. I thank you very much.
    One final thing for you, Mr. Hendricks. Your son is going 
to have to wait for lunch for one second.
    You said in your testimony that there was an independent 
national office to oversee and enforce the privacy law, was a 
recommendation of the U.S. privacy protection study commission 
in 1976.
    I think it's time we consider something like that and I 
hope that you will consider that within the framework of this 
task force.
    That being so, then I would like to, if there's no more 
questions, the Chair notes that some Members may have 
additional questions for this panel that they may wish to 
submit in writing.
    So without objection, the hearing record is going to remain 
open for 30 days for Members to submit written questions to 
these witnesses and to place their responses in the record.
    On behalf of the subcommittees, I want to thank all of the 
witnesses for taking the time to be here today. I believe it's 
been a very productive hearing that has highlighted a problem 
that can be solved with regards to identity theft.
    This panel is excused with our appreciation. I want to 
thank Chairman Shaw and his staff and other Members and all of 
their assistants, and my staff, for making the hearing 
possible.
    The hearing is adjourned.
    [Whereupon, at 12:25 p.m., the hearing was adjourned.]

                            A P P E N D I X

                            November 8, 2001

[GRAPHIC] [TIFF OMITTED] T6259.001

[GRAPHIC] [TIFF OMITTED] T6259.002

[GRAPHIC] [TIFF OMITTED] T6259.003

[GRAPHIC] [TIFF OMITTED] T6259.004

[GRAPHIC] [TIFF OMITTED] T6259.005

[GRAPHIC] [TIFF OMITTED] T6259.006

[GRAPHIC] [TIFF OMITTED] T6259.007

[GRAPHIC] [TIFF OMITTED] T6259.008

[GRAPHIC] [TIFF OMITTED] T6259.009

[GRAPHIC] [TIFF OMITTED] T6259.010

[GRAPHIC] [TIFF OMITTED] T6259.011

[GRAPHIC] [TIFF OMITTED] T6259.012

[GRAPHIC] [TIFF OMITTED] T6259.013

[GRAPHIC] [TIFF OMITTED] T6259.014

[GRAPHIC] [TIFF OMITTED] T6259.015

[GRAPHIC] [TIFF OMITTED] T6259.016

[GRAPHIC] [TIFF OMITTED] T6259.017

[GRAPHIC] [TIFF OMITTED] T6259.018

[GRAPHIC] [TIFF OMITTED] T6259.019

[GRAPHIC] [TIFF OMITTED] T6259.020

[GRAPHIC] [TIFF OMITTED] T6259.021

[GRAPHIC] [TIFF OMITTED] T6259.022

[GRAPHIC] [TIFF OMITTED] T6259.023

[GRAPHIC] [TIFF OMITTED] T6259.024

[GRAPHIC] [TIFF OMITTED] T6259.025

[GRAPHIC] [TIFF OMITTED] T6259.026

[GRAPHIC] [TIFF OMITTED] T6259.027

[GRAPHIC] [TIFF OMITTED] T6259.028

[GRAPHIC] [TIFF OMITTED] T6259.029

[GRAPHIC] [TIFF OMITTED] T6259.030

[GRAPHIC] [TIFF OMITTED] T6259.031

[GRAPHIC] [TIFF OMITTED] T6259.032

[GRAPHIC] [TIFF OMITTED] T6259.033

[GRAPHIC] [TIFF OMITTED] T6259.034

[GRAPHIC] [TIFF OMITTED] T6259.035

[GRAPHIC] [TIFF OMITTED] T6259.036

[GRAPHIC] [TIFF OMITTED] T6259.037

[GRAPHIC] [TIFF OMITTED] T6259.038

[GRAPHIC] [TIFF OMITTED] T6259.039

[GRAPHIC] [TIFF OMITTED] T6259.040

[GRAPHIC] [TIFF OMITTED] T6259.041

[GRAPHIC] [TIFF OMITTED] T6259.042

[GRAPHIC] [TIFF OMITTED] T6259.043

[GRAPHIC] [TIFF OMITTED] T6259.044

[GRAPHIC] [TIFF OMITTED] T6259.045

[GRAPHIC] [TIFF OMITTED] T6259.046

[GRAPHIC] [TIFF OMITTED] T6259.047

[GRAPHIC] [TIFF OMITTED] T6259.048

[GRAPHIC] [TIFF OMITTED] T6259.049

[GRAPHIC] [TIFF OMITTED] T6259.050

[GRAPHIC] [TIFF OMITTED] T6259.051

[GRAPHIC] [TIFF OMITTED] T6259.052

[GRAPHIC] [TIFF OMITTED] T6259.053

[GRAPHIC] [TIFF OMITTED] T6259.054

[GRAPHIC] [TIFF OMITTED] T6259.055

[GRAPHIC] [TIFF OMITTED] T6259.056

[GRAPHIC] [TIFF OMITTED] T6259.057

[GRAPHIC] [TIFF OMITTED] T6259.058

[GRAPHIC] [TIFF OMITTED] T6259.059

[GRAPHIC] [TIFF OMITTED] T6259.060

[GRAPHIC] [TIFF OMITTED] T6259.061

[GRAPHIC] [TIFF OMITTED] T6259.062

[GRAPHIC] [TIFF OMITTED] T6259.063

[GRAPHIC] [TIFF OMITTED] T6259.064

[GRAPHIC] [TIFF OMITTED] T6259.065

[GRAPHIC] [TIFF OMITTED] T6259.066

[GRAPHIC] [TIFF OMITTED] T6259.067

[GRAPHIC] [TIFF OMITTED] T6259.068

[GRAPHIC] [TIFF OMITTED] T6259.069

[GRAPHIC] [TIFF OMITTED] T6259.070

[GRAPHIC] [TIFF OMITTED] T6259.071

[GRAPHIC] [TIFF OMITTED] T6259.072

[GRAPHIC] [TIFF OMITTED] T6259.073

[GRAPHIC] [TIFF OMITTED] T6259.074

[GRAPHIC] [TIFF OMITTED] T6259.075

[GRAPHIC] [TIFF OMITTED] T6259.076

[GRAPHIC] [TIFF OMITTED] T6259.077

[GRAPHIC] [TIFF OMITTED] T6259.078

[GRAPHIC] [TIFF OMITTED] T6259.079

[GRAPHIC] [TIFF OMITTED] T6259.080

[GRAPHIC] [TIFF OMITTED] T6259.081

[GRAPHIC] [TIFF OMITTED] T6259.082

[GRAPHIC] [TIFF OMITTED] T6259.083

[GRAPHIC] [TIFF OMITTED] T6259.084

[GRAPHIC] [TIFF OMITTED] T6259.085

[GRAPHIC] [TIFF OMITTED] T6259.086

[GRAPHIC] [TIFF OMITTED] T6259.087

[GRAPHIC] [TIFF OMITTED] T6259.088

[GRAPHIC] [TIFF OMITTED] T6259.089

[GRAPHIC] [TIFF OMITTED] T6259.090

[GRAPHIC] [TIFF OMITTED] T6259.091

[GRAPHIC] [TIFF OMITTED] T6259.092

[GRAPHIC] [TIFF OMITTED] T6259.093

[GRAPHIC] [TIFF OMITTED] T6259.094

[GRAPHIC] [TIFF OMITTED] T6259.095

[GRAPHIC] [TIFF OMITTED] T6259.096

[GRAPHIC] [TIFF OMITTED] T6259.097


```