U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

76–259 PS 2002

PREVENTING IDENTITY THEFT BY TERRORISTS

AND CRIMINALS

JOINT HEARING

BEFORE THE

SUBCOMMITTEE ON

OVERSIGHT AND INVESTIGATIONS

OF THE

COMMITTEE ON FINANCIAL SERVICES

AND THE

SUBCOMMITTEE ON SOCIAL SECURITY

OF THE

COMMITTEE ON WAYS AND MEANS

OF THE

U.S. HOUSE OF REPRESENTATIVES

ONE HUNDRED SEVENTH CONGRESS

FIRST SESSION

NOVEMBER 8, 2001

Printed for the use of the Committee on Financial Services and

the Committee on Ways and Means

Serial No. 107–50

(Committee on Financial Services)

Serial No. 107–51

(Committee on Ways and Means)

(

(II)

HOUSE COMMITTEE ON FINANCIAL SERVICES

MICHAEL G. OXLEY, Ohio, Chairman

JAMES A. LEACH, Iowa

MARGE ROUKEMA, New Jersey, Vice Chair

DOUG BEREUTER, Nebraska

RICHARD H. BAKER, Louisiana

SPENCER BACHUS, Alabama

MICHAEL N. CASTLE, Delaware

PETER T. KING, New York

EDWARD R. ROYCE, California

FRANK D. LUCAS, Oklahoma

ROBERT W. NEY, Texas

BOB BARR, Georgia

SUE W. KELLY, New York

RON PAUL, Texas

PAUL E. GILLMOR, Ohio

CHRISTOPHER COX, California

DAVE WELDON, Florida

JIM RYUN, Kansas

BOB RILEY, Alabama

STEVEN C. LATOURETTE, Ohio

DONALD A. MANZULLO, Illinois

WALTER B. JONES, North Carolina

DOUG OSE, California

JUDY BIGGERT, Illinois

MARK GREEN, Wisconsin

PATRICK J. TOOMEY, Pennsylvania

CHRISTOPHER SHAYS, Connecticut

JOHN B. SHADEGG, Arizona

VITO FOSSELLA, New York

GARY G. MILLER, California

ERIC CANTOR, Virginia

FELIX J. GRUCCI, JR., New York

MELISSA A. HART, Pennsylvania

SHELLEY MOORE CAPITO, West Virginia

MIKE FERGUSON, New Jersey

MIKE ROGERS, Michigan

PATRICK J. TIBERI, Ohio

JOHN J. LAFALCE, New York

BARNEY FRANK, Massachusetts

PAUL E. KANJORSKI, Pennsylvania

MAXINE WATERS, California

CAROLYN B. MALONEY, New York

LUIS V. GUTIERREZ, Illinois

NYDIA M. VELA ́ ZQUEZ, New York

MELVIN L. WATT, North Carolina

GARY L. ACKERMAN, New York

KEN BENTSEN, Texas

JAMES H. MALONEY, Connecticut

DARLENE HOOLEY, Oregon

JULIA CARSON, Indiana

BRAD SHERMAN, California

MAX SANDLIN, Texas

GREGORY W. MEEKS, New York

BARBARA LEE, California

FRANK MASCARA, Pennsylvania

JAY INSLEE, Washington

JANICE D. SCHAKOWSKY, Illinois

DENNIS MOORE, Kansas

CHARLES A. GONZALEZ, Texas

STEPHANIE TUBBS JONES, Ohio

MICHAEL E. CAPUANO, Massachusetts

HAROLD E. FORD JR., Tennessee

RUBE ́ N HINOJOSA, Texas

KEN LUCAS, Kentucky

RONNIE SHOWS, Mississippi

JOSEPH CROWLEY, New York

WILLIAM LACY CLAY, Missouri

STEVE ISRAEL, New York

MIKE ROSS, Arizona

BERNARD SANDERS, Vermont

Terry Haines, Chief Counsel and Staff Director

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS

SUE W. KELLY, New York, Chair

RON PAUL, Ohio, Vice Chairman

PETER T. KING, New York

ROBERT W. NEY, Texas

CHRISTOPHER COX, California

DAVE WELDON, Florida

WALTER B. JONES, North Carolina

JOHN B. SHADEGG, Arizona

VITO FOSSELLA, New York

ERIC CANTOR, Virginia

PATRICK J. TIBERI, Ohio

LUIS V. GUTIERREZ, Illinois

KEN BENTSEN, Texas

JAY INSLEE, Washington

JANICE D. SCHAKOWSKY, Illinois

DENNIS MOORE, Kansas

MICHAEL CAPUANO, Massachusetts

RONNIE SHOWS, Mississippi

JOSEPH CROWLEY, New York

WILLIAM LACY CLAY, Missouri

(III)

HOUSE COMMITTEE ON WAYS AND MEANS

BILL THOMAS, California, Chairman

PHILIP M. CRANE, Illinois,

E. CLAY SHAW, JR., Florida

NANCY L. JOHNSON, Connecticut

AMO HOUGHTON, New York

WALLY HERGER, California

JIM MCCRERY, Louisiana

DAVE CAMP, Michigan

JIM RAMSTAD, Minnesota

JIM NUSSLE, Iowa

SAM JOHNSON, Texas

JENNIFER DUNN, Washington

MAC COLLINS, Georgia

ROB PORTMAN, Ohio

PHILIP S. ENGLISH, Pennsylvania

WES WATKINS, Oklahoma

J.D. HAYWORTH, Arizona

JERRY WELLER, Illinois

KENNY HULSHOF, Missouri

SCOTT MCINNIS, Colorado

RON LEWIS, Kentucky

MARK FOLEY, Florida

KEVIN BRADY, Texas

PAUL RYAN, Wisconsin

CHARLES B. RANGEL, New York

FORTNEY PETE STARK, California

ROBERT T. MATSUI, California

WILLIAM J. COYNE, Pennsylvania

SANDER LEVIN, Michigan

BENJAMIN L. CARDIN, Maryland

JIM MCDERMOTT, Washington

GERALD D. KLECZKA, Wisconsin

JOHN LEWIS, Georgia

RICHARD E. NEAL, Massachusetts

MICHAEL R. MCNULTY, New York

WILLIAM J. JEFFERSON, Louisiana

JOHN S. TANNER, Tennessee

XAVIER BECERRA, California

KAREN L. THURMAN, Florida

LLOYD DOGGETT, Texas

EARL POMEROY, North Dakota

SUBCOMMITTEE ON SOCIAL SECURITY

E. CLAY SHAW, JR., Florida, Chairman

SAM JOHNSON, Texas

MAC COLLINS, Georgia

J.D. HAYWORTH, Arizona

KENNY HULSHOF, Missouri

RON LEWIS, Kentucky

KEVIN BRADY, Texas

PAUL RYAN, Wisconsin

ROBERT T. MATSUI, California

LLOYD DOGGETT, Texas

BENJAMIN L. CARDIN, Maryland

EARL POMEROY, North Dakota

XAVIER BECERRA, California

(V)

C O N T E N T S

Page

Hearing held on:

November 8, 2001 ............................................................................................. 1

Appendix:

November 8, 2001 ............................................................................................. 45

WITNESSES

THURSDAY, NOVEMBER 8, 2001

Bond, Hon. Philip J., Under Secretary for Technology, Department of

Commerce ............................................................................................................. 7

Bovbjerg, Barbara D., Director, Education, Workforce and Income Security

Issues, U.S. General Accounting Office .............................................................. 13

Dugan, John C., Partner, Covington & Burling, on behalf of the Financial

Services Coordinating Council ............................................................................ 32

Hillman, Richard J., Director, Financial Markets and Community Investment

Issues, U.S. General Accounting Office .............................................................. 13

Hendricks, Evan, Editor and Publisher, Privacy Times ....................................... 36

Huse, Hon. James G., Jr., Inspector General, Social Security Administration .. 9

Lehner, Thomas J., Executive Vice President, American Financial Services

Association ............................................................................................................ 28

Pratt, Stuart K., Vice President, Government Relations, Associated Credit

Bureaus ................................................................................................................. 26

Rotenberg, Marc, Executive Director, Electronic Privacy Information Center;

Adjunct Professor, Georgetown University Law Center ................................... 34

Sadaka, Thomas A., Special Counsel for Computer Crime and Identity Theft

Prosecutions, Florida Office of Statewide Prosecution ...................................... 30

Streckewald, Fritz, Acting Assistant Deputy Commissioner for Disability and

Income Security Programs, Social Security Administration ............................ 11

APPENDIX

Prepared statements:

Kelly, Hon. Sue W. ........................................................................................... 47

Shaw, Hon. E. Clay Jr. .................................................................................... 49

Oxley, Hon. Michael G. .................................................................................... 46

Cardin, Hon. Benjamin L. ................................................................................ 51

Gutierrez, Hon. Luis V. .................................................................................... 53

Paul, Hon. Ron .................................................................................................. 54

Schakowsky, Hon. Janice D. ............................................................................ 56

Bond, Hon. Philip J. ......................................................................................... 57

Bovbjerg, Barbara D., and Richard J. Hillman, joint statement .................. 87

Dugan, John C. ................................................................................................. 113

Hendricks, Evan ............................................................................................... 131

Huse, Hon. James G., Jr. ................................................................................. 62

Lehner, Thomas J. ............................................................................................ 107

Pratt, Stuart K. ................................................................................................ 100

Rotenberg, Marc ............................................................................................... 126

Sadaka, Thomas A. ........................................................................................... 110

Streckewald, Fritz ............................................................................................ 73

(VI)

ADDITIONAL MATERIAL SUBMITTED FOR THE RECORD

Bovbjerg, Barbara D., and Richard J. Hillman:

Written response to questions from Congressman Gutierrez and the

Subcommittee on Social Security ................................................................. 96

Dugan, John C.:

Written response to questions from Congressman Gutierrez and the

Subcommittee on Social Security ................................................................. 123

Hendricks, Evan:

Written response to questions from Congressman Gutierrez and the

Subcommittee on Social Security ................................................................. 135

Huse, Hon. James G., Jr.:

Written response to questions from Congressman Gutierrez and the

Subcommittee on Social Security ................................................................. 67

Streckewald, Fritz:

Response to an inquiry from Congresswoman Kelly ..................................... 82

Response to an inquiry from Congressman Shaw ......................................... 83

Written response to questions from Congressman Gutierrez and the

Subcommittee on Social Security ................................................................. 84

Comserv, Inc., prepared statement ........................................................................ 137

Erisa Industry Committee, prepared statement ................................................... 140

National Council on Teacher Retirement, prepared statement ........................... 142

(1)

JOINT HEARING: PREVENTING IDENTITY

THEFT BY TERRORISTS AND CRIMINALS

THURSDAY, NOVEMBER 8, 2001

U.S. HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS, COMMITTEE ON FINANCIAL SERVICES, AND THE

SUBCOMMITTEE ON SOCIAL SECURITY, COMMITTEE ON WAYS AND MEANS, Washington, DC.

The subcommittees met, pursuant to call, at 10:10 a.m., in room

2128, Rayburn House Office Building, Hon. Sue W. Kelly,

[chairwoman of the Subcommittee on Oversight and Investigations], and E. Clay Shaw, Jr., [chairman of the Subcommittee on

Social Security], presiding.

Present from Subcommittee on Oversight and Investigations:

Chairwoman Kelly; Representatives Weldon, Inslee, Tiberi, Jones,

Shows and Clay.

Present from Subcommittee on Social Security: Chairman Shaw;

Representatives Matsui, Cardin, Becerra, Doggett, Collins, Brady,

and Ryan.

Also attending was Congresswoman Hooley.

Chairwoman KELLY. This joint hearing of the Committee on

Financial Services Subcommittee on Oversight and Investigations,

and Committee on Ways and Means Subcommittee on Social Security, will now come to order.

I welcome today my colleagues, Clay Shaw, and Ben Cardin. I’m

delighted that we also have other colleagues here—Darlene Hooley.

Thank you very much.

I look forward to hearing what the witnesses have to say.

We’re here this morning to see how we can prevent the awful

crime and terrible tragedy of identity theft by terrorists and criminals. Our special intention is to protect the families of the deceased

from such theft and financial fraud at their most vulnerable moment—when they are grieving from the shock of their loss.

Through the rapid transmittal of the information in the Death

Master File from the Social Security Administration to the financial services industry and the immediate use of that information by

the industry, we can prevent these crimes and spare the families

pain.

James Jackson and Derek Cunningham stole hundreds of thousands of dollars in gems and watches from deceased executives of

our major corporations before being caught by law enforcement.

They stole the identity of the late CEO of Wendy’s International

2

within days after his death and were not arrested until about 2

months later.

In the past 2 months, we learned that identity theft could be a

tool of the hijackers who murdered thousands of our fellow citizens,

and of their accomplices as well.

Last week, the Inspector General of the Social Security Administration testified that some of the 19 hijackers used phony Social Security numbers to perpetrate their murders. And we know that

Lofti Raisi, an Algerian held on suspicion that he trained four of

the hijackers how to fly, used the Social Security number of a New

Jersey woman who has been dead for 10 years.

Even after these events, and after three of us serving on the Financial Services Committee requested the SSA to ensure the rapid

transmission of the Death Master File, we’ve received no commitment from the SSA to take any specific action.

The file is still physically shipped to an agency at the Commerce

Department, where copies are made and physically shipped to subscribers.

In other words, ‘‘snail-mail.’’ There has been no reduction for years in the time that it takes

for the SSA to officially notify the financial services industry of a

death. Identity theft is now part of the first war of the 21st Century, but the Federal Government is still treating it in a 1960s

way.

That must end. That is why we asked the General Accounting

Office to study the matter and report their findings to the committee. That is why we’re so pleased that the Ways and Means

Subcommittee on Social Security, chaired by my colleague, Representative Clay Shaw, can join us in holding a joint hearing today.

We need the Social Security Administration to take bold and immediate action to get the information to the financial services industry. We will hear from the SSA, the Commerce Department, the

General Accounting Office, and we expect an innovative and effective solution.

We also need the financial services industry to ensure that the

information is immediately integrated into databases and available

for permanently deactivating Social Security numbers of the deceased.

Moreover, with the passage of the USA Patriot Act, there will

soon be Treasury Department regulations requiring them to verify

the identification of new account-holders and for customers to provide the identification requested by the companies.

We know that the SSA and financial institutions can meet this

challenge. In the past 3 years, they’ve already met two difficult

challenges—the Y2K conversion and the aftermath of the terrorist

attacks.

The SSA was a leader among Government agencies in successfully avoiding the Y2K glitch and the financial institutions breezed

through the turn of the millennium without a single major problem.

As the acting SSA commissioner testified last week before Representative Shaw’s subcommittee, the SSA regional offices in the

New York and Pennsylvania area reacted with fortitude and compassion to assist the victims and their families, and I want to

3

thank the Social Security Administration for their wonderful assistance to New Yorkers, including the many of those in my district.

After the horrendous destruction in New York City interrupted

the financial markets and killed many, financial institutions there

and across the country picked themselves up, dusted off, and got

back to work with an amazing speed and grace, even while mourning their compatriots.

And all of them did all of that, the Y2K conversion and the recovery from the attacks, without any specific mandate in Federal law.

Surely, we can work together to meet this challenge before us

now. I urge all parties to get together and, based on the GAO’s

findings, leapfrog over the antiquated system now used, and stop

identity theft of the deceased.

Representative Shaw will chair the hearing for the first panel of

witnesses. I will chair the hearing for the second panel.

Thank you.

[The prepared statement of Hon. Sue W. Kelly can be found on

page 47 in the appendix.]

Chairman SHAW. Thank you, Ms. Kelly. We appreciate being

here in your committee room and being able to join with you in this

hearing this morning.

Today, our two subcommittees join together to examine ways to

prevent identity theft by terrorists and criminals. When Social Security numbers were created 65 years ago, their only purpose was

to track a worker’s earnings so that Social Security benefits could

be calculated. But today, use of the Social Security number is pervasive.

Our culture is hooked on Social Security numbers. Businesses

and Government use the number as their primary source of identifying individuals. You can’t even conduct the most frivolous transaction, like renting a video at your local store, without someone

asking you first to render your 9-digit Social Security ID.

Interestingly enough, I had a doctor’s appointment last Friday.

It was a doctor I had never been to before. And I noticed when I

was signing in, my Social Security number was required.

I mentioned that to him back in the examining room and I told

him, I said, the time is going to come when you’re not going to be

able to get that number. And he said, well, I hope it does, because

he had been a victim of identity theft and it took him many years

through the various layers of collection agencies to finally show

that he was not the one that ran the tremendous debt up on the

credit cards.

Your Social Security number is a key that unlocks the doors to

your identity for any unscrupulous individual who gains access to

it. Once the door is unlocked, the criminal or terrorist has at their

fingertips all the essential elements needed to carry out whatever

dastardly act that they conceive.

We now know that some terrorists involved in the September

11th attacks illegally obtained Social Security numbers and used

them to steal identities and obtain false documents, thus hiding

their true identities and their motives. These unspeakable acts

shine an intense spotlight on the need for the Government and the

private industry to be vigilant in protecting identities. It also deVerDate 11-MAY-2000 13:45 Apr 11, 2002 Jkt 000000 PO 00000 Frm 00009 Fmt 6633 Sfmt 6633 76259.TXT HBANK1 PsN: HBANK1
4

mands that safeguards to prevent identity theft are put in place

and put in place now.

Earlier this year, I, along with several of my Ways and Means

colleagues, introduced H.R. 2036, the Social Security Number Privacy and Identity Theft Prevention Act of 2001. This bipartisan bill

represents a balanced approach to protecting the privacy of Social

Security numbers, while allowing for their legitimate uses.

Because of its broad scope, the bill has also been referred to the

Committee on Energy and Commerce and the Committee on Financial Services, in addition to Ways and Means. I urge prompt action

by all three committees so that we may bring this important legislation to the floor as quickly as possible.

It is a needed part of our Nation’s response to terrorism.

Sadly, identity theft is a crime not perpetrated just against the

living. A Washington Post article on Saturday, September 29th, reported that a man detained in Great Britain and suspected of

training the terrorists who hijacked the airliners on September

11th, used the Social Security number of a New Jersey woman who

died in 1991.

The Associated Press reported on October 31st, that an individual from North Carolina had been indicted on charges he tried

to steal the identity of someone killed in the terrorist attack at the

World Trade Center.

Therefore, today, we will take a hard look at the sharing of death

information. The Social Security Administration maintains the

most comprehensive file of death information in the Federal Government. How this information is compiled, its accuracy, and the

speed with which it is shared with the public will be explored.

Because the financial services industry relies fundamentally on

Social Security numbers as the common identifier to assemble accurate financial information, they are in a unique position to assist

in the prevention of Social Security number fraud and abuse. Their

timely receipt of death information and prompt updating of financial data is key in preventing identity theft.

In the past, some businesses have not been enthusiastic about

further restricting the use of Social Security numbers. It is my

hope they will rethink their resistance in light of September 11th.

Identity theft is a national security threat involving life and

property. Safeguards will be made and I predict sooner rather than

later.

Mr. Cardin.

[The prepared statement of Hon. E. Clay Shaw Jr. can be found

on page 49 in the appendix.]

Mr. CARDIN. Thank you, Mr. Shaw. Let me thank both Chairman

Shaw and Chairwoman Kelly for convening this joint hearing

today.

This is an extremely important subject. We’re working in a very

bipartisan way to do everything we can to prevent identity theft.

The FBI considers identity theft to be one of the fastest-growing

crimes in the United States. 350,000 cases a year.

We can do better.

The focus of today’s hearing is going to spend a lot of time on

the SSA’s Death Master File, where it compiles the names and Social Security numbers of those individuals who have recently died.

5

Questions have been raised as to whether those files are as upto-date as they need to be and whether that information is being

shared, particularly with financial institutions, in the most effective way in order to reduce the amount of identity fraud.

I think there’s a joint responsibility here and when the panel

presents their testimony, I hope that they will deal with this.

There’s clearly a responsibility by SSA to have the information

available so that we can prevent identity theft.

But there’s also responsibility in the private sector, particularly

of financial institutions, as to how they deal with identity in the

use of fraudulent or false information.

Both need to work together in order to accomplish it.

The Chairmen have given us examples that should chill all of us.

The fact that several of the hijackers had fraudulent SS numbers,

that is something that is unacceptable. The fact that a terrorist apprehended in Britain had a Social Security number that was from

a deceased person that was 10 years old is unacceptable. We can

do better than that.

There is now, of course, a ring of thefts involving recently-deceased business executives. Ms. Kelly mentioned the Wendy’s executive.

We need to be wiser in how we deal with the Social Security

numbers and updating the data bank at the public level, sharing

with the private sector, to avoid these types of crimes.

I think the questions being raised is whether we can update

these Death Master Files in a more effective way, would that have

prevented some of these ID thefts?

But I must at least raise some additional questions here as we

go through this hearing.

We have the question that the primary purpose, the primary

mission of the SSA’s use of the Social Security card is to maintain

earnings records and pay benefits in the case of death, retirement

and disability.

I have concern about making the list more up-to-date and easier

to use, could compromise individual privacy and have the unintended consequence of making it easier, rather than more difficult,

for people to steal and use false SSNs.

So there are tradeoffs here.

We also have the challenge of joint accounts, where one person

dies and you have another person account. If we all of a sudden

freeze those assets, in a way, we may be causing unintended problems for our constituents.

So these are not easy issues.

But the bottom line is we cannot accept the number of thefts that

are occurring today through the use of Social Security numbers. We

need to do a better job. And we look forward to working with the

people who will be here today on our panel and others so that we

can effectively combat this criminal activity.

Thank you, Mr. Chairman.

Chairman SHAW. Thank you.

Mr. Weldon, do you have a statement?

Mr. WELDON. No, thank you, Mr. Chairman.

Chairman SHAW. Mr. Inslee.

Mr. INSLEE. No statement, Mr. Chairman.

6

Chairman SHAW. Mr. Tiberi.

Mr. TIBERI. No, thank you, Mr. Chairman.

Chairman SHAW. Ms. Hooley.

Ms. HOOLEY. Thank you, Chairman Shaw, and Chairwoman

Kelly.

We’ve heard numerous times today identity theft is an equal opportunity crime. It affects victims of all ages, all incomes, and all

ethnic backgrounds.

Ms. Kelly told us about Wendy’s CEO. But more often than not,

identity theft is something that affects the ordinary citizen, the

person who is working hard, paying their taxes, and trying to do

their best in life.

For example, a little over a year ago, a young man from Oregon

named Sean Bolden, appeared before the full Banking Committee

to testify about his personal nightmare with identity theft.

In Sean’s case, identity thieves had opened dozens of financial

accounts with his Social Security number and, as a result, at age

23, he was unable to obtain any credit whatsoever, including student loans.

And then there’s the case of the little boy in Salem, Oregon,

named Tyler Bales. Tyler was 16 months old when he lost his battle with a rare genetic disease called Hurler’s Syndrome.

Now there’s nothing more tragic than losing a child. Unfortunately, the heartache of Tyler’s loss hasn’t been eased for his parents.

Not only isn’t it hard enough losing a 16-month-old child, but

last spring, the Bales learned, courtesy of the Internal Revenue

Service, that someone claimed Tyler as a dependent on their 2000

income tax return and, as a result, the Bales’ income tax return

was rejected.

As disturbing as that is, it gets worse.

Because of Federal disclosure issues, the IRS cannot give out the

name of the identity theft to the Salem Police Department, even

though identity theft is a felony offense in Oregon. The thief could

live right down the street or 3000 miles away. But because of a

loophole in the IRS, the Bales and the police department will never

know who stole their son’s personal information.

Mr. Chair, I submit that Tyler Bales and Sean Bolden are more

than a name, a date of birth, or a Social Security number, and

that’s why I’ve been a strong advocate of stamping out the crime

of identity theft.

In Tyler’s case, I introduced H.R. 2077, the ID Theft Loophole

Closure bill. It is in the Ways and Means Committee. It is a very

simple bill that says the IRS, in fact, can give out the information

to the local police.

I know our economy in a large degree depends on the flow of free

information. However, it’s imperative that we recognize that private information is just that—private—and not a salable commodity or something to be exposed by unscrupulous individuals.

Literally, this is the fastest-growing crime there is. The numbers

are outrageous. And I could spend some times with numbers, but

I don’t want to do that. What I want to express today is this is happening more and more frequently. It’s happening with people who

are committing other crimes.

7

In Salem, the police department has said that in the last 2 years,

ID theft has increased by over 38 percent and much of that is related to also methamphetamine abuse, is the motivating factor.

We need to close some of these loopholes. We need to do something with identity theft, instead of just talk about it. And I think

today’s hearing is a good start and I yield back my time.

Chairman SHAW. Thank you very much.

Now I’d like to introduce our first panel this morning.

We first have:

The Honorable Philip Bond, who is the Undersecretary of Technology at the United States Department of Commerce;

Jim Huse is no stranger to the subcommittees, he is the Inspector General of the Social Security Administration;

Fritz Streckewald, Acting Assistant Deputy Commissioner for

Disability and Income Security Programs of the Social Security Administration;

Barbara Bovbjerg, the Director—Barbara, if I ever fail to mispronounce your name, would you please call me down on it?

[Laughter.]

Ms. BOVBJERG. It’s ‘‘Bo-berg,’’ and everyone has trouble with it.

Chairman SHAW. And it seems, as long as I’ve known you, I’d

have gotten it right by now.

[Laughter.]

But you certainly are no stranger to the subcommittees, because

you’re the Director of Education, Workforce and Income Security of

the General Accounting Office.

And Richard Hillman, who is the Director of the Financial Markets and Community Investment of the General Accounting Office.

Welcome to all the witnesses. We have your full statements and

they’ll be made a part of the record. You may proceed as you see

fit.

Mr. Bond.

STATEMENT OF HON. PHILIP J. BOND, UNDER SECRETARY

FOR TECHNOLOGY, U.S. DEPARTMENT OF COMMERCE

Mr. BOND. Thank you, Mr. Chairman, Chairwoman Kelly, Members of both subcommittees. I want to thank you for inviting me

here to address an important issue, obviously of combatting fraudulent use of Social Security numbers of decreased individuals.

The National Technical Information Service, NTIS, is a component of the Department of Commerce. It’s involved in this issue because it makes available to the public the Social Security Administration’s Death Master File extract.

Let me just say by way of preface that as someone who spent 7

years working in the people’s house, sitting back there in the staff

row, it’s a special and deep honor for me to come back here and

work with you in trying to work toward a solution and improvement in the system in this regard.

Obviously, September 11th has caused all of us to revisit and reassess what we’re doing in every branch of Government, and certainly that is true at the Department of Commerce, where Secretary Evans has us involved deeply in that reassessment.

So I want to commend you for holding this hearing, for the leadership, and for bringing some attention to this matter. And I’m conVerDate 11-MAY-2000 13:45 Apr 11, 2002 Jkt 000000 PO 00000 Frm 00013 Fmt 6633 Sfmt 6633 76259.TXT HBANK1 PsN: HBANK1
8

fident that as the subcommittees look into this, that they’ll find

that technology is part of the solution.

First, very quickly, a bit about NTIS.

For over 50 years, NTIS has collected, organized and permanently preserved most of the research and technical reports of the

Federal Government. There are today about 3 million information

products in its permanent collection.

NTIS, I want to stress, received no appropriated funds. It is selfsustaining, basically on the sale of these largely technical manuals

and reports.

Many agencies in the Federal Government work with NTIS because they know the agency has the ability to make their information products more widely available, beyond their normal constituency, and in different formats.

Clearly, it would be more expensive if all of the agencies tried

to replicate this infrastructure.

A quick example. The Defense Technical Information Center provides its technical reports directly to the folks in their community.

But they turn to the NTIS for the release of unclassified research

to the public at large.

Similarly, the Social Security Administration distributes the

Death Master File to Federal agencies, some State and local agencies, but they turn to the NTIS to make it available to others, in

part because SSA does not currently have the capacity or the distribution networks.

Very quickly, my principal comments here will address what

NTIS does with the files once we receive them and I’ll defer to that

agency on a description of the preparation of the files, other than

to say that, on a quarterly basis, they do the full Master File and

then monthly updates beyond that.

The Death Master File contains only basic information—Social

Security number, last name, first name, date of death, date of

birth, State or county of residence, zip code for the last residence,

and last lump-sum payment.

Obviously, the Death Master File can be a great help for detecting erroneous or fraudulent payments.

Accordingly, SSA makes it available directly to a number of

agencies that pay benefits or have other needs for this information,

such as preparing statistical studies and to States which use the

list to detect fraud or administrative errors, including fraudulent or

erroneous food stamp payments, for example.

At the same time, SSA makes the Death Master File available

to these Federal agencies, they make it available to NTIS for reproduction and distribution to others.

We receive this information on a cartridge via overnight mail and

copy the information onto magnetic tape or cartridge or CD, depending on what our end-user has requested.

And I want to stress that NTIS will of course be pleased to consider other formats.

It typically takes 1 to 3 days for NTIS to complete this production process, having received the cartridge and then turning it

around.

9

We send the file to more than one hundred subscribers, either

via overnight mail or first-class mail, if that is their preference. All

formats are sent out at the same time.

The turn-around time does depend in part on the size of the file,

but it is not generally a function of the fact that NTIS offers it in

various formats.

That is not the source of delay.

We understand that the Social Security Administration is exploring new approaches to making the file available in a more timely

technological manner. These include sending the file to NTIS electronically and sending updates on a weekly, rather than monthly,

basis.

Clearly, electronic transfer would certainly reduce the turnaround time. Subscribers would probably find it easier to obtain

just the updates electronically rather than the massive Master File.

In any event, we are committed to working with SSA to improve

the delivery of this important product.

Finally, let me express—I understand there’s a desire in the financial community for a web-based search capability. That is an

interesting proposal that we will certainly look at.

And again, NTIS is pleased to look at that further. If there’s anything that we can or should do to expedite the process, we want

to do it as soon as possible.

Thank you, Mr. Chairman.

[The prepared statement of Hon. Philip J. Bond can be found on

page 57 in the appendix.]

Chairman SHAW. Thank you, Mr. Bond.

Mr. Huse.

STATEMENT OF HON. JAMES G. HUSE, JR., INSPECTOR

GENERAL, SOCIAL SECURITY ADMINISTRATION

Mr. HUSE. Good morning, Mr. Chairman. Thank you for having

me. Chairwoman Kelly.

While I have testified on the issue of identity theft before various

committees in both the House and Senate, the issues of September

11th lend a renewed urgency to this issue.

Identity theft was already a significant problem facing law enforcement, the financial industry, and the American public before

September 11th. In the weeks since that terrible day, it has become

increasingly apparent that improperly obtained Social Security

numbers were a factor in the terrorists’ ability to assimilate themselves into our society while they planned their attacks.

While this has heightened the urgency of the need for Congress,

the Social Security Administration, and my office to take additional

steps to protect the integrity of the Social Security number, it has

not altered the nature of the steps that must be taken.

The Social Security number, no matter how much we avoid labeling it as such, is our national identifier. As such, it is incumbent

upon those of us gathered here to do all in our power to protect

it and the people to whom it is issued. There are three stages at

which protections must be in place: upon issuance, during the life

of the number holder, and upon that individual’s death.

With respect to the issuance of SSNs, or what the Social Security

Administration refers to as the enumeration process, our audit and

10

investigative work has revealed a number of vulnerabilities and resulted in a number of recommendations.

The most critical of these recommendations centers around the

authentication of documents presented by the individual applying

for an SSN or a replacement Social Security card.

If we are to preserve the integrity of the SSN, birth records, immigration records, and other identification documents presented to

SSA must be independently verified as authentic before an SSN is

issued.

Further, if immigration records are to be relied upon, the Immigration and Naturalization Service must be required to authenticate those records.

Regrettably, this will subject the enumeration process to delays.

But just as we must endure lengthy waits at airports in the name

of higher security, so must we now sacrifice a degree of customer

service in the name of SSN integrity.

H.R.2036, introduced by the Social Security Subcommittee,

moves us closer to these protections, the importance of which cannot be overstated. If we cannot stop the improper issuance of SSNs

by the Federal Government, then no degree of protection after the

fact will have any significant effect.

It would merely be closing the barn door after the horse has

gone.

The second and most difficult stage of protecting the SSN comes

during the life of the number-holder. Because the SSN has become

so integral a part of our lives, particularly with respect to financial

transactions, it is difficult to give the number the degree of privacy

it requires, but there are important steps we can take.

We can limit the SSN’s public availability to the greatest extent

practicable, without unduly limiting commerce. We can prohibit the

sale of SSNs, prohibit their display on public records, and limit

their use to valid transactions. And we can put in place enforcement mechanisms and stiff penalties to further discourage identity

theft.

Finally, we must do more to protect the SSN after the numberholder’s death. The Social Security Administration receives death

information from a wide variety of sources and compiles a Death

Master File, which is updated monthly and transmitted to various

Federal agencies. It is also required to be offered for sale to the

public and can be accessed over the internet through a number of

sources, as we’ve already heard.

My concern under the current system is with the accuracy of the

death information. Accuracy in this area is critical to SSA in the

administration of its programs, to the financial services industry,

and to the American people. Our audit work has revealed systemic

errors in the Death Master File and we have recommended steps

that SSA can take to improve the reliability of this critical data.

Among these recommendations were matching the Death Master

File against auxiliary benefit records to ensure that individuals receiving benefits in one system are not listed as deceased in another, and reconciling 1.3 million deaths recorded in SSA’s benefit

payment files that do not appear in the Death Master File.

We are faced with striking a balance between speed and convenience, on the one hand, and accuracy and security on the other.

11

This is true in the case of the Death Master File, just as it is true

in the enumeration process.

At all three of these stages of an SSN’s existence, improvement

is needed. H.R. 2036 addresses many of these concerns. The Social

Security Administration, my office, the Congress, and the American

people must act together to accord the SSN the protections appropriate to the power it wields.

Thank you very much.

[The prepared statement of Hon. James G. Huse, Jr. can be

found on page 62 in the appendix.]

Chairman SHAW. Thank you, Mr. Huse.

Mr. Streckewald.

STATEMENT OF FRITZ STRECKEWALD, ACTING ASSISTANT

DEPUTY COMMISSIONER FOR DISABILITY AND INCOME SECURITY PROGRAMS, SOCIAL SECURITY ADMINISTRATION

Mr. STRECKEWALD. Chairman Shaw, Chairwoman Kelly, Members of the subcommittees, thank you for asking me to appear before you today to discuss the Social Security Administration’s collection, maintenance and distribution of death information.

We use this information for a number of important program purposes and the integrity of this information is of utmost importance

to us.

SSA’s Death Master File was created because of a 1980 Consent

Judgement resulting from a lawsuit brought by a private citizen.

Under the Freedom of Information Act, we are required to disclose

the Death Master File to members of the public.

SSA obtains death reports from many sources, with 90 percent

of the reports obtained from family members and funeral homes.

The remainder of the information comes from States and other

Federal agencies through data exchanges and reports from postal

authorities and financial institutions. We match death reports of

the approximately 2.5 million people who die annually against our

payment records and terminate benefits for those individuals who

are deceased. We annotate the deaths on our master Social Security and Supplemental Security Income beneficiary records and on

the Social Security number record file for beneficiaries and nonbeneficiaries.

Since studies have shown that death reports from family members and from funeral homes are over 99 percent accurate, we do

not verify these reports. For our beneficiaries, we are currently

verifying reports from financial institutions and postal authorities

after terminating benefits. However, we are changing our policy to

verify these reports before taking any action.

Reports obtained through data exchange require verification

through our field offices before an individual’s death is posted to

our payment records and their benefit is terminated. This includes

death data received from the States.

We do not verify death reports on persons who don’t receive Social Security benefits, and it would be difficult for us to do so since

we do not have addresses or other identifying information on these

individuals.

The Death Master File is updated daily based upon reports SSA

receives and contains approximately 70 million records, including

12

Social Security beneficiaries and non-beneficiaries, with verified

and unverified reports of death.

If available, the file contains the deceased’s SSN, first name,

middle name, surname, date of death, date of birth, State, county,

zip code of the last address on our records, and the zip code of the

lump-sum death payment. The record is also annotated to indicate

where the report was verified.

Federal agencies, State and local government, and the private

sector use the national death data file, and we are reimbursed for

the cost of providing this information. Currently, as required by

law, SSA shares the full Death Master File with Federal benefitpaying agencies that use the data to conduct matches against their

own beneficiary rolls, such as the Department of Defense and the

Office of Personnel Management.

Under the matching agreement with SSA, these agencies are required to independently verify the fact of death before taking any

adverse action.

The publicly available Death Master File is provided monthly to

the Department of Commerce, National Technical Information

Service, or NTIS, which in turn makes it available to the public

under the Freedom of Information Act. NTIS distributes it to subscribers by either tape file or CD-ROM version. Some of these private companies, including genealogical publishing companies, create their own files from the Death Master File. Some private

websites have these files on line.

In response to issues raised by the subcommittee Members, we

are exploring electronically transmitting our Death Master File to

the NTIS, rather than sending them through Federal Express.

We are prepared to do that immediately, as soon as NTIS is

ready to receive it. Transmitting the data more frequently is also

possible, perhaps on a weekly or bi-weekly basis.

SSA also has an electronic data exchange of all States and a

large number of Federal agencies. This is an electronic overnight

query process that enables requesters to enter a query for any individual. Using this process, State agencies can access our death

records so they can ensure that benefits are not paid to deceased

individuals.

Finally, I’d like to briefly mention recent initiatives to strengthen

the enumeration process.

In response to the events of September 11th and the indication

that some terrorists had Social Security numbers and cards, some

of which may have been fraudulently obtained, SSA formed a highlevel response team to re-examine the enumeration process.

The response team, which includes representatives of SSA’s Office of the Inspector General, will help determine what changes

need to be made to ensure that we are taking all necessary precautions to prevent those of criminal intent from using Social Security numbers and cards to advance their operations.

Thank you again for the opportunity to discuss with your committees how SSA gathers and distributes death information.

I will be glad to answer any questions.

[The prepared statement of Fritz Streckewald can be found on

page 73 in the appendix.]

Chairman SHAW. Thank you.

13

Mrs. Bovbjerg.

STATEMENT OF BARBARA D. BOVBJERG, DIRECTOR, EDUCATION, WORKFORCE AND INCOME SECURITY ISSUES; AND

RICHARD J. HILLMAN, DIRECTOR, FINANCIAL MARKETS AND

COMMUNITY INVESTMENT ISSUES, GENERAL ACCOUNTING

OFFICE

Ms. BOVBJERG. Thank you, Mr. Chairman, Members of the subcommittees.

I’m really pleased to be here before the subcommittee again and

to meet a new subcommittee to me, with my colleague, Richard

Hillman, to discuss the distribution of death information to financial institutions.

As we’ve heard, the Social Security Administration collects and

records the names and Social Security numbers of the more than

two million Americans who die each year. This information is critical to the integrity of the Federal benefit system.

Properly used and distributed, death information can also help

prevent the fraudulent use of Social Security numbers to steal

identities, to obtain false identification documents, and to commit

financial fraud.

In light of the recent terrorist attacks, it is more important than

ever to safeguard Social Security numbers from criminal use.

Accordingly, our testimony today addresses three points. First,

how death information is collected and distributed and how long

this takes. Second, how the financial services industry uses such

information. And third, possible steps to improve timeliness of distribution.

Our observations are based on prior GAO work, preliminary

work at the SSA and the National Technical Information Service,

and our discussions with financial services institutions.

First, let me describe the collection and distribution process.

As we’ve heard, SSA receives about 90 percent of its death information from funeral homes and relatives of the deceased, and most

of this information reaches SSA within a week of death. SSA takes

another week to process the information and add it to individual

Social Security records.

At the beginning of each month, SSA extracts this death information from its records to the Death Master File, and sends it to

the NTIS. NTIS receives this information by the fourth or fifth day

of each month and mails it to subscribers on tape or on CD-ROM

within another 2 to 4 days.

Overall, most death information reaches these subscribers within

1 to 2 months of death, depending on when the death notice first

reaches Social Security.

The remaining ten percent of death information comes to SSA

from other Federal agencies that learn of deaths through data

matches or undelivered benefit checks and from State vital statistics bureaus. However, these death reports are less timely than

those sent directly from families and funeral directors to SSA, and

require verification by SSA before they can be added to the Master

File and distributed.

14

Death information may not reach SSA from State reports until

3 to 4 months after the date of death and is not available to private

subscribers.

Let me now turn to how financial services institutions use this

information.

Representatives of such institutions told us they did not use a

formal process or a central data source to identify deceased customers, although most receive death information either from family

members or, in the case of Social Security beneficiaries with direct

deposit, from SSA directly.

However, most also told us that they subscribe to fraud prevention products or services offered by credit reporting agencies for

evaluating new credit applications. All three credit reporting agencies subscribe to the Master File and make this information available to their customers through these proprietary fraud prevention

products.

Most institutions we contacted expressed an interest in receiving

timely death information with frequent updates. Some of these institutions were aware of the Master File, but unfamiliar with the

information they provide, or of the ability to subscribe, while others

were not aware of it at all.

Finally, let me turn to possible steps for improving the distribution and use of death information.

As you’ve heard, SSA is exploring ways to speed up this process

and has stated that it would be relatively easy to produce updates

on a weekly, rather than a monthly, basis. SSA and NTIS officials

have stated that it should also be possible for SSA to transmit updates to NTIS electronically and that NTIS could transmit the information to subscribers electronically as well.

SSA is also piloting the electronic death registration system,

which would enable States to collect and report deaths electronically to SSA, both streamlining and centralizing the collection reporting of such information.

However, existing restrictions on distribution of State-provided

data could complicate adoption of such an approach.

In conclusion, most death information is available to the public

within 2 months and improvements to the collection and transmission processes could make this information more complete and

more timely. Educating the financial services industry about the

availability and contents of the Master File would also be helpful.

Such measures are tangible steps that could act to narrow the

window of time in which a criminal can open new accounts using

a deceased person’s identity and would raise the likelihood that

such behavior would be detected.

However, improving the use and timeliness of death information

will not by itself eliminate identity theft and is not a panacea for

addressing the larger issue of criminal misuse of Social Security

numbers.

That concludes my statement, Madam Chairwoman. Mr. Hillman

and I would be happy to answer any questions you have.

Chairwoman KELLY. Thank you very much.

Mr. Hillman, have you a statement, or is yours the same? It’s a

joint statement?

Mr. HILLMAN. Yes, Madam Chairwoman.

15

[The prepared joint statement of Barbara D. Bovbjerg and Richard J. Hillman can be found on page 87 in the appendix.]

Chairwoman KELLY. All right. Thank you very much.

I appreciate you all indulging us up here as some of us are leaving to vote. This way, we can keep the hearing going without keeping you all in your seats for too long a period of time. I’m going

to open the questioning.

Mr. Streckewald, I have a question for you. Actually, I have a

couple of questions for you.

On page 6, in your testimony, you describe the State verification

and exchange system that allows some States and some Federal

agencies to verify a death within one day. Have you considered

whether to open it to access by the financial services industry?

Mr. STRECKEWALD. We use that for, as you said, the State governments. We have, as far as I know, not looked into using it for

financial institutions.

We do have the ability for employers to verify Social Security

numbers in a batch mode, which is like an overnight type of mode

as well. And so, employers can send us batches or individual Social

Security numbers, so that we can verify for them.

I’m not aware that we have specifically looked at the financial

services’ access to the information.

Chairwoman KELLY. I think that looks like the basis for a system

that’s needed by the financial institutions, so that they could do

rapid verification.

Since the Patriot Act requires them to verify the identity of any

new account-holder, I don’t understand why the SSA can’t commit

to allowing that system to be used as part of verification procedures.

Mr. STRECKEWALD. We can certainly take a look at that and get

back to the subcommittees on what we find.

[The information referred to can be found on page 82 in the

appendix.]

Chairwoman KELLY. I wish you would, please. And to that effect,

I’m going to send a letter to the Secretary of the Treasury with

that recommendation to put into their regulations, because I think

that that’s a way of rapidly helping our financial institutions.

I also wondered if the SSA and the NTIS had ever collaborated

on a study to determine a faster means of getting the information

to the financial services industry, including this one, and including

sending it electronically or even perhaps, that difficult word, contracting out the entire process, from extraction to dissemination.

Mr. STRECKEWALD. I think with recent events, we’ve come to the

conclusion with NTIS that we do need to get this information to

them quicker and that they need to be able to distribute it quicker.

I think what remains to be worked out is just the details of that.

It’s certainly technologically feasible and as we’ve heard this morning, it seems like both agencies are willing to move to perhaps a

weekly or biweekly update of the information and to transmit electronically rather than through overnight mail.

Chairwoman KELLY. That I read in the testimony. My question

is, I really want to know how rapidly you’re doing that, but also

there’s another piece of this.

16

There’s a victim. I had my credit card stolen. I think there’s a

lot of people who have had things like that go on. I want to know

with regard to the Social Security number what you’re doing to

help the victims who have their identity stolen, or the families of

victims.

Mr. STRECKEWALD. We have a series of actions that kick into

place when we hear about this type of event. First of all, we refer

them to the inspector general hotline because it’s perhaps a criminal event that needs to be investigated.

But we also work very closely with the person. We give them

pamphlets that explain who they can contact. We give them referrals to some of the national financial services organizations so they

can clarify and correct their credit ratings.

So we do have procedures in place for referrals to hotlines and

other services that can help correct the problem.

Chairwoman KELLY. It’s been my experience in working with

those that they are not terribly rapid. It takes a while. And it takes

going through several people to get it done.

I’m going to ask you this, Mr. Bond, and I would like you both

to answer both those questions, the prior question and this one.

What’s the possibility of allowing people to do this kind of thing,

to do it perhaps electronically with something as a follow-up that

would be a verification.

Mr. BOND. I’m sorry? Just to understand, a verification of the receipt of the information or a verification of falsely secured numbers?

Chairwoman KELLY. I’m extending this to the people who are the

victims of identity theft from the Social Security Administration

numbers.

Those people would have to, when you have that happen, if it’s

in your family, you have to deal with a lot of different people.

What’s the electronic possibilities of letting people do that electronically, deal with people and do it rapidly, rather than having

to make a lot of telephone calls?

Mr. HUSE. If I may be permitted, Chairwoman Kelly.

Chairwoman KELLY. By all means.

Mr. HUSE. The Federal Trade Commission and our office of the

inspector general have a reciprocal information exchange that

going forward will only get better. But in the last 2 years, has rapidly improved the transmission of victim information so that it gets

to the credit-reporting bureaus better than it used to.

Can it be improved? Yes. Like many other things in Government,

it is based on this application of resources and we’re certainly

changing our approach to the amount of resources we apply to this

as this crisis has developed over the last 5 years.

But that’s the way it’s done. It’s better today, and does use, by

the way, e-mail and electronic transmission, if victims have that

available to them, to get the information to us.

From that clearinghouse, then, this information becomes available to local, county and State law enforcement.

Again, I’m not trying to paint a rosy picture here, but at least

we have the dots on the paper and we’re connecting them a little

bit better than we used to.

Chairwoman KELLY. What’s the timeline on that?

17

Mr. HUSE. It all depends on the application of resources. We

work in our budget submission process to try and gain those to do

this.

The technology is already there. It really is a matter of adjusting

IT resources and the human capital that you need to make this

happen.

We’re just learning that this is an issue that the people care

about a great deal.

Mr. BOND. Madam Chairwoman, if I could add to that, too.

Technologically, of course, there’s no reason you can’t expedite

things via the internet and secure communications and so forth. It

really becomes part of a very fundamental e-government initiative

that both the Congress and the Administration have to join hands

on.

The Administration has sent up an aggressive proposal in that

regard and appointed people at OMB to oversee it, to try to really

push the agencies more toward quicker, more rapid response for

our shared constituents.

But it’s going to be a very fundamental effort to apply technology

to the service of constituents.

Chairwoman KELLY. What’s your timeline?

Mr. BOND. There is a multi-year plan out of OMB which does require some significant funding here on the Hill. And that will be

one of the many issues in final appropriations discussions for this

year because the request was not fully funded coming out of the

two chambers.

Chairwoman KELLY. So it’s a matter of appropriated funds from

Congress.

Is that correct?

Mr. BOND. Absolutely, to upgrade the IT capabilities in many of

the Federal agencies.

Mr. STRECKEWALD. If I could, I would reinforce Mr. Bond’s comments that the Federal Government as a whole, through the leadership of OMB and through individual agencies’ initiatives, is looking at customer-oriented electronic services.

In some ways, SSA has been providing this with our online applications. But this particular example that you’re using, which is to

help people correct identity theft problems, would have to be a

broad spectrum of stakeholders, financial services, Government

agencies, States, would have to come together and plan this out

and construct the communications lines and the procedures for

solving this.

But it is technologically feasible and OMB is trying to lead us to

a more electronically-focused, customer-oriented Government.

Chairwoman KELLY. Mr. Huse.

Mr. HUSE. One more thought on all of this.

I think we understand now, with this identity fraud crisis issue

and victim assistance as a key part of it, we’ve learned a lot the

last few years that our traditional approaches to this just don’t cut

it. They don’t work.

We have advanced a proposal in the budget process for innovative ways to change this model, so that law enforcement, Federal

law enforcement integrates itself better with local law enforcement

18

because it’s a total issue. It just can’t be relegated to the Federal

Government or a burden on local governments.

And this model means non-traditional approaches. The key to it

is rapid and effective information exchange. The work is there and

the ideas are there.

In fact, some of this is in 2036. Some of the pieces that we need

to get this done is in 2036. But I really want to assure you, Madam

Chairwoman, that we are committed to trying to do this.

But, as I said, as in everything in Government, it is resource-dependent.

Chairwoman KELLY. Most people who come before these subcommittees ask for resources. That’s not a surprise.

Mr. HUSE. No.

Chairwoman KELLY. But we’re essentially in a terrorist war situation.

One of the things that America has always had is ingenuity. This

may be the time to do more with less. And I’m not saying that you

can’t get the resources. What I’m simply saying is that we have a

limited budget. We all know that. And ingenuity is going to have

to be the order of the day for all of us.

This may be the time, when you need to have that larger meeting, discuss how it’s going to go and do it sooner rather than later,

so you can get help from the financial institutions as well as from

anyone else who is an interested stakeholder in this.

I want to ask the GAO, since there’s no one else who has come

back from the vote yet, I want to ask you, Barbara, if you don’t

mind, have you considered whether the Social Security Administration can open the State verification and exchange system to the financial services industry to allow the companies to verify?

Is that something that you’ve thought about?

Ms. BOVBJERG. GAO has done a lot of work on data sharing and

the importance, on the one hand, of sharing information that allows you to safeguard benefits and safeguard identity and, on the

other hand, being concerned about privacy and retention of personal information.

The death records are already public information, at least for the

most part. What remains to be worked out with the States is this

question of State restrictions on information that they provide that

is not verified by SSA. That seems to be one of the sticking points.

And we do hear about a resource question.

I think we have been interested and have asked about the feasibility of doing some sort of online look-up, web-based approach that

financial institutions could go to directly. And we’re not in a position to make any recommendations. We would have to look at the

cost versus benefits. But we thought that that might show promise.

Chairwoman KELLY. Perhaps we should ask for a cost/benefit

analysis of something like that.

Ms. BOVBJERG. Well, may I add something?

Chairwoman KELLY. Yes.

Ms. BOVBJERG. Excuse me, Ms. Chairwoman.

We are doing some work that I wanted to call to your attention

for Congressman Johnson on the Social Security Subcommittee

that looks at law enforcement and identity theft across governments.

19

And one of the questions that he has us addressing is looking at

the lead Federal and State law enforcement agencies with responsibilities in identity theft investigation and looking at how they cooperate across jurisdiction, including across Federal agencies.

I’m not sure when that work will be published. That’s being done

in another team. But I think that that will help get at some of the

issues that have been raised this morning.

Chairwoman KELLY. Thank you, and thank you for volunteering

that.

What exposure did you find that financial institutions have? If

a name is in the Master File and the institution processes a payment any way?

Mr. Hillman, do you want to answer that?

Mr. HILLMAN. I’m not exactly sure what the exposure may be to

a financial institution who processes information and maybe provides funds out to an individual of a deceased person.

But we could find that out for you and let you know.

Chairwoman KELLY. I would appreciate your taking a look at

that because that goes to the next question. And that is whether

or not—I’m trying to get the acronym here—the FFIEC, the exam

procedures, perhaps should take that into account.

I don’t know if it does or not, but I think it’s worth taking a look

at.

I’m concerned also with the education of financial institutions

with regard to what their exposure is and the appropriate usage

of the Death Master File.

So perhaps you could take a look at look at that also.

Mr. HILLMAN. We’d be happy to do that. We have looked at the

examination procedures, as you might expect, that financial Federal regulators follow in looking at the financial services industry.

And in general, those examination procedures look to the safety

and soundness of those depository institutions to ensure that they

have sufficient funds to conduct their businesses.

They haven’t in all cases looked at other important areas such

as concerns with individuals or constituents. And I agree with you

that that would be an important topic to further study.

Chairwoman KELLY. Thank you very much.

Mr. Brady, do you have any questions?

Mr. BRADY. Thank you, Madam Chairwoman. I’m sorry I missed

the last part of the testimony. But, obviously, to solve this problem

will take a combination of prevention and enforcement in the process.

We need to do all we can in prevention of identity theft. But I

think what everyone understands is that, in this open society, it

will be difficult to close that barn door completely, in this open, information-based society.

So focusing a bit on the enforcement and the punishment side of

it, what are the chances someone engaging in identity theft is going

to get caught? What are the consequences in real life when they

do?

Who’s the best responsible and available to do that, State or Federal Government? What role can the business community play in

catching them?

20

And the bottom line, what would it take to make the consequences harsher to be a real deterrent to people engaging in it?

And I’ll open it up to anyone who’s got an opinion.

Mr. HUSE. I’ll take the first cut at an answer, Mr. Brady.

Mr. BRADY. All right.

Mr. HUSE. We don’t do a great job from a criminal justice perspective with identity thieves because it’s a relatively new crime.

We have a mixed result if you look across the Federal judicial

system in terms of sentencing on these crimes. We need to do better.

One of the outreach efforts I think we need to make now with

the post–9/11 consciousness that we have is to educate United

States attorneys to the fact that these crimes need to be a priority

concern in each of the 94 judicial districts.

That may or may not be the case depending upon where you are

in the United States. Other trendier crimes get priority.

Most States have very vigorous and good identity crime statutes

themselves. So we need to cooperate more with local and State law

enforcement to prosecute there where we can.

Clearly, though, the key to identity fraud because it transcends

all boundaries is there has to be a better information-sharing

mechanism. And the Congress, when it passed the Identity Theft

Deterrence Act several years ago, an Assumption Deterrence Act

several years ago, and established the clearing house in the FTC,

I assure you that that is working and will only get better as we

engage it more.

So that’s my first try at an answer.

Mr. STRECKEWALD. If I could just elaborate a little bit. That particular law that was passed in 1998, which for the first time made

it a Federal crime to fraudulently obtain identification, sell identification, or misrepresent yourself on obtaining any type of identification.

And for the first time, the Social Security number was included

as a means of identification. So that did provide law enforcement

with an added tool for enforcement.

Mr. BRADY. How many prosecutions have there been?

Mr. HUSE. We can get that for you and follow that up. One thing

I want to add, Mr. Brady, is one of the provisions of 2036, if it’s

passed, gives us some great civil money penalty tools.

Also, for those identity crimes that fall maybe under the prosecutorial thresholds in a given judicial district, but still have a fact

pattern that supports an offense, we can sting those people with

some money penalties, and I think that’s a good thing, too.

Mr. BRADY. In real life, what are the consequences for getting

caught? What’s an average sentence, punishment, for identity

theft?

Mr. HUSE. Well, with sentencing guidelines, probably for a first

offender, it is several years of confinement. It depends on the criminal history involved.

Mr. BRADY. Sure.

Mr. HUSE. But it’s a 10-year felony, the misuse is a basic Federal

felony.

Mr. BRADY. Is there a feel for what first-time, second-time offenders, what they traditionally get? I’m not pushing. I’m just curious.

21

We all know what guidelines are. We all know what happens in

real life.

Mr. HUSE. As I said, it’s confinement for several years. It hasn’t

reached the point, even though the violation is just as bad, of having, for example, the emotion involved of a bank robbery or something like that. But it’s just as pernicious.

Mr. BRADY. What role—can I keep, while I’m on a roll?

Two questions, really. How can Washington help? Is it to create

more resources here at the Federal level, or to complement better

State prosecution efforts?

Second, what role can the business community play in helping us

catch and enforce this?

Mr. HUSE. I’ll let Barbara answer that.

Ms. BOVBJERG. I’ll step into the breech.

We have talked in GAO about the need for both prevention and

for law enforcement. One of the things that we’re doing right now

at the request of Chairman Shaw is looking at uses in Government

at all levels—Federal agencies, various departments in State government, local government, and the courts, looking at uses of the

number and looking at how the number is being safeguarded and

developing options that could be considered for safeguarding.

So my answer to your question is more in a prevention side and

working with SSA as they try to have the balance of making information available, but at the same time safeguarding it.

That’s always an issue with some of these web-based——

Mr. BRADY. And clearly, we need to do both. I’m not discounting

either. I was just focusing on that side because I’m not as aware

of it.

And second, it just seems, when you look at the number of people

who have been hurt by identity theft and fraud, the average time

it takes to try and clear their name, the costs to them, and then

on September 11th, we had people who stole identities and then

stole thousands of people’s lives as a result of it.

So the obvious question is, what can we do to punish them to the

fullest extent, or to deter the next person who has that in mind?

That was my focus.

Ms. BOVBJERG. And then I turn it over to the law enforcement

end of the table.

Mr. HUSE. Well, I just wanted to take the piece of the question,

is it all about resources? And that goes to Chairwoman Kelly’s earlier comment.

It doesn’t necessarily just mean resources, although some modest

adjustments are needed here and there because you’re short some

capacity.

But basically, the key to this is rethinking this particular crime

top to bottom, and rethinking how we focus on this crime.

We’re trying to apply an old model to this that just doesn’t work.

If we could just understand how serious it is, that’s a big, huge

step, and then work with ways to, using the magnificent technology

that we have, to communicate better.

I think that’s really the answer, rather than some new agency

or the like.

Mr. BRADY. Thank you. Thank you all very much.

22

Chairman SHAW. Before I go to Ms. Hooley, I do have a question

for you, Mr. Huse.

Does the law distinguish in the case of identity theft between a

living person’s identity who has been stolen or a deceased person?

Mr. HUSE. I don’t believe it does. I think the law deals with the

identity theft. I do know that a deceased person has no rights because they’re not here to have them. But in terms of the identity

theft, it still stays the same under the law.

Again, my staff——

Mr. BOND. I want to add, my understanding on that is that an

individual under law is considered to be a living individual. And so

the rights do not extend to the deceased.

So when you talk about privacy laws, those are applied to living

individuals and that is a fine point that I think some of the Executive agency lawyers would want to talk to the committee staff

about in doing forward on your legislation.

Chairman SHAW. OK. If that answer needs sharpening up, let us

know.

Mr. BOND. OK.

Chairman SHAW. Ms. Hooley.

Ms. HOOLEY. Thank you, Mr. Chair.

In the case of Tyler Bales, you could not give the information to

local law enforcement agencies, even though identity theft is a

crime in Oregon.

So I want to know, do we need to as a body fix that?

Mr. HUSE. Congresswoman, when you were speaking, I jotted

down on a card that case and I passed it back to our chief investigator and I said, we should look at this case.

I don’t know why under the IRS rules they didn’t disclose. And

that may be some arcane rule. I mean, they’re governed by rules.

We are at Social Security.

But, usually, I’d like to see if there wasn’t a way that the Social

Security Administration might not be able to work with that case

and take it forward.

And I’m not criticizing IRS. I’m just not sure.

Ms. HOOLEY. What I’m looking for is if we can do that, in the

case of Oregon where identity theft is a crime.

Mr. HUSE. Right.

Ms. HOOLEY. And I’m just trying to figure out, do we need to fix

it or if it’s some rule that can be fixed.

Mr. HUSE. That’s why I’d like to look at that.

Ms. HOOLEY. OK.

Mr. HUSE. And we’d be glad to talk to your staff about that and

look into that case and then get back to you, if that’s OK.

Ms. HOOLEY. OK. I have a couple of other questions.

The Death Master File, it contains everything that a thief would

need to get up and running. It’s now being transmitted, I understand, to 104 customers, up from about 51 in 1999.

Is that correct?

Mr. BOND. Yes, that’s about right.

Ms. HOOLEY. And all of the customers are paying for the information.

Mr. BOND. Correct.

23

Ms. HOOLEY. And do they use it for the purpose to flag financial

holdings of the deceased individuals or is the information being

used for other purposes? And if so, what are the other purposes?

Mr. BOND. It is a wide variety of purposes, from security to

checking for fraud, obviously. I’m just flipping through here to try

to see, because I had asked that question myself. Having just been

sworn in on October 30th, I’m trying to find out everything I can

quickly.

Ms. HOOLEY. I think sort of the irony of this thing is—— Mr. BOND. There are a couple of things that you need to know

about. One is just the private genealogy sites that people talked

about. That is one that is used, that you can go to. I did my own

search and found that the Jasper County Public Library in Indiana

has got the full Death Master File available there.

So there’s a variety of uses out there.

But the private sector is checking mostly for fraud in financial

transactions.

Ms. HOOLEY. I guess sort of for me the irony is that the Internal

Revenue Service can’t pass the information on to law enforcement,

but they can sell it to other organizations to be used.

And I just have a bit of a problem with that. Should I?

Mr. HUSE. I don’t think any of us here are tax experts. We won’t

even go near there.

Mr. BOND. All I can add is that by the time it gets to NTIS, it

is, as was explained, considered subject to the FOIA laws, and so

it’s out there.

Mr. STRECKEWALD. I have a little more information on the uses

of that, at least in terms of the customers.

About 20 percent of the purchasers of the Death Master File are

public sector groups. Some colleges use it, perhaps for research or

checking against their databases of students. In addition, several

private insurance companies use it extensively, along with a few

banks.

But there are not a lot of financial institutions on the list.

Mr. BOND. Here’s the actual breakdown from NTIS, Congresswoman. It’s 20 percent State and local, 20 percent information brokers, 15 percent insurance companies. Medical and cancer research

organizations make up 15 percent. Security providers, five. Marketing companies, around five percent. Credit reporting bureaus

and agencies, five percent. Pension funds, five percent. Banks and

financial institutions, three. And genealogy, three.

Ms. HOOLEY. Thank you. Thank you and I yield back my time.

Chairman SHAW. Thank you.

I want to pursue the question of Ms. Hooley. I want to know,

those death files, when they’re put out, the Social Security numbers are on them. And I guess they’re readily obtainable.

We know from experience and testimony before these subcommittees that they still have value to those that would attempt identity

theft.

At the hearing that we had last week, we found that those numbers do survive the decedent and have a real purpose in State tax

returns and things of this nature as an identifier.

And we also found that the numbers stay exactly the same.

There’s no D for decedent or something put after the number. So

24

those numbers are still out there and for the layman looking at it,

wouldn’t know whether that was a decedent or somebody who was

very much alive.

What is the suggestion—and I open this to any member of the

panel, that any of you might have—with how we could safeguard

those numbers and yet, release them for legitimate purposes?

Obviously, insurance companies need them and some public officials need them—public agencies need them, rather.

Are there any thoughts on that?

Mr. STRECKEWALD. Yes. Let me see if I can give a couple

thoughts on that.

I think it goes to the whole purpose of the Death Master File.

Originally, it was a court settlement that required us to do this

under the Freedom of Information Act law. But we sell the Death

Master File for commercial purposes through NTIS, so that those

with a reason to know individuals’ Social Security numbers will

know which numbers belong to deceased individuals. If a number

comes through their system and it matches up with a number on

the Death Master File, there’s a problem.

So, in fact, the number is flagged. It is annotated when you compare it against our Death Master File.

If the Death Master File is not used extensively, then, of course,

people won’t have awareness of it.

So, on the one hand, if it’s out there, anybody can use it and try

to take a number from it and create an identity or use it to apply

for a credit card. But if the financial services and insurance companies and others make greater use of the Death Master File, then

they’ll know which numbers belong to deceased individuals.

Chairman SHAW. How can we safeguard that, those lists being

misused?

We have to assume that if they’re out there, they’re being marketed, that they are available to the bad guys.

Mr. STRECKEWALD. From Social Security’s perspective, if a person uses a Social Security fraudulently to work—sometimes numbers are used fraudulently for working—if earnings are reported on

that number the year after the real number-holder dies, then we

automatically investigate because we know that number belongs to

a person who is shown as deceased on our records.

We issue an alert to the field office and they call the employer

and ask who is this person that’s giving these wages under this

number. On our records, it shows that the number belongs to deceased individuals.

So, again, from the original purposes, earnings recordation, we

do track back and see if it belongs to a dead person and if so, why

are earnings being recorded.

Chairman SHAW. It takes a year. You know the person is dead,

money is coming in, it is going into his account. Why wouldn’t it

be kicked out in the first——

Mr. STRECKEWALD. Well, if a person works in January, February

and dies in March, those earnings are reported to us after the end

of the year. So we know that we haven’t heard from the IRS yet

until the year is over.

The next year, if we receive earnings from that person, that’s

suspicious and that triggers an alert.

25

Chairman SHAW. Yes, that would be suspicious. How do we handle death in foreign countries? Someone has retired in a foreign

country, their money is being electronically transferred to a bank

down in Mexico. How is that dealt with?

Mr. STRECKEWALD. I believe that we receive from embassies lists

of deceased beneficiaries in foreign countries—they have Social Security numbers—so we would annotate our records and we would

terminate their benefits.

Chairman SHAW. How do the embassies accumulate that? Now

here, the funeral home turns them in. The death record is required

on that.

So where is it in countries that don’t have that process in place?

Mr. HUSE. To get to a bottom line here, it’s not a perfect system

and it’s totally dependent on cooperation in those countries to give

that information back to the benefit officers that we have in foreign

stations.

So what happens is, periodically, the agency does send out a survey team based on ages of beneficiaries—I think they set the number in the 1990s, but they’re take a look to see if those people are

still alive in the foreign population areas.

And those are done on a cycle basis by the international operations.

Mr. STRECKEWALD. It’s the international operations. And in fact,

for countries that are considered to be high risk, such as Yemen,

they send a team out there.

Not only do they look at the elderly people, they ask to see in

person every beneficiary in Yemen. That’s one example. But we

also go to the Philippines regularly and other countries.

Chairman SHAW. Would it help if we actually sent checks to foreign countries that required signatures, or is the expense of doing

that more than the savings on electronic transfer?

Mr. STRECKEWALD. I think we’d have to take a look at that and

get back to you. I’m not sure. It certainly would be an issue.

[The information referred to can be found on page 83 in the

appendix.]

Chairman SHAW. And actually ask for an endorsement on the

check. I think people would be a little less likely to endorse or forge

somebody’s name than they would be to just simply let the thing

slide and let the money continue to accumulate in the bank account.

That’s my off-hand opinion.

Anyway, any further questions? The gentleman from Wisconsin?

Mr. RYAN. No questions.

Chairman SHAW. OK. Well, at this point, I turn the gavel over

to Ms. Kelly, who will preside over the next panel.

Chairwoman KELLY. Let me make the introductions of the second

panel.

We have: Mr. Stuart Pratt, Vice President for Government Relations, Associated Credit Bureaus;

Tom Lehner, Executive Vice President for Government Affairs,

American Financial Services Association;

Tom Sadaka, Special Counsel, Office of Statewide Prosecution,

Orlando, Florida. We welcome you, Mr. Sadaka. Am I pronouncing

that correctly?

26

Mr. SADAKA. Sadaka.

Chairwoman KELLY. John Dugan, Covington & Burling, representing the Financial Services Coordinating Council.

Mark Rotenberg, Executive Director, Electronic Privacy Information Center.

And Evan Hendricks, Editor and Publisher of Privacy Times. We welcome you all. We look forward to your testimony. And I’d

like to advise all Members and witnesses, I intend to keep to the

5-minute rule. So I’m going to remind witnesses when they have

a minute remaining. Please check the clock.

I will also ask unanimous consent that all Members’ questions be

included in the record. I’d like to begin with you, Mr. Pratt.

STATEMENT OF STUART K. PRATT, VICE PRESIDENT FOR GOVERNMENT RELATIONS, ASSOCIATED CREDIT BUREAUS, INC.

Mr. PRATT. Thank you both very much for this opportunity to appear before this joint hearing today.

For the record, my name is Stuart Pratt and I am the Vice President of Government Relations for the Associated Credit Bureaus.

By way of background, the ACB, as we’re commonly known, represents more than 500 consumer information companies and

produce a wide range of products, including fraud prevention, risk

management, credit reports, mortgage reports, tenant employment

screening services, check fraud, and verification services.

And so the subject matter here today is obviously very relevant

to us and all of our members.

I think it’s clear, perhaps more than ever before, that how we authenticate, how we verify, and how we ensure the authenticity of

information in various types of applications is an essential need in

this country. Unfortunately, I think we’ve learned that for all of the

wrong reasons.

But at the core of this need is also the availability of information

to be used and deployed in the authentication of application processes. And at the core of all of that, in many cases still, is the need

for the availability of the Social Security number, which plays a

particularly important role in our ability and our members’ ability

to build authentication and fraud prevention products, which then

in turn allow us to mediate disparate sets of information and bring

them back together in order to partner with our financial services

customer bases, insurance and so on, in ensuring that they are, in

fact, opening up lines of credit, depository accounts and so on, for

legitimate individuals and for legitimate purposes.

I want to applaud your subcommittee, of course, and the Congress as a whole for the enactment of the USA Patriot Act and the

very fact that this Act itself recognizes the need to have a robust

system of authentication, and in turn specifically directs the Secretary of the Treasury to establish minimum standards for financial institutions to verify account applicant information.

I think, further, Chairman Shaw, in your hearing last week, we

heard additional challenges in terms of even the enumeration process, how do we authenticate and verify information about individuals who are making applications for Social Security numbers.

And in fact, I think we heard information in your hearing last

week about the challenges even the States will face on a go-forward

27

basis in authenticating and verifying individuals who make applications for something as simple, but as consequential, as a driver’s

license.

So it’s a changed world in which we live.

The ACB was asked to address some questions or some areas in

our testimony and I thought I would attempt to do that very quickly. And then of course we can amplify on that in questions and answers that you may have.

You first asked how we, as consumer-reporting agencies, use the

Social Security Administration’s Death Master File. And let me

start by discussing something about the scope of the industry that

we represent.

Our three major credit reporting system members—Equifax,

Experian, and TransUnion—each maintain databases of approximately 200 million files on credit-active consumers in this country.

In addition to that, members such as E-funds and Dole & Media,

maintain Nationwide systems as well that help prevent checking

account fraud and check fraud at the point of sale and further.

In fact, we estimate, easily, that more than a billion consumer

reports are sold every year in this country. And those consumer reports can carry forward and do carry forward in most cases a notification where there is a Death Master File record that we have

been able to obtain.

There are many members within our association who are, in fact,

on that subscriber list. And I thought I would clarify one point that

I think was lost perhaps in the previous round of testimony.

And that is that, when we say there were not many financial institutions on that listing of subscribers, that’s in part, because the

channel of distribution through which the DMF data is made available to a majority of the financial institution market place is

through companies like the ones that we represent here with the

ACB.

You’ve asked about technical problems with the current system

and I think a lot of that has been covered in previous testimony.

I think our members are also encouraged by the fact that there

may be new and different technologies that could be brought to

bear. There could be greater efficiencies achieved.

And I think those are the right questions and I think we’ll have

to work toward achieving the right answers.

Regarding other means of obtaining information, really, the only

other way that the Associated Credit Bureau’s members would be

aware of an individual having died is through notifications that

come through the systems directly from credit lenders.

When a credit lender is notified through a trustee of an estate,

they in turn will notify through coding back to us the fact that that

consumer’s credit account is now associated with a deceased individual. And that would be a code that would then be included in

a statement that would be included and referenced on that account

in subsequent credit reports issued on that individual.

You’ve asked about outlining ways in which sources of information can be better integrated. And let me just say that today, integration is something that we achieve through the systems that we

have.

28

Unfortunately, I do want to state that the FTC’s rules under

GLB restrain us significantly in terms of building fraud prevention

products outside of the Gramm-Leach-Bliley Act or the Fair Credit

Reporting Act.

And let me close by making just a couple of announcements. I

see I’m slowly losing time here.

Chairwoman KELLY. Mr. Pratt, you’ve lost time.

[Laughter.]

So if you could sum up, that would be great.

Mr. PRATT. Two announcements. Number one, we’ve asked all of

our DMF subscriber members of the Associated Credit Bureaus to

convert to monthly receipt. All members will convert to monthly

subscriptions with the DMF Master File, which I think will help

escalate and help make information available.

And number two, our members have established and will work

with a task force to work with the Social Security Administration

in working through technology and legal issues that might be associated with escalating availability of information from the Administration.

[The prepared statement of Stuart K. Pratt can be found on page

100 in the appendix.]

Chairwoman KELLY. Thank you very much, Mr. Pratt.

We move now to Mr. Lehner.

STATEMENT OF THOMAS J. LEHNER, EXECUTIVE VICE PRESIDENT FOR GOVERNMENT AFFAIRS, AMERICAN FINANCIAL

SERVICES ASSOCIATION

Mr. LEHNER. Thank you, Chairwoman Kelly, Chairman Shaw,

Members of the subcommittees. Thank you for inviting me to testify today.

I’m Tom Lehner. I’m the executive vice president of the American

Financial Services Association. AFSA is the leading trade association for market-funded financial services companies.

Our 400 member companies include consumer and commercial finance companies, auto finance/leasing companies, mortgage lenders, credit card issuers, and industry suppliers.

I’m here to address the issue of identify theft using Social Security numbers and, specifically, the industry’s use of the Social Security Administration’s Death Master File.

Social Security numbers are the most unique identifier of individuals in the United States. The financial services industry uses

these identifiers for a variety of reasons, such as customer

verification, credit checks, bankruptcy filings, and monetary judgments such as tax liens.

The use of Social Security numbers is not generally secure. They

are readily available and, indeed, used by companies, State and

local governments, motor vehicle departments, colleges, and even

by consumers who willingly print the numbers on the face of their

checks.

Thieves often steal Social Security numbers and ultimately the

identity of individuals, both living and dead. Financial institutions

such as credit card companies and banks have also incurred significant losses resulting from misuse of Social Security numbers.

29

Consumers have also experienced monetary losses, impaired

credit and legal problems because others have amassed debts using

their identities.

Financial firms have an obvious interest in making sure that individuals who open accounts are who they say they are. Companies

rely on the Social Security Death Master File to protect against

theft.

In most cases, firms do not directly subscribe to the Death Master File, but access it indirectly through credit reporting agencies

or other vendors who do subscribe to it.

This is both more efficient and less costly to the consumer.

For example, bank issuers of credit cards routinely obtain consumer reports on card applicants from credit reporting agencies.

Because the credit bureaus periodically update their files by comparing information to the Death Master File, the credit report will

contain an indicator if the individual has been reported as deceased. And the bank can use this information to decline the application or investigate the circumstances.

Other financial firms such as securities broker/dealers also access the Death Master File as part of the account-opening process.

This screening is typically done by third-party vendors who utilize

Death Master File information.

Consumer lenders regularly use information from credit-reporting agencies to review and adjust the status of existing accounts

as well. It also helps to verify customers seeking to refinance existing mortgages or those who are interested in other services offered

by the financial institution.

Naturally, financial firms have other sources of information that

might indicate that a customer has died and that access to the account should be frozen or terminated. The principal source is family members who called to notify the institution of the death of the

customer and may request changes in the name on the account or

the address where statements are sent.

Lawyers and estate executors are another source of this information.

Whether financial institutions obtain information about deceased

individuals directly from the Death Master File or indirectly from

other subscribers, they have an interest in obtaining information

and data that is accurate and current. Delays between the date on

which an individual dies and the date on which this information

is made available to the public through the Death Master File increases the opportunity for identity thieves to defraud survivors,

beneficiaries and financial institutions.

One of the disadvantages of the current Social Security numbering system is that the agency is not always immediately notified

upon the death of an individual. There appears to be no requirement for local officials to notify the Social Security Administration

when someone dies.

Despite their best intentions, having incomplete and incorrect information makes it very difficult for the Social Security Administration to issue an accurate Death Master File.

Many companies have established internal processes that deal

with fraud and identity theft. In addition, companies work with

30

customers who are victims of identity theft and they also work with

prosecutors to pursue those responsible.

AFSA supports the efforts to encourage the Social Security Administration to obtain death information promptly and report it

more frequently. We also support the continued dialogue between

credit-reporting agencies and financial institutions to facilitate the

flow of the Death Master File information and bureau files.

For example, there may need to be a change in procedures so

that when creditors report account status information to credit-reporting agencies, and this information is placed in a file of a customer about whom the bureau has received death information, the

creditor is made aware of this fact on a timely basis.

We believe that more financial institutions would consider subscribing to the data directly if the information provided was in real

time and more accurate. Whether financial institutions obtain information about deceased individuals directly from the DMF or indirectly from other subscribers, it’s in our interest and that of the

consumer that we obtain correct information.

We’ve hopeful that the Social Security Administration will make

both the procedural and policy changes necessary to ensure the security of our individual unique identifiers, our Social Security numbers.

Thank you.

[The prepared statement of Thomas J. Lehner can be found on

page 107 in the appendix.]

Chairwoman KELLY. Thank you very much and thank you for

limiting your testimony to the time.

We now move to Mr. Thomas Sadaka.

STATEMENT OF THOMAS A. SADAKA, SPECIAL COUNSEL,

OFFICE OF STATEWIDE PROSECUTION, ORLANDO, FL

Mr. SADAKA. Chairwoman Kelly, Chairman Shaw, I truly thank

you for the opportunity to be here today.

For the record, my name is Thomas Sadaka and I am Special

Counsel to the Statewide Prosecutor of Florida for computer crime

and identity theft prosecutions.

As the only representative of State government, as well as State

law enforcement, I think a bit of a background is in order.

Florida ranks third in the Nation currently in identity theft complaints, according to the FTC. As such, we have embarked on a

rather strenuous effort to combat and to curb the epidemic of identity theft.

At the request of Gov. Bush and as a result of the Privacy Technology Task Force, which addressed issues of Social Security abuse,

public records abuse, and identity theft in general, we have

impaneled a State-wide grand jury and have partnered with the

Florida Department of Law Enforcement to focus specifically on

identity theft cases as well as what Florida can do to minimize the

effects of identity theft and the victimization of her citizens.

As such, the use of the Social Security number and the use of

other public records information has become apparent. It is the

constant in all of the crimes that we have currently investigated.

The State of Florida, through my office, was instrumental in

passing an identity theft statute. In 1999, the statute went into efVerDate 11-MAY-2000 13:45 Apr 11, 2002 Jkt 000000 PO 00000 Frm 00036 Fmt 6633 Sfmt 6633 76259.TXT HBANK1 PsN: HBANK1
31

fect, and at that time, we were one of only three States in the Nation to actually criminalize identity theft on the local level.

That is improving. State law enforcement and legislatures are

quick to enact these laws and are quick to operate on them.

As such, the investigation and the prosecution of these cases is

moving along slowly. So while we’ve addressed the after-the-fact

dealings of identity theft, we now need to turn to the issues of prevention of identity theft.

The use of the Social Security number and the use of other public

records information is vitally important to the identity thief, as

well as to the terrorists and others who want to shelter from society who they truly are.

From the law enforcement encounter with the individual on the

street to the airport security checker who is relying on the Stateissued identification card, identity theft has a very broad base, both

public safety concern as well as financial industry concern.

Our public safety issues are much more in the forefront now

since September 11th. But we’ve been addressing these issues over

the past year to try to develop fraud-proof identification as well as

uniform identifiers throughout the country so that we can rely on

information that’s provided from other States.

State driver’s license offices rely heavily on the Social Security

number. Every State requires a Social Security number to be provided. Yet, the States don’t avail themselves of the information

available from the Social Security Administration, nor the other required information that would be available.

Several of the States do check the Master Death File. The Florida legislature commissioned us in July to conduct a study on developing a fraud-proof Florida DL.

So as part of that, I have been researching what other States do

in the issuance process of identification cards.

Of those that do some type of independent verification, only a select number of them interact with the death index on a real-time

basis. And although the Social Security Administration has made

limited availability for online data verification of Social Security,

name and geographical region, there are no States currently that

avail themselves of that ability.

The State of Florida is currently looking into the ability to expand their infrastructure such that they can rely on the information from the Social Security Administration.

There are two issues that face Congress. One is, the Social Security number has become basically our de facto national identifier.

There are two subissues to that.

Do we want that to be the case? And if the Congress’ decision

is that, yes, that is to be the case, then there need to be laws and

initiatives in place that can basically back up the integrity of that

number.

There needs to be the ability of both the financial industry as

well as State and local governments to verify that the Social Security number that’s provided by the citizen or by the customer is

truly that individual’s Social Security number.

We need to confirm that the identify of that person is their true

identity.

32

We rely heavily on breeder documents. There are currently 262

different birth certificates in circulation in the United States.

Those linked with Social Security numbers and passports and documents that are available from other countries create an daunting

task on the part of the administrator, who is issuing this identification card.

The Social Security Administration has within its grasp and

within the other agencies of the Federal Government all of the information that is necessary to both the State and local governments, as well as the financial industry, to confirm the identity of

the person who is before them. That information needs to be

streamlined in its distribution and needs to be made available.

If the other alternative is to not allow the Social Security number

to be used for that purpose, then we face another undaunting task

of developing some other unique identifier, such that all of our citizens can be comfortable that the information that is represented to

financial industries and to State and local governments is correct

and accurate information.

Again, I want to thank you very much for the opportunity to be

here today and I’d be more than willing to answer any questions

at the close of the testimony.

[The prepared statement of Thomas A. Sadaka can be found on

page 110 in the appendix.]

Chairwoman KELLY. Thank you very much.

We now move to Mr. Dugan.

STATEMENT OF JOHN C. DUGAN, PARTNER, COVINGTON &

BURLING, ON BEHALF OF THE FINANCIAL SERVICES

COORDINATING COUNCIL

Mr. DUGAN. Thank you very much, Madam Chairwoman, Mr.

Chairman. It’s a pleasure to be here today.

I’m testifying today on behalf of the Financial Services Coordinating Council, or FSCC, whose members are the American Bankers Association, the American Council of Life Insurers, the American Insurance Association, the Investment Company Institute, and

the Securities Industry Association.

The FSCC represents the largest and most diverse group of financial institutions in the country, consisting of thousands of large

and small banks, insurance companies, investment companies, and

securities firms.

Together, these financial institutions provide financial services to

virtually very household in the United States.

The FSCC continues to believe that the Social Security number

plays a central role in deterring and detecting fraud and identity

theft because Social Security numbers are the best unique identifier that financial institutions can use to determine whether an individual really is who he or she says he or she is.

To that end, the FSCC welcomes the attention the subcommittees are giving to the misuse of Social Security numbers of deceased individuals.

My testimony today makes three fundamental points. First, Social Security numbers are key unique identifiers that are essential

to guard against identity theft.

33

Second, the SSA’s Death Master File is a comprehensive record

of deceased individuals’ Social Security numbers, but delays in updating and disseminating this list can create opportunities for

fraud and identity theft.

Third, because financial institutions ultimately rely, usually indirectly, almost exclusively on the Death Master File to determine

whether a Social Security number belongs to a deceased individual,

the more frequently the DMF is updated and disseminated and the

more accessible that information is, then the more effective the list

will be as a tool to detect and deter fraud and identity theft.

On the first fundamental point, following the lead of the Federal

Government, the financial services industry has used the Social Security number for many decades as a unique identifier for a broad

range of responsible purposes.

For example, our Nation’s remarkably efficient credit-reporting

system relies fundamentally on the Social Security number as a

common identifier to compile disparate information from many different sources into a reliable credit report.

The banking, insurance and securities industries each use SSNs

as unique identifiers for a variety of important regulatory and business transactions, primarily to ensure again that the person with

whom the financial institution is dealing really is that person.

It’s that essential need to verify a person’s identity using a common unique identifier—the Social Security number—that leads financial institutions to rely on the reporting of deceased individual’s

SSNs to guard against identity theft.

We believe there are two keys to preventing the misuse of Social

Security numbers of deceased individuals.

First, the list of such numbers must be kept current. Second, the

current list must be widely accessible and easy to search and crosshatch against a given Social Security number.

Unfortunately, while the current DMF is used to accomplish both

these goals, there’s clearly room for improvement.

On the first point, with respect to the currency of information in

the DMF, there can be significant delays in updating the list.

These are delays caused by the time taken for deaths to be reported to the SSA, delays caused by the entry of inaccurate information, and delays caused by the fact that the SSA releases comprehensive updates on only a monthly basis.

On the second point, the DMF is not provided in a form that is

readily searchable. As a result, because it contains such a large

amount of information, the most practical way to use the list, at

least for financial institutions, is through intermediaries that convert the DMF into a searchable database that can be used by financial institutions and others.

This service by third-party vendors is valuable, but it can be

costly, and cost can thus be a deterrent to the widespread use of

the DMF.

Obviously, if a centralized, searchable database containing the

DMF were widely available at a reasonable price, it’s likely that

the DMF would be used more routinely for a wider variety of authentication checks.

Let me now conclude by talking about financial institutions’ use

of the Death Master File.

34

Although the main purpose of the DMF is to inform the SSA that

an individual has died, it’s also purchased by private information

vendors. Financial institutions ultimately rely on these vendors for

accurate information about the status of individuals’ SSNs.

Therefore, while the accuracy of the DMF is crucial to saving the

SSA money, it’s equally crucial to financial institutions who seek

to prevent fraud and identity theft.

For example, many large banks contract with information vendors to compare the bank’s list of individuals who have been approved for credit cards against the DMF.

Similarly, banks, securities broker/dealers, mutual fund transfer

agents, and insurance companies frequently use these information

vendors to conduct the same kind of search with new account openings, changes in parties on accounts, to determine whether to allow

a client to maintain a margin account, to locate lost shareholders,

and for other purposes.

Simply put, the more current the DMF is, then the more current

the vendor’s data is, and the better financial institutions can be at

uncovering identity theft and other fraud.

And with that, I would conclude. We certainly welcome suggestions for achieving both of the goals I’ve outlined in the testimony

and we’d be happy to work with the subcommittees and their staffs

to facilitate these efforts.

Thank you very much.

[The prepared statement of John C. Dugan can be found on page

113 in the appendix.]

Chairwoman KELLY. Thank you, Mr. Dugan.

We move next to Mr. Rotenberg. Mr. Rotenberg, I’m sorry I did

not have your testimony before we had this hearing. Usually, I like

to have a chance to read it before.

But I’m going to be very interested in what you have to say

today.

STATEMENT OF MARC ROTENBERG, EXECUTIVE DIRECTOR,

ELECTRONIC PRIVACY INFORMATION CENTER; ADJUNCT

PROFESSOR, GEORGETOWN UNIVERSITY LAW CENTER

Mr. ROTENBERG. Well, thank you, Chairwoman Kelly, and Chairman Shaw. I would ask that my statement be entered into the

record and I will briefly summarize the points that I’m going to

make this morning.

I appreciate the opportunity to be here. I’m the Director of the

Electronic Privacy Information Center. We are a public interest research group in Washington concerned with privacy issues relating

to American consumers.

I have also been on the faculty at Georgetown for more than 10

years, where I teach the law of information privacy.

I think it’s critical to make clear at the outset for the purposes

of this hearing that there’s a long-standing effort by Congress and

by the courts to protect the privacy of the Social Security number

in law. And this has been done from the outset out of recognition

that the particular status of this number, which can be used in so

many different contexts, is ripe for misuse and abuse and, as we’ve

seen in the last few years, the growing crime of identity theft.

35

So, for example, Section 7 of the Privacy Act of 1974 makes very

clear in the collection and use of the SSN that Federal agencies

may only use the number for certain statutory purposes.

And I’d like to say at the outset that the efforts of Chairman

Shaw and other Members of the subcommittees to move forward

legislation, H.R. 2036, which would extend similar protections to

the private sector and strengthen as well the protections in the

public sector, is a very important measure that I hope you will

move quickly in this session.

Now the second part of the problem to understand is that the ID

theft problem results from the growing dependence of the Social

Security number as a general form of identification unrelated to

the original purpose, which was of course the management of SSA

benefits.

And if I may, Chairwoman Kelly, to pick up on your opening

statement, I’d like to make a brief observation about this case involving Lahfti Raisi, who is the Algerian who may be responsible,

in fact, for training the hijackers in the great tragedy of September

11th.

Now it has been reported that Raisi took advantage of the Social

Security number of a deceased person in the State of New Jersey,

presumably to obtain access to facilities in other places that he

would not otherwise be able to go.

But it’s not clear, at least from the reports that we have reviewed, that Raisi sought the Social Security number of a deceased

person.

In other words, this may have just been a nine-digit number

pulled from the air that turned out, in fact, to be the number of

a person who was deceased.

And I make this point because it’s critical to understand that in

the area of identity theft, there are many ways to create Social Security numbers that are not one’s own that don’t require access to

a deceased’s SSN.

You can spoof SSNs in a number of different ways. I can look at

a Social Security number and probably determine whether it’s accurate—in fact, a real Social Security number, computer programs

and financial institutions do this on a regular basis.

But my point here is I think we need to understand that it is

the growing dependence on the use of the Social Security number

and whether that number comes from a person who’s deceased or

whether it’s simply made up, is going to be an ongoing problem in

systems of identification going forward.

Now this then relates to my third point about the expanded use

of the Death Master File. And I fully appreciate the interest of the

financial institutions in having more timely, more accurate information on an ongoing basis. So that when they are making these

determinations about whether or not an SSN is the SSN of the person who represents it, they have better information on which to

make that decision.

But in expanding the use of the DMF, I’m concerned also that

it will create new opportunities for misuse and abuse by others,

who will use that information for other purposes. Because, of

course, now you will have access to a very convenient file in elecVerDate 11-MAY-2000 13:45 Apr 11, 2002 Jkt 000000 PO 00000 Frm 00041 Fmt 6633 Sfmt 6633 76259.TXT HBANK1 PsN: HBANK1
36

tronic format that will give the public a great deal of detailed personal information.

And so I think an assessment needs to be done. How do you ensure that that information will be used only by the financial institutions for the appropriate purpose and not by others for ill-intended purpose?

I’d like to conclude, then, with three recommendations.

The first recommendation, having worked on this issue now for

more than 10 years, is to urge you once again to think about systems of identification that are not solely dependent on the Social

Security number. It is the SSN that contributes to ID theft and our

growing use of the SSN leads to more ID theft.

Second, as I suggested at the outset, I think the legislation before the subcommittees is excellent.

And finally, if you do go forward with the proposal to make the

DMF readily available in electronic format, I urge you to create

some mechanism of oversight, some way to evaluate, maybe a year

out, how that information is being used, because it could well be

the case that that file will become a new source of identity theft,

and that could simply compound the tragedy.

Thank you.

[The prepared statement of Marc Rotenberg can be found on

page 126 in the appendix.]

Chairwoman KELLY. Thank you very much.

We now move to Mr. Hendricks.

STATEMENT OF EVAN HENDRICKS, EDITOR AND PUBLISHER,

PRIVACY TIMES

Mr. HENDRICKS. Thank you, Madam Chairwoman, and Mr.

Chairman. My name is Evan Hendricks, Editor and Publisher of

Privacy Times. I’ve been qualified as an expert in identity theft cases by the

Federal courts and I realize I’m the last witness between not only

you and lunch, but the lunch of my son, Daniel, who has accompanied me here today.

Chairwoman KELLY. We welcome your son.

Mr. HENDRICKS. Yes, thank you.

Chairwoman KELLY. Welcome, Daniel.

Mr. HENDRICKS. Thank you. This is an important issue. I’m

grateful to follow my colleague, Marc Rotenberg, because I concur

in his remarks and incorporate them.

What we’ve seen in this terrible tragedy is that not only has

identity theft figured in the use for passport and visa purposes, but

also the terrorists supported themselves by committing identity

theft and credit fraud.

We followed this in my newsletter, Privacy Times, which is in its

21st year; there is an excellent article in the November 4th, Chicago Tribune which summarizes many of the activities they did, including skimming, which is using a machine to swipe a card and

steal all the information and then make a counterfeit card out of

it.

There are two things that fraudsters want in this day and age:

either a Social Security number so that they can do identity theft,

or a credit card number and an expiration date.

37

We also know that the fraudsters are using stolen credit card

numbers to buy people’s Social Security numbers so that then they

can commit more identity theft.

So it’s becoming a vicious circle.

When the World Trade Center tragedy hit, unfortunately, it became somewhat like when there’s a black-out in New York: the

thieves know they can break into buildings because there’s no electronic burglar alarms any more.

And unfortunately, one of the World Trade victim’s friends took

her credit card and went on a credit joyride, and I’m told by my

friends at the Privacy Rights Clearinghouse and the Identity Theft

Resource Center that a plane crash victim was going to be picked

up by a limo driver who had all his information and then went on

to commit identity theft.

As indicated by Congresswoman Hooley’s opening remarks, there

are some really sick people out there and a lot of them are now

gravitating toward identity theft.

I come here to say that, like Mr. Rotenberg, the goal of privacy

laws is to give people control over their personal information. And

some of the gaps and the weaknesses in our current privacy laws

help the fraudsters get control over other people’s information.

One of the fundamental principles of privacy laws is the information collected for one purpose should not be used for another purpose without your knowledge and consent. And this is at the heart

of the Fair Credit Reporting Act, which is one of the first privacy

laws enacted in 1971, amended by Congress in 1996.

It’s a good law and it recognizes in practice that there are other

purposes. And so, the Fair Credit Reporting Act defines permissible

purposes. And it also gives people remedies, private right of action,

penalties.

And I think even my colleague down the table, Mr. Pratt, will

agree, this privacy law has made the credit-reporting industry a

better industry. They do a better job handling data. They have to

be more responsive. And if things go wrong, people have a remedy.

And so I’m also here to dispel the myth because there is really

not much of a conflict between privacy law and security: all of our

existing privacy laws make exceptions for law enforcement, for

health and safety, and for intelligence purposes.

I think if you get into an honest discussion with the investigators, you’ll see that the privacy law has not impeded the investigations here.

But that’s why we look for solutions, as Mr. Rotenberg said, we

need to take advantage of information technology. We need automated exchanges of data.

Just as the Fair Credit Reporting Act defines purposes and gives

people a degree of confidence that data will be used for permissible

purposes, so we need to expand that concept to our larger society,

including automating any sort of a Master Death File that will be

shared with the banks on an instant basis, or with the credit-reporting agencies, too.

I also want to agree with Mr. Rotenberg that we need to have

a national oversight office. Every other western country has an

independent privacy commissioner that answers to the legislative

branch.

38

We need one, too.

In terms of three practical solutions, the first is that, conceptually, people need to be plugged into their credit report. The technology allows for it today, and actually, we’re gravitating toward

this and we need to accelerate it. So if there’s activity on your credit report, you should receive some sort of electronic alert.

This is not that difficult to set up and it would be one of the best

ways to guard against identity theft.

Second of all, though the credit reporting agencies sell a service

where they can do a trace on SSNs, it’s not clear to me that they

do an audit of their own systems to see how many names and addresses are associated with one SSN.

And if they did that simple audit function, they would guard

against some real problems and help clean up the integrity of their

databases.

The final thing I’d like to mention is something that’s called single-use credit card numbers. And Ms. Chairwoman, I heard that

you had your credit card number stolen. I don’t know if it was by

skimming or through a database.

One company that I work with, called Privasys, has developed

these prototype cards. You punch your pin number into the credit

card so it can issue you a single-use number that is only good for

one purchase.

So if later that number is stolen, it’s worthless.

And so, there are solutions that we need in law, in organizational

practice, and in technology.

Thanks very much. I’d be happy to answer any questions.

[The prepared statement of Evan Hendricks can be found on

page 131 in the appendix.]

Chairwoman KELLY. Thank you, Mr. Hendricks. I’m going to ask

just a couple of questions.

Mr. Rotenberg, on page 2 of your statement, I have to say, I was

multi-tasking up here and reading it at the same time.

I find this a fascinating statement. It is the financial services industry’s misplaced reliance on the SSN, lacks verification procedures and aggressive marketing, that are responsible for the financial consequences of identity theft.

I want you to enlarge on that.

Mr. ROTENBERG. Well, my point, Chairwoman, is simply that the

SSN has been moved from the realm of processing Social Security

benefits within the Federal Government and the purpose of tax

identification when it become recognized by Congress for that purpose in 1961, to a generalized identifier across the financial services sector.

Chairwoman KELLY. Yes, sir, I do understand that. My question

is why you are blaming—it appears you’re blaming the financial

service industry’s use and reliance on that Social Security number

for some of the fraud.

As a matter of fact, that integrates with a comment by Mr. Pratt

when he talks about the Gramm-Leach-Bliley effect on the FTC

rules.

I’m wondering if the two of you can tell me—if what my interpretation is is a correct one. Are you saying that the Gramm-LeachVerDate 11-MAY-2000 13:45 Apr 11, 2002 Jkt 000000 PO 00000 Frm 00044 Fmt 6633 Sfmt 6633 76259.TXT HBANK1 PsN: HBANK1
39

Bliley bill has had an effect on the use of the SSN by the financial

services industry that would increase the ability for fraud to exist?

Mr. PRATT. If I may, from our perspective, the point we wanted

to make in the testimony was simply that the Gramm-Leach-Bliley

Act did take into account that there would be a series of exceptions

to a consumer’s choice for how non-public personal information

could be transferred. And one of those exceptions was for purposes

under the Fair Credit Reporting Act.

But the FTC’s interpretation appears to foreclose on a consumer

reporting agency’s ability once they have that information to then

build fraud prevention products that might apply to other exceptions within the GLB 502[e] exceptions.

And clearly, to foreclose on our ability to build a fraud prevention

or a verification product which would use identifying information

outside of GLB and outside of the Fair Credit Reporting Act.

So, in that case, the law seems to have tightened down the

screws a little too tightly on some information that we might be

able to use.

Chairwoman KELLY. Do you agree with that, Mr. Rotenberg?

Anyone is welcome to join in, but I want to ask that specifically of

Mr. Rotenberg.

Mr. ROTENBERG. Well, I don’t agree that one of the consequences

of GLB was to make the Social Security number more widely available to financial institutions. I understand the point that it in some

ways may restrict certain verification procedures.

But I do want to be clear about the point in my statement here.

Clearly, the theft itself is not committed by the institutions. That’s

not what I said.

What I said, that the use of the SSN to link financial records

across institutions means that when the theft has occurred, the

damages are amplified.

And so, when I said earlier that we need to think about systems

of identification that are not so dependent on the SSN, it is very

much based on the experience that victims of ID theft have had.

When their Social Security numbers get out, then they lose control

of their bank account, their credit account, and the other accounts

that they may have with financial institutions.

Mr. HENDRICKS. Madam Chairwoman, can I respond to that?

Chairwoman KELLY. Mr. Hendricks.

Mr. HENDRICKS. I’ll give you one example.

Identity thieves are in the business of getting credit fraudulently.

They’re able to do that because they apply for credit in somebody

else’s name and Social Security number.

The first problem is the credit-reporting agencies are too liberal

in disclosing the innocent victim’s credit report in response to an

application made by an imposter. In many of these cases, I’ve seen

that the city is different, the address is different, and the spelling

is different. Yet, they err on the side of maximum disclosure from

the credit-reporting agency to the credit granter, and that’s the

first problem.

The second problem is that, if the imposter simply has your Social Security number, I’ve seen cases—if you write these two names

down—Myra Coleman and Maria Gaten. If you have the same Social Security number, their algorithms work so, since there’s an M

40

and an R and another letter in the first name, that it’s similar

enough to go ahead and disclose the information, even though the

names are completely different.

So there are some real application problems that were built from

earlier days when they were thinking—well, women get married,

they change their last name. People move a lot. As opposed to now,

where we have a clear threat of identity theft and they need to update their rules for disclosing consumers’ credit reports.

Mr. DUGAN. Madam Chairwoman, I’d just like to make two

points.

Number one, we think the Gramm-Leach-Bliley Act, in fact,

makes the misuse of Social Security numbers much more unlikely

because it gives individuals more control over the ability of a financial institution to share that information with any non-affiliated

third party, number one.

And number two, to the extent that information is provided for

permissible purposes under the Gramm-Leach-Bliley Act, like fraud

prevention, then the law specifically prohibits the recipient from

using it for any other purpose.

So we think that that goes to that point particularly.

The second point I wanted to make was, it’s nice to say that it’s

easy to steal a Social Security number, and, therefore, it’s easy to

steal someone’s identity. But think what it would be like if you did

not have a Social Security number used at all for identification

purposes.

What Mr. Sadaka was saying earlier, you have to have some way

to have a common, unique identifier in many circumstances, which

is precisely what financial institutions use it for, to make sure that

they know you are the Madam Sue Kelly that comes in the door

and not a different Sue Kelly.

There have to be ways to link that up. And the use of the Social

Security number is the way we do that. Without it, and with improper restrictions on its use, it would increase the occurrence of

identity theft, not decrease it.

Chairwoman KELLY. Thank you very much. I have just one follow-up for Mr. Pratt.

What percent of your membership gets the DMF?

Mr. PRATT. I actually don’t have a good answer for you, but I’ll

be happy to follow up.

Chairwoman KELLY. I wish you would, please.

Mr. PRATT. And I think your question is in terms of the total customer base, how many customers are using the DMF product that

our members produce.

Is that it?

Chairwoman KELLY. I’m going to withhold any of my further

questions because I’ve run out of time, and go to Chairman Shaw.

Chairman SHAW. I’d like to direct my question to Mr. Pratt

again.

Our subcommittee has heard from many victims of identity theft

over the last 2 years and there are stories that raise some very

troubling issues pertaining to harassment and other matters.

First of all, fraudulent accounts were opened using their Social

Security numbers, even though all of the information on the application was actually incorrect, including their names, addresses, and

41

even their birthdays. And the Social Security number was the only

piece of information that was correct on these applications.

A second troubling issue is that credit-reporting agencies verified

this incorrect information. Verifications of a name, address, place

of employment, age, or spouse’s name were not questioned. If the

Social Security number matched up, the information was verified

and the fraudulent application was approved.

First of all, can you explain how these fraudulent applications

could have been verified or accepted?

Mr. PRATT. Well, let me go to, if I could break out your question

into some parts.

Chairman SHAW. Maybe you could start just by telling us, what

is the process and what are the checkpoints?

Mr. PRATT. The checkpoints that we use are the Social Security

number, the name, the address, and, when available, we may be

also able to cross-check previous address. Those would be the principle cross-checks.

Clearly, where we have 3 million consumers each year with last

names changing, our cross-checks try to accommodate the fact that

marriage and divorce occur and names can change in cycle.

Date of birth, some of the other identifying elements that you’ve

indicated might have been on the application are not transmitted

to the consumer reporting systems.

These may be issues that are addressed today differently than

they may have been previously, but the cross-checks we use today

are Social Security number, name and address.

In terms of why an application was approved, I’m not trying to

put the monkey on someone’s else back, but of course I can’t tell

you why the application was approved.

We transmit the information. We show the lender what information we believe in our file matches—— Chairman SHAW. Do you have any indication of where the system failed in this event?

Mr. PRATT. Well, no, sir, I really don’t, because I don’t have the

facts in front of me specific to those particular situations.

I’d have to look at those, I suppose, to better understand where

the failure occurred.

Chairman SHAW. Let me ask the question of liability because,

from your previous answer, it sounds like it’s nothing but negligence on the part of whoever is putting this information together.

Under the current law, are creditors and credit-reporting agencies accountable when their negligence contributes to identity theft

and to other Social Security number misuses?

Mr. PRATT. Well, I have to resist the industry being characterized as negligent under the Fair Credit Reporting Act.

Chairman SHAW. I’m not characterizing the industry. I’m just

saying, in the event of negligence, are they liable?

That’s a simple, straightforward question.

Mr. PRATT. The answer to the question would be, under the Fair

Credit Reporting Act, we’re liable for being accurate. And therefore,

if we’re not accurate and a lender in turn is also liable as a user

and as a furnisher under the same Fair Credit Reporting Act.

Chairman SHAW. So it’s your testimony that they would be liable

in the cases of negligence.

42

Mr. PRATT. There is negligence, there are willful and negligent

standards under the Fair Credit Reporting Act and there are liabilities associated with the accuracy of the information and the use

of the information.

Chairman SHAW. I’ll have to go to the Act and see exactly what

it says. What does it say—willful negligence, or do you know?

Mr. PRATT. There are two standards of civil liability, for example,

and then of course there’s administrative enforcement through the

Federal Trade Commission and other functional regulators under

the Act.

But the civil liability standards are willful and negligence.

Chairman SHAW. Ordinary negligence.

Mr. PRATT. Yes.

Chairman SHAW. And that makes them liable.

Mr. PRATT. Those are two standards of liability depending on the

fact pattern, depending on how the suit is brought, against any one

of the parties that is regulated under the Act.

Chairman SHAW. Do you think the creditors and credit-reporting

agencies should be liable for these kinds of mistakes?

Mr. PRATT. Well, I think we’re on the same side of this along

with you. We don’t want these mistakes to happen and we want

accurate information in our files, sir, really.

Chairman SHAW. If we weren’t on the same side, I wouldn’t be

here listening to you.

Mr. PRATT. I appreciate that.

Chairman SHAW. We’re trying to figure this thing out so that we

don’t disrupt a system of a national identifier that, for good reason

or bad reason, has been in place now for a number of years.

But we do know that there’s been serious misuse. We do know

that this is the fastest-growing crime in the country today.

And I personally believe and I think many other people personally believe, and I think Mr. Sadaka would agree with me on this—

Mr. Sadaka, I think you agree that failure to do something is going

to create a snowball effect and that this thing will be totally out

of control after a reasonable period of time.

Do you agree with that?

Mr. SADAKA. Yes, sir, I do.

Chairman SHAW. Thank you. I yield back my time.

Chairwoman KELLY. Thank you.

We go to Mr. Hooley.

Ms. HOOLEY. Thank you, Just a couple of quick questions.

Anyone from the industry side can answer the first question. And

that is, I understand the need for the industry to have this master

list, so you can flag your files to prevent compromise by an identity

thief.

What else do you do with the information? I mean, you use it to

flag your files. What else do you do with the information?

Any one of you.

Mr. LEHNER. Well, as I mentioned in my testimony, it’s oftentimes used to verify information on existing accounts, if people

change the status of their account for some of our mortgage lenders. If a customer is refinancing their home, they’re changing credit

products within a company.

43

Usually, that information is asked as a means to verify that they

are who they say they are.

Mr. PRATT. Our members as subscribers are using it principally

for fraud prevention.

Ms. HOOLEY. That’s what I assume, all of you are using it for

fraud prevention.

Mr. DUGAN. There are other reasons to use the information: to

track down or locate lost shareholders, or to review loan applications. But principally, it’s to make sure that the person is who they

say they are.

Ms. HOOLEY. Would you have any opposition to having it in law

that the information is solely used to flag the file of a deceased individual or for fraud prevention?

Mr. PRATT. Like all good trade associations, I’d have to go back

and talk to the members, I guess, and find out whether there’s anything out there that I’m just not aware of here today.

Ms. HOOLEY. OK. By the way, Mr. Pratt, thank you very much

for clearing up the file of Sean. I really appreciate your doing that.

Mr. PRATT. Thank you.

Ms. HOOLEY. For either Evan or Marc Rotenberg, are you aware

of any instances where information from the Death Master File has

been intercepted by identity thieves?

Are you aware of that at all?

Mr. HENDRICKS. No, not per se. The cases that I’ve heard of, the

identity is just doing straight to the local government agency and

getting information off death certificates. I’ve heard about cases

like that and I’ve asked for more documentation of that.

Ms. HOOLEY. Do you think we should use it solely for flagging

the files, using the Death Master list solely for flagging the files

or for fraud?

Mr. HENDRICKS. Yes. You create an automated information exchange here and you specify what those purposes are and you create penalties for people that violate that and remedies for individuals whose privacy is violated.

I think that’s the way to go. And I think if you look at the kind

of privilege that goes between a lawyer and a client or a doctor and

a patient, the privacy privilege is not so people can hide or keep

data secret. It’s to allow for the open exchange of information for

the purposes you need—better health care, better legal advice.

And I want to take that concept and expand it to everything in

our society. So privacy is protected within certain spheres, but that

allows for open data exchange within the approves spheres.

Ms. HOOLEY. Thank you. That’s all the questions I have.

Chairwoman KELLY. Thank you very much. I have a couple of

other questions. One for all of you as panel members.

I’d like to know if you can commit to participating on a task force

with the SSA to solve this problem.

I think that if we put together—if there’s a task force of the SSA,

the GAO, the Commerce Department, and all of you, we could probably get to the root of the problem and get it solved much more

quickly than every agency acting without consulting the others.

So I’d like to ask for a commitment from all of you to being a

part of that task force. Can you commit to that?

44

Mr. DUGAN. Madam Chairwoman, we’d be delighted to commit to

do that.

Chairwoman KELLY. Am I hearing that from all of you?

Mr. PRATT. Our testimony already indicates we support doing

that.

Mr. SADAKA. Absolutely, yes.

Mr. LEHNER. Absolutely.

Mr. HENDRICKS. Yes.

Mr. ROTENBERG. Yes.

Mr. SADAKA. We’d be very willing to commit as well.

Chairwoman KELLY. I thank you very much.

One final thing for you, Mr. Hendricks. Your son is going to have

to wait for lunch for one second.

You said in your testimony that there was an independent national office to oversee and enforce the privacy law, was a recommendation of the U.S. privacy protection study commission in

1976.

I think it’s time we consider something like that and I hope that

you will consider that within the framework of this task force.

That being so, then I would like to, if there’s no more questions,

the Chair notes that some Members may have additional questions

for this panel that they may wish to submit in writing.

So without objection, the hearing record is going to remain open

for 30 days for Members to submit written questions to these witnesses and to place their responses in the record.

On behalf of the subcommittees, I want to thank all of the witnesses for taking the time to be here today. I believe it’s been a

very productive hearing that has highlighted a problem that can be

solved with regards to identity theft.

This panel is excused with our appreciation. I want to thank

Chairman Shaw and his staff and other Members and all of their

assistants, and my staff, for making the hearing possible.

The hearing is adjourned.

[Whereupon, at 12:25 p.m., the hearing was adjourned.]

(45)

A P P E N D I X

November 8, 2001

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142