PRISON WORK

PROGRAMS

Inmates’ Access to

Personal Information

United States General Accounting Office

GAO Report to the Honorable Charles F. Bass

House of Representatives

August 1999

GAO/GGD-99-146

United States General Accounting Office General Government Division

Washington, D.C. 20548

Page 1 GAO/GGD-99-146 Inmates’ Access to Personal Information

B-280467

August 18, 1999

The Honorable Charles F. Bass

House of Representatives

Dear Mr. Bass:

This report responds to your request that we obtain information on

correctional industry work programs1

 under the federal Bureau of Prisons

(BOP) and in state prison systems2

 that allow inmates access to personal

information. For this assignment, we defined personal information as

information that can be used to threaten an individual’s physical,

psychological, or financial well-being. This information would include (1)

credit card numbers (personal or business); (2) Social Security numbers;

or (3) names in combination with physical descriptions or financial,

medical, or motor vehicle information. You also were interested in

information on inmates who had access to only names and addresses or

telephone numbers.3

 This type of information tends to be more readily

available to the public, such as through telephone books, than personal

information.

More specifically, you asked for information on

• the extent to which inmates in the BOP and state prison systems had

access to personal information through correctional industry work

programs;

• prison safeguards and procedures, statutes and regulations, and proposed

legislation that addressed correctional industry work programs involving

personal information;

• the extent to which contracts that provided inmates access to personal

information contributed to BOP’s and states’ correctional industry income;

• the extent to which BOP and state prison inmates had access to only

names and addresses or telephone numbers through correctional industry

work programs; and

 

1

For our study, we defined correctional industry work programs as work programs that produce

products and services for sale to government agencies and/or to the private sector.

2

For this report, when we refer to state or states, we are including the District of Columbia.

3

When we use the phrase “names and addresses or telephone numbers” we are referring to names and

one or more of the following: work or home addresses or telephone numbers, names of employers, or

job titles but no other item that we defined as personal information.
B-280467

Page 2 GAO/GGD-99-146 Inmates’ Access to Personal Information

• incidents of inmates misusing information obtained through correctional

industry work programs, including how safeguards failed and what, if any,

changes were made as a result of the incidents.

To answer these questions, we surveyed BOP and state correctional

industry officials by mail.4

 Although questionnaire respondents provided us

with data on the number of inmates with access to personal information or

only names and addresses or telephone numbers, it should be noted that

some officials told us that these data were estimates. We also contacted

states’ attorneys general and the special counsel for the District of

Columbia, interviewed officials from federal investigative agencies, and

conducted literature and database searches.

On September 30, 1998, of approximately 1.2 million5

 inmates, about 1,4006

in BOP and 19 state prison systems had access to personal information

through correctional industry work programs, based on the questionnaire

responses from correctional industry officials.

• Of these 1,400 inmates, about 1,100 had access to names and dates of birth

or Social Security numbers. These inmates were performing work, such as

data entry, for the federal, state, or local governments.

• BOP and all of the 19 states reported using a variety of safeguards to

prevent inmates from misusing the information. The safeguards cited by

the largest number of states were close supervision; selective hiring (e.g.,

excluding inmates convicted of sex offenses or fraud); confidentiality

agreements;7

 and security checks at the exits from the work areas. The

federal government and seven states in which inmates had access to

personal information were identified as having either enacted statutes or

had bills pending that related to limiting which inmates could perform

work involving personal information.

 

4

Representatives from Arizona’s state-run facilities, Ohio, and Tennessee declined to respond to our

questionnaire. The representatives from Arizona and Ohio told us that they would not respond due to

limited staffing. The Ohio representative informed us that inmates involved in data entry work

programs did not have access to credit card numbers or Social Security numbers. Arizona provided

information on work programs in privately run facilities, which we included in our analyses.

5

The latest date for which data were available from the Bureau of Justice Statistics on the number of

inmates in custody in federal and state correctional facilities was June 30, 1998. See Prison and Jail

Inmates at Midyear 1998, Bureau of Justice Statistics, March 1999, NCJ 173414.

6

This number is an estimate because, as noted previously, state-run facilities in Arizona, Ohio, and

Tennessee declined to respond to our survey.

7

Confidentiality agreements are agreements signed by the inmates not to release information obtained

through a work program.

Results in Brief
B-280467

Page 3 GAO/GGD-99-146 Inmates’ Access to Personal Information

• Less than one-hundredth of 1 percent of BOP’s and no more than 22

percent of any state’s fiscal year 1998 gross correctional industry income

was generated from contracts that resulted in inmates having access to

personal information. Six states reported that less than 1 percent of their

gross correctional industry income was earned from these contracts.

In addition, about 5,500 inmates in BOP and 31 state prison systems had

access to only names and addresses or telephone numbers through

correctional industry work program contracts or support work.8

 The three

safeguards that the largest number of states and BOP reported using were

similar to those used when inmates had access to personal information—

close supervision, security checks at the exits from the work areas, and

selective hiring.

Questionnaire respondents described nine incidents in which inmates

misused personal information or names and addresses or telephone

numbers obtained from correctional industry work programs. In four of

the nine incidents, inmates removed information from the work areas,

either physically or by memorization. In five of the incidents, the work

programs were discontinued.

In 1995, the latest year for which complete data were available, about 65

percent (or about 647,000) of the inmates in custody in federal and state

places of confinement9

 participated in 1 or more types of work programs.10

These work programs included prison industries (e.g., involving the

manufacture of license plates, wood products, and textiles); facility

support services (e.g., doing office and administrative work, food service,

laundry, and building maintenance); farming/agriculture; and public works

assignments (i.e., inmates working outside the facility on road, park, or

other public maintenance work). Data entry was the type of work that

most often allowed inmates access to personal information.

 

8

We defined a contract as a formal or informal agreement (including purchase orders) to produce a

specific product or perform a specific service. By support work, we mean inmates who were not

associated with a specific correctional industry work program contract but who had access to personal

information by performing tasks, such as order taking, order fulfillment, manufacturing or customer

support, complaint resolution, or shipping, that supported the industry work program operations.

9

Places of confinement included prisons; prison hospitals; prison farms; boot camps; and centers for

reception, classification, or alcohol/drug treatment.

10The latest date for which these data were available from the Bureau of Justice Statistics was June 30,

1995. See Census of State and Federal Correctional Facilities, 1995, Bureau of Justice Statistics, August

1997, NCJ-164266.

Background
B-280467

Page 4 GAO/GGD-99-146 Inmates’ Access to Personal Information

One mission of the Federal Prison Industries (FPI), a BOP component, is

to employ and provide skills training to the greatest practicable number of

inmates and to produce market priced quality goods in a self-sustaining

manner that minimizes potential impact on private business and labor. FPI

markets about 150 types of products and services to federal agencies.

Some states had similar programs and provisions. For example, Alabama

generally requires state departments, institutions, and political

subdivisions to purchase their products and services from Alabama

Correctional Industries, to the extent to which they can be supplied. In

addition, only those entities can purchase Correctional Industries

products. According to the Alabama Correctional Industries purpose

statement, it exists primarily for the purpose of providing a work-training

program for inmates of the Department of Corrections. Another important

purpose is to assist all state departments, institutions, and political subdivisions of the State to secure their requirements to the greatest possible

extent.

To obtain information on the assignment objectives, we surveyed BOP and

state correctional industry officials by mail. We asked the officials to

answer questions on correctional industry work programs in federal, state,

and privately run facilities for which the federal or state government or

state-appointed organizations had oversight. We limited the questionnaire

to work programs associated with secure, confined facilities, including

youth authorities but excluding programs associated with prerelease

facilities and city and county jails. We asked

• if on September 30, 1998, they had inmates who, through performing (1)

work on correctional industry work program contracts that were either in

progress or were agreed to but the work had not been started or (2)

support work for the industry work program operations, had access to

personal information or only names and addresses or telephone numbers;

• what prison procedures, statutes, regulations, pending legislation, or other

guidelines provided guidance on (1) limiting which inmates perform work

involving access to personal information and (2) preventing personal

information from being retained by inmates or being transferred to

unauthorized inmates or other persons;

• what the total gross income was for the correctional industry work

program and the income generated by those contracts that resulted in

inmates having access to personal information in the most recently

completed fiscal year; and

• what incidents of misuse occurred as a result of inmates having access to

the information through correctional industry work programs.

Scope and

Methodology
B-280467

Page 5 GAO/GGD-99-146 Inmates’ Access to Personal Information

We received responses from BOP, 47 states, and the District of Columbia.

We did not independently verify the information provided by questionnaire

respondents. We did, however, compare the questionnaire responses to the

results of our current literature and legal database searches. After we

consolidated the data received from the questionnaire respondents in the

tables included in this report, we faxed the compiled information to all of

the questionnaire respondents for confirmation of the accuracy of the data

displayed and made corrections as necessary.

We interviewed BOP and state officials. We also contacted states’

attorneys general to obtain information on (1) incidents of misuse of which

they were aware and (2) state statutes or regulations, pending legislation,

or other guidelines that provided guidance on work programs involving

personal information.

We requested comments on a draft of this report from BOP and the

Correctional Industries Association, Inc. They provided written comments

that are summarized at the end of this report and are reprinted in

appendixes X and XI.

We performed our work from June 1998 to June 1999 in accordance with

generally accepted government auditing standards. Appendix I provides

more details on our objectives, scope, and methodology.

On September 30, 1998, about 1,400 inmates in BOP and 19 state prison

systems had access to personal information through correctional industry

work programs, according to the questionnaire respondents. This number

accounts for (1) about one-tenth of 1 percent of all inmates in custody as

of June 30, 1998, (or approximately 1.2 million) and (2) about 2 percent of

all inmates participating in correctional industry work programs

(approximately 61,500). Almost all of the inmates who had access to

personal information were being held in federal or state-run facilities

(1,332 inmates) as opposed to privately run facilities (25 inmates).

The number of inmates with access to personal information in each of the

19 states ranged from 6 in New Jersey to 426 in California. The types of

information to which the largest number of inmates had access were (1)

names and dates of birth or (2) Social Security numbers.11 About 30

 

11The numbers of inmates having access to specific types of personal information are the maximum

number that would have had access to the information. Some inmates worked on more than one

contract. Also, we asked respondents for the number of inmates on each contract and the types of

information to which inmates had access. However, each inmate may not have had access to all the

types of personal information involved in a contract.

Extent to Which

Inmates Had Access to

Personal Information
B-280467

Page 6 GAO/GGD-99-146 Inmates’ Access to Personal Information

percent of the inmates had access to names and (1) drivers’ license

numbers or (2) vehicle makes and models. Appendix II shows the number

of inmates in BOP and individual state prison systems that had access to

personal information on September 30, 1998, and the types of information

to which they had access.

Most of the inmates who had access to personal information were

performing work for federal, state, or local governments (93 percent) as

opposed to private sector companies (7 percent). Over half of the inmates

with access to personal information were involved in data entry work.

Another about 25 percent of the inmates were duplicating or scanning

documents. Types of information processed in these work programs

included

• medical records;

• state, county, or local licenses;

• automobile registrations;

• unemployment records;

• student enrollment data; and

• accident reports.

The length of time the contracts that resulted in inmates having access to

personal information had been in effect ranged from less than 1 year to 19

years. About 1 quarter of the contracts had been in place from 10 to 19

years; the remainder were more recent. The reasons BOP and states most

commonly identified for selecting the contracts that resulted in inmates

having access to personal information were the contracts

• provided valuable job skills training,

• satisfied a need or demand for a service,

• were needed to provide work for more inmates,

• were profitable, and

• provided work that was relatively easy for training inmates.

Questionnaire respondents from 11 states said they planned to add and/or

expand existing correctional industry work programs that allow inmates

access to personal information. Respondents from 29 states said they did

not plan to add or expand existing work programs that would allow

inmates access to personal information, and respondents from 8 states

said they did not know whether their states had plans to add and/or

expand existing correctional industry work programs that would allow

inmates access to personal information.
B-280467

Page 7 GAO/GGD-99-146 Inmates’ Access to Personal Information

In response to our survey, 29 states indicated that inmates did not have

access to personal information on September 30, 1998. The more

commonly stated reasons were that the opportunity had not presented

itself, the prisons prohibited such work programs, and public opinion

limited the feasibility of implementing such work programs.

BOP and each state that had work programs in which inmates had access

to personal information reported that they had in place a variety of

safeguards to prevent inmates from misusing personal information. In

addition, BOP and most of the states in which inmates had access to

personal information reported that they had prison procedures that limited

which inmates could perform work that would give them access to

personal information. The federal government and seven states in which

inmates had access to personal information were identified as having

either enacted statutes or had bills pending that related to limiting which

inmates could perform work involving personal information.

The safeguards most frequently reported as being used when inmates had

access to personal information were close supervision; selective hiring

(e.g., excluding inmates convicted of sex offenses or fraud); confidentiality

agreements; and security checks at the work area exits. Other commonly

used safeguards included security checks at the work area entrances, no

photocopy machines in the work area, and monitored telephone calls.

Appendix III provides additional information on the safeguards cited by

questionnaire respondents.

BOP and most of the 19 states in which inmates had access to personal

information reported that they had prison procedures that placed

limitations on which inmates could perform work that would give them

access to personal information. Questionnaire respondents from BOP and

18 states said that they screened inmates before hiring them for work

programs involving personal information. For example, one state

respondent said that inmates who were convicted of rape or who have life

sentences were ineligible to work on contracts where they would have

access to personal information. In addition, in the course of our work,

statutes or proposed legislation related to this issue were identified in

seven of the states as well as the federal government in which inmates had

access to personal information. A brief summary of these provisions is

provided in appendix IV, table IV.1.

Further, six states were identified in which inmates did not have access to

personal information that had enacted statutes or introduced legislation

Safeguards Used When

Inmates Had Access to

Personal Information
B-280467

Page 8 GAO/GGD-99-146 Inmates’ Access to Personal Information

that related to this issue. For more information on these statutes and

pending bills, see appendix IV, table IV.2.

Less than one-hundredth of 1 percent of the BOP’s annual gross

correctional industry income of $568 million was generated from its

contract that allowed inmates access to personal information. For those

states in which inmates had access to personal information, no more than

22 percent of any state’s gross fiscal year 1998 correctional industry

income was generated from these contracts; six states reported that less

than 1 percent of their gross correctional industry income was earned from

these contracts. In total, these states grossed about $18 million in 1998

from correctional industry work program contracts that allowed inmates

access to personal information, compared to an annual gross correctional

industry income of about $515 million. Appendix V provides information

on the income generated from these contracts.

About 5,500 inmates, in BOP and 31 state prison systems, had access to

only names and addresses or telephone numbers through correctional

industry work programs. Over half of these inmates were in the custody of

BOP. Appendix VI presents these data by BOP and state. The types of work

inmates were performing in the largest number of states in which they had

this access were order fulfillment, data entry, shipping, and printing. For

additional information on the types of work performed by inmates with

access to only names and addresses or telephone numbers, see appendix

VII.

The safeguards that BOP and most states reported using when inmates had

access to only names and addresses or telephone numbers were similar to

those reported being used when inmates had access to personal

information. The most commonly used safeguards reported by states

included close supervision while working, security checks at the exits

from the work areas, selective hiring, and security checks at the entrances

to the work areas. For additional information on safeguards that BOP and

states used when inmates had access to only names and addresses or

telephone numbers, see appendix VIII.

Questionnaire respondents from eight states reported a total of nine

incidents in which inmates misused personal information or names and

addresses or telephone numbers that they obtained from a correctional

industry work program. We defined misuse of information as any action

that threatened or caused injury to the physical, psychological, or financial

well-being of any member of the public. Each of these incidents was

associated with a different contract. Six of the incidents involved inmates

Income Generated

From Contracts That

Allowed Inmates

Access to Personal

Information

Extent to Which

Inmates Had Access to

Only Names and

Addresses or

Telephone Numbers

Incidents of Inmates

Misusing Personal

Information or Names

and Addresses or

Telephone Numbers
B-280467

Page 9 GAO/GGD-99-146 Inmates’ Access to Personal Information

contacting individuals identified through a work program by telephone or

by mail (in one of these instances, the inmate in the work program passed

information on an individual to another inmate, who then contacted the

individual). Two incidents involved inmates using credit card numbers that

they obtained through participating in a work program. The other incident

involved two inmates’ attempts to smuggle copies of documents out of the

prison through the U.S. mail.

Five of the contracts related to these incidents were terminated after the

incident occurred. In three of the four other incidents, the prison

responded by either adding new safeguards or reinforcing existing

safeguards used on the contract. In the remaining incident, the prison’s

procedures remained the same. For more information on these incidents,

see appendix IX.

Questionnaire respondents also provided information on four additional

incidents that did not meet the previously described criteria for misuse of

personal information. On the basis of one or more of the following

reasons, these four incidents were not included in appendix IX: no

reported injury, a court finding of no wrongdoing, or termination of the

inmate from the work program on the basis of an allegation or suspected

wrongdoing. These incidents, however, resulted in some type of program

change. The types of program changes ranged from adding or reinforcing

policies and safeguards to program termination. Briefly, these incidents, as

reported by the respondents, consisted of the following:

• An inmate was processing accident reports in a data entry work program.

He told another inmate, not in the work program, about an individual

involved in one of the accident reports he processed. The other inmate

contacted the individual involved in the accident. The questionnaire

respondent reported that nobody was harmed, safeguards did not fail, and

no sanctions were taken. After this incident, the state reportedly

reinforced its policies and safeguards associated with this contract.

• An inmate working in a data entry work program saw, reportedly by

accident, a state document that had information about one of his family

members. He spoke with another member of his family about the

information he saw. A member of his family filed a lawsuit claiming that

the inmate should not have had access to this information. The

questionnaire respondent reported that the case was dismissed because

the information was covered by an open record regulation whereby birth

records are considered to be public records. The state, however, canceled

the contract for processing this type of information.
B-280467

Page 10 GAO/GGD-99-146 Inmates’ Access to Personal Information

• An inmate working in a telemarketing work program was accused of

harassing a customer. The inmate was terminated and transferred to

maximum security on the basis of the allegation alone. The state

reportedly implemented additional safeguards after the alleged incident

was reported.

• An inmate wrote a letter to an individual, and it was suspected that the

inmate obtained the individual’s name and address through the work

program. According to the survey response, the inmate was disciplined

and terminated from the work program, and a measure providing for the

closer monitoring of inmates was instituted.

In commenting on our report, BOP concurred with our report with one

exception. BOP noted that since our survey, it changed its procedures, and

no inmates in the BOP prison system have access to personal information.

Since our methodology was to report on the number of inmates who had

access to personal information on September 30, 1998, we did not

eliminate the 25 BOP inmates who we reported as having access to

personal information. (See app. X.)

The Correctional Industries Association, Inc., in its comments said that our

report was fair and thorough and presented the facts objectively. However,

it took two exceptions with the report. First, the Association said that the

information on inmates’ access to personal information is presented

largely out of context. We disagree. Our draft report said that of

approximately 1.2 million inmates, about 1,400 in BOP and 19 state prison

systems had access to personal information through correctional industry

work programs. We noted that less than one-hundredth of 1 percent of

BOP’s and no more than 22 percent of any state’s fiscal year 1998 gross

correctional industry income was generated from contracts that resulted in

inmates having access to personal information. Further, we pointed out

that about a quarter of the contracts that resulted in inmates having access

to personal information had been in place from 10 to 19 years.

Second, the Association said that a benchmark is needed against which the

success or failure of correctional industries to control access issues can be

measured. We did not judge whether the correctional industries have

succeeded or failed in their attempt to prevent the misuse of personal

information to which inmates had access as the result of work programs

because we are not aware of criteria by which to make such a judgment.

Agency Comments and

Our Evaluation
B-280467

Page 11 GAO/GGD-99-146 Inmates’ Access to Personal Information

However, given that the inmates with access to personal information are

individuals who have been incarcerated for crimes, and given that the

institutional settings permit work program officials to exercise close

scrutiny over the inmates and work places, breaches of security and

misuses of personal information are a cause for concern. (See app. XI.)

As agreed, unless you announce the contents of this report earlier, we plan

no further distribution until 30 days from the date of this letter. At that

time, we will send copies of this report to the Honorable Janet Reno,

Attorney General; the Honorable Kathleen Hawk Sawyer, Director, BOP;

Ms. Gwyn Smith Ingley, Executive Director, Correctional Industries

Association, Inc.; the states that responded to our survey; and other

interested parties. Copies will also be made available to others upon

request.

The major contributors to this report are acknowledged in appendix XII. If

you or your staff have any questions about the information in this report,

please contact me or Brenda Bridges on (202) 512-8777.

Sincerely yours,

Richard M. Stana

Associate Director, Administration

 of Justice Issues
Page 12 GAO/GGD-99-146 Inmates’ Access to Personal Information

Contents

1 Letter

Appendix I: Objectives, Scope, and Methodology 14

Appendix II: Number of Inmates With Access to Personal

Information Through Work Programs

18

Appendix III: Safeguards Used in Work Programs in

Which Inmates Had Access to Personal Information

26

Appendix IV: Procedures, Statutes, and Pending Bills 31

Appendix V: Income From Work Programs That Allowed

Inmates Access to Personal Information, Fiscal Year

1998

35

Appendix VI: Number of Inmates With Access to Only

Names and Addresses Through Work Programs

38

Appendix VII: Type of Work Performed in Work

Programs in Which Inmates Had Access to Only Names

and Addresses

40

Appendix VIII: Safeguards Used in Work Programs in

Which Inmates Had Access to Only Names and

Addresses

44

Appendix IX: Incidents of Misuse of Personal Information

by Inmates

48

Appendix X: Comments From the Bureau of Prisons 52

Appendix XI: Comments From the Correctional

Industries Association, Inc.

53

Appendix XII: GAO Contacts and Staff Acknowledgments 54

Appendixes

Table IV.1: Federal and State Prison Procedures,

Statutes, and Pending Bills That Address Limitations

on Inmates Who Perform Work Involving Personal

Information Where Inmates Had Access to Personal

Information on September 30, 1998

31

Table IV.2: Statutes and Pending Bills That Address Work

Programs Involving Access to Personal Information in

States Where Questionnaire Respondents Reported

That Inmates Did Not Have Access to Personal

Information on September 30, 1998

34

Tables
Contents

Page 13 GAO/GGD-99-146 Inmates’ Access to Personal Information

Abbreviations

BOP Bureau of Prisons

FPI Federal Prison Industries
Appendix I

Objectives, Scope, and Methodology

Page 14 GAO/GGD-99-146 Inmates’ Access to Personal Information

The objectives of our study were to

• determine the extent to which inmates in the BOP and state prison

systems had access to personal information through correctional industry

work programs;

• identify prison safeguards and procedures, statutes and regulations, and

proposed legislation that addressed correctional industry work programs

involving personal information;

• determine the extent to which contracts that provided inmates access to

personal information contributed to BOP’s and states’ correctional

industry income;

• determine the extent to which inmates in the BOP and state prison

systems had access to only names and addresses or telephone numbers

through correctional industry work programs; and

• identify incidents of inmates misusing information obtained through a

correctional industry work program, including how safeguards failed and

what, if any, changes were made as a result of the incidents.

For our study, we defined correctional industry work programs as

programs that produced products and services for sale to government

agencies and/or to the private sector. We excluded institutional work

programs, i.e., programs that would involve activities such as

housekeeping, food services, day-to-day maintenance, and community

service, as well as support programs in which an inmate may have

inadvertently seen personal information. The scope of our study included

work programs that were (1) overseen by BOP, a state government, or a

state-appointed commission; (2) associated with federal, state, or privately

run facilities; and (3) associated with secure, confined facilities—including

youth authorities—but not programs associated with prerelease facilities

or city or county jails.

We defined “personal information” as information that could be used to

threaten an individual’s physical, psychological, or financial well-being.

This information would include (1) credit card numbers (personal or

business); (2) Social Security numbers; or (3) names in combination with

physical descriptions or financial, medical, or motor vehicle information.

We also collected data on inmates’ access to “names and addresses or

telephone numbers,” which included a name and one or more of the

following: work or home address or telephone number, name of employer,

or job title but no other item that we defined as personal information.
Appendix I

Objectives, Scope, and Methodology

Page 15 GAO/GGD-99-146 Inmates’ Access to Personal Information

To meet the assignment objectives, we surveyed, by mail, correctional

industry officials in BOP, all 50 states, and the District of Columbia. The

questionnaire asked for information on the following:

• correctional industry work program contracts that involved personal

information that were either orders-in-progress or that had been agreed to

but had not yet been started on September 30, 1998;1

• the number of inmates who had access to personal information or to

names and addresses or telephone numbers through correctional industry

work program contracts or support work;

• safeguards that were in place to prevent inmates from misusing the

information;

• statutes, regulations, procedures, other guidelines, and proposed

legislation that dealt with correctional industry work programs involving

personal information;

• the gross income in the most recently completed fiscal year for the

correctional industry work program overall and for those contracts that

involved personal information; and

• incidents of misuse of information that occurred at any time as a result of

inmate access to the information through a correctional industry work

program.

We asked questionnaire respondents for information on inmates who had

access to (1) personal information or (2) names and addresses or

telephone numbers, either through working on a correctional industry

work program contract or through performing support work for the

industry work program operations. We defined a contract as a formal or

informal agreement to produce a specific product or perform a specific

service. We defined inmates who were performing support work as

inmates who were not associated with a specific correctional industry

work program contract but who performed tasks—such as order taking,

order fulfillment, manufacturing or customer support, complaint

resolution, or shipping—that supported the industry work program

operations.

In designing our questionnaire, we received input from the Correctional

Industries Association, Inc. (a nonprofit professional organization

representing individuals and agencies engaged in and concerned with

correctional industries) and federal and state correctional industry

 1

We chose September 30, 1998, because it coincided with the last day of the federal and some states’

fiscal years. We anticipated that quarterly or annual data would be collected and compiled at that time

and that this would facilitate the questionnaire recipients’ ability to provide us with information.
Appendix I

Objectives, Scope, and Methodology

Page 16 GAO/GGD-99-146 Inmates’ Access to Personal Information

officials. We revised the questionnaire based on the feedback these

officials provided. We made further changes based on input from

correctional industry officials as a result of pilot testing the survey

instrument in Maryland and Virginia.

To identify questionnaire recipients, we called the contact point for each

state’s correctional industry program as identified in the 1998 Correctional

Industries Association, Inc., Directory. We informed them of our

assignment and asked whether they would be the proper recipients for the

questionnaire. We asked these officials if their state had any privately run

prisons that housed inmates from their state prison system or from other

states’ prison systems. If they had such facilities, we asked them to identify

the individual who had oversight responsibilities for work programs in

these facilities.

To further ensure that we had a respondent for each privately run facility

that met our criteria (i.e., the facility was a secure, confined facility—

including youth authorities—but not a prerelease facility or city or county

jail, and any work programs in the facility would be overseen by BOP, a

state government, or a state-appointed commission), we obtained a list of

privately run correctional facilities from the Private Corrections Project

Internet web site.2

 We then contacted the individuals whom we had

identified as overseeing work programs at privately run facilities to ensure

that they had responsibility for each facility that met our criteria. If they

stated that they did not have responsibility, we asked them who did and

repeated this procedure until we reached the appropriate party.

We mailed a total of 63 questionnaires: 1 to BOP, 1 to each state and the

District of Columbia, 1 to a youth authority, 1 to a joint venture program,

and 1 each to 9 privately run facilities that had been identified by the

method described above. Representatives from two states, Arizona and

Tennessee, informed us that they would not be participating in our survey.

Ohio’s representative also indicated that he would not be completing the

questionnaire but told us that Ohio does not permit inmates involved in

data entry to have access to credit card numbers or Social Security

numbers. When we received the questionnaires, we followed-up by

telephone on missing or incomplete data, consolidated the data into the

tables displayed in this report, faxed the completed tables to all

questionnaire respondents for confirmation of the accuracy of the data

displayed, and made corrections as necessary. Questionnaire respondents

were provided only with compiled data concerning their individual states.

 

2

 The address for this web site is http://web.crim.ufl.edu/pcp.
Appendix I

Objectives, Scope, and Methodology

Page 17 GAO/GGD-99-146 Inmates’ Access to Personal Information

We also conducted literature and legal database searches to identify

published articles, reports, studies, statutes, proposed bills, and other

documents dealing with the assignment objectives. We contacted

representatives from various organizations to determine what information

they may have that related to our assignment objectives. These

organizations included the American Correctional Association;

Correctional Industries Association, Inc.; American Jail Association;

American Federation of Labor and Congress of Industrial Organizations;

and Union of Needletraders, Industrial and Textile Employees.

We contacted each state’s attorney general’s office and the District of

Columbia’s Corporation Counsel to identify any additional (1) incidents of

inmates misusing information obtained through correctional industry work

programs and (2) state statutes or regulations, proposed legislation, or

other guidance that dealt with correctional industry work programs

involving personal information. We did not verify the completeness of the

information provided.

We contacted various federal agencies with investigatory responsibilities

to determine if they were aware of instances of inmates misusing personal

information that they obtained through correctional industry work

programs. Within the Department of the Treasury, we contacted the

Internal Revenue Service’s Criminal Investigation Division and the U.S.

Secret Service. Within the Department of Justice, we contacted the Federal

Bureau of Investigation. Finally, we contacted the U.S. Postal Service and

the Social Security Administration.

We performed our work between June 1998 and June 1999 in accordance

with generally accepted government auditing standards.
Appendix II

Number of Inmates With Access to Personal

Information Through Work Programs

Page 18 GAO/GGD-99-146 Inmates’ Access to Personal Information

 Totals in bold

Jurisdiction/

 Contractor Number of inmates

Social security

number

Credit card

number

Federal

Bureau of Prisons 25 25

Federal agency 25 25

State

Alabama 0

Alaska 0

Arizona NR NR NR

Arkansas 13

State agency 13

California 426 426

State agency 426 426

Colorado 0

Connecticut 0

Delaware 0

District of Columbia 0

Florida 55 20

State agency 1 10 10

State agency 2 10 10

State agency 3 5

State agency 4 5

State agency 5 25

Georgia 0

Hawaii 0

Idaho 31 31

State agency 31 31

Illinois 86

State agency 1 38

State agency 2 48

Indiana 0

Iowa 20 20

State agency 20 20

Kansas 15 15

State agency 15 15

Kentucky 56 56

State agency 56 56

Louisiana 0

Maine 0

Maryland 0

Massachusetts 0

Michigan 0

Minnesota 15

Private company 1 10

Private company 2 5
Appendix II

Number of Inmates With Access to Personal Information Through Work Programs

Page 19 GAO/GGD-99-146 Inmates’ Access to Personal Information

Name and

Date of

birth

Home

address

Driver’s

license

number

Home

telephone

number

Name of

employer

Make and

model of

vehicle

Income or

salarya

Place of

birth

Medical

diagnosis

Prescription

information

Employee

identification

number Other

NR NR NR NR NR NR NR NR NR NR NR NR

13 13 13

13 13 13 b

426 426

426 426c

45 50 30 20 10 30 5 55

10 10 10 10d

10 10 10 10e

5 5f

5 5 5 5 5 5g

25 25 25 25 25h

31 31 31 31 31 31

31 31 31 31 31 31 d

86 86 86 86

38 38 38 38

48 48 48 48

20 20 20

20 20 20 f

15 15 15 15 15

15 15 15 15 15

56 56 56 56

56 56 56 56 d

15 15 5 10 5

10 10 10a

5 5 5 5i
Appendix II

Number of Inmates With Access to Personal Information Through Work Programs

Page 20 GAO/GGD-99-146 Inmates’ Access to Personal Information

 Totals in bold

Jurisdiction/

Contractor Number of inmates

Social security

number

Credit card

number

Mississippi 0

Missouri 48 48

State agency 1 9 9

State agency 2 15 15

State agency 3 15 15

State agency 4 9 9

Montana 0

Nebraska 0

Nevada 0

New Hampshire 25

State agency 25

New Jersey 6 3

State agency 1 2

State agency 2 3 3

State agency 3 1

New Mexico 26 26

State agency 1 1 1

State agency 2 25 25

New York 23

State agency 1 13

State agency 2 10

North Carolina 0

North Dakota 0

Ohio NR 0 0

Oklahoma 254 221 84

State agency 1 2 2

State agency 2 4 4

State agency 3 3 3

State agency 4 3 3

State agency 5 3 3

State agency 6 3 3

State agency 7 5 5

State agency 8 33

State agency 9 27 27

State agency 10 41 41

State agency 11 41 41

State agency 12 27 27

State agency 13 41 41

State agency 14 41 41

State agency 15 46 46

State agency 16 46

State agency 17 84 84

State agency 18 84 84

State agency 19 84 84
Appendix II

Number of Inmates With Access to Personal Information Through Work Programs

Page 21 GAO/GGD-99-146 Inmates’ Access to Personal Information

Name and

Date of

birth

Home

address

Driver’s

license

number

Home

telephone

number

Name of

employer

Make and

model of

vehicle

Income or

salarya

Place of

birth

Medical

diagnosis

Prescription

information

Employee

identification

number Other

30 30 15 15 9 15 15 24

9 9d

15 15 15 15 15

15 15 15 15j

25 25

25 25

1 3 1 3 2

2 2k

3

1 1 1

25 25 26 1 25 25 25 25

1 1

25 25 25 25 25 25 25d

13 10 13 13 23

13 13 13 13l

10 10m

NR NR NR NR NR NR NR NR NR NR NR NR

207 246 174 207 208 204 132 166 117 117 49 254

2 2 2 2 2 2 2 2d

4 4 4 4 4 4 4 4n

3 3 3 3 3o

3p

3 3 3q

3 3 3 3 3d

5 5 5d

33 33 33r

27 27 27 27 27 27 27 27s

41 41 41 41t

41 41

27 27

41 41 41 41 41 41

41 41

46 46 46 46 46 46s

46 46 46 46u

84 84 84 84 84 84 84 84 84s

84 84 84 84 84 84 84 84 84s

84 84 84 84 84 84 84 84 84 84 84d
Appendix II

Number of Inmates With Access to Personal Information Through Work Programs

Page 22 GAO/GGD-99-146 Inmates’ Access to Personal Information

 Totals in bold

Jurisdiction/

 Contractor Number of inmates

Social security

number

Credit card

number

Oklahoma (cont.)

 State agency 20 84 84 84

 Oregon 75

 State agency 1 35

 State agency 2 40

Pennsylvania 0

Rhode Island 0

South Carolina 0

South Dakota 18 18

State agency 18 18

Tennessee NR NR NR

Texas 0

Utah 60 60

State agency 60 60

Vermont 0

Virginia 0

Washington 0

West Virginia 0

Wisconsin 80 80

Private company 80 80

Wyoming 0

Total 1,357 1,049 84
Appendix II

Number of Inmates With Access to Personal Information Through Work Programs

Page 23 GAO/GGD-99-146 Inmates’ Access to Personal Information

Name and

Date of

birth

Home

address

Driver’s

license

number

Home

telephone

number

Name of

employer

Make and

model of

vehicle

Income or

salarya

Place of

birth

Medical

diagnosis

Prescription

information

Employee

identification

number Other

84 84 84 84 84d

75 35 40 40 35 40

35 35 35

40 40 40 40v

18 18 18 18

18 18 18 18d

NR NR NR NR NR NR NR NR NR NR NR NR

60 60 60 60 60 60

60 60 60 60 60 60f

80 80 80

80 80 80d

1,133 742 464 431 413 411 249 194 157 155 74 1,132

Note 1: Personal information means information that can be used to threaten an individual’s physical,

psychological, or financial well-being. This information would include (1) credit card numbers

(personal or business); (2) Social Security numbers; or (3) names in combination with physical

descriptions or financial, medical, or motor vehicle information. This table does not include inmates

who had access to only names and one or more of the following: work or home address or telephone

number, name of employer, or job title. For that information, see appendix VI.

Note 2: States with “NR” in each category did not return a questionnaire. We received a

questionnaire from Arizona’s privately run facilities. These facilities did not have any inmates who had

access to names, addresses, telephone numbers, or other types of personal information. A

representative from Ohio’s state-run facilities informed us that inmates involved in data entry work

programs did not have access to credit card numbers or Social Security numbers. We did not receive

any information from respondents in state-run correctional facilities in Arizona or Tennessee.

Note 3: The numbers shown above represent the maximum numbers of inmates who would have had

access to each type of personal information. Some inmates worked on more than one contract.

Consequently, as in Oklahoma, totals are not the sum of the number of inmates shown for each

contract. Also, we asked respondents for the types of personal information to which inmates had

access. However, each inmate may not have had access to all of the types of personal information

involved in a contract.

Note 4: According to the questionnaire respondents, the data from Idaho represent the combined

information from two contracts, and the data from New Hampshire were combined from five contracts.

Illinois’ data represent one contract situated in two geographic locations.

a

Income or salary may refer to a range rather than a discreet number. In Minnesota, customers are

prompted to refuse to respond at their discretion.

b

Physical description.

c

Optical prescription and gender.
Appendix II

Number of Inmates With Access to Personal Information Through Work Programs

Page 24 GAO/GGD-99-146 Inmates’ Access to Personal Information

d

Work address and work telephone number.

e

Physician’s name and date of incident.

f

Mother’s maiden name.

g

Vehicle identification number.

h

Boat description.

i

Work telephone number, vehicle identification number, and license plate number.

j

Medical treatment information.

k

Work address, federal identification number of business, or Social Security number.

l

Work address, work telephone number, Medicaid recipient number, and Medicaid provider number.

m

Driver’s license plate number.

n

Medical information.

o

Mug shot.

p

Name of payee, address, claim number, and amount of check.

q

Amount of check.

r

Lien information.

s

Work address, work telephone number, and mother’s maiden name.

t

Work address.

u

Lien holder.

v

License plate number, driver’s license suspension, and motor vehicle-related conviction.

Source: GAO survey of correctional industry officials.
Appendix II

Number of Inmates With Access to Personal Information Through Work Programs

Page 25 GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix III

Safeguards Used in Work Programs in Which

Inmates Had Access to Personal Information

Page 26 GAO/GGD-99-146 Inmates’ Access to Personal Information

Jurisdiction/

 contractor

Close

supervision

Selective

hiring

Confidentiality

agreementa

Security check

at exit

Security check at

entrance

Federal

 Bureau of Prisons

 Federal agency • • •

State

 Arkansas

 State agency • • •

 California

 State agency • • • •

 Florida

 State agency 1 • • • • •

 State agency 2 • • • • •

 State agency 3 • • • • •

 State agency 4 • • • • •

 State agency 5 •

 Idaho

 State agency • • • •

 Illinois

 State agency 1 • • • •

 State agency 2 • • • • •

 Iowa

 State agency • • • • •

 Kansas

 State agency • • • •

 Kentucky

 State agency • • • •

 Minnesota

 Private company 1 • • • • •

 Private company 2 • • • • •

 Missouri

 State agency 1 • •

 State agency 2 • •

 State agency 3 • •

 State agency 4 • •

 New Hampshire

 State agency • • • • •

 New Jersey

 State agency 1 • • • • •

 State agency 2 • • • •

 State agency 3 • • • • •

 New Mexico

 State agency 1 • • • • •

 State agency 2 • • • • •
Appendix III

Safeguards Used in Work Programs in Which Inmates Had Access to Personal Information

Page 27 GAO/GGD-99-146 Inmates’ Access to Personal Information

No photocopy

machines

Monitored

telephone calls

Computer

program with

privacy

safeguards

Incoming

 calls only

Personal

information

segmented

among inmates

No paper or

writing

instruments Other

• •

b

•

• • •

c

• •

• •

d

• •

• •

• • • •

e

• • • •

f

• • • •

f

• • • • •

d

• •

•

• •

• •

• • • •

g

• • • •

• • •

h

• •

i

• •

•
Appendix III

Safeguards Used in Work Programs in Which Inmates Had Access to Personal Information

Page 28 GAO/GGD-99-146 Inmates’ Access to Personal Information

Jurisdiction/

 contractor

 Close

supervision

Selective

hiring

Confidentiality

agreementa

Security check

at exit

Security check

at entrance

 New York

 State agency 1 • •

 State agency 2 • •

Oklahoma

State agency 1 • • •

State agency 2 • • •

State agency 3 • • •

State agency 4 • • •

State agency 5 • • •

State agency 6 • • •

State agency 7 • • •

State agency 8 • • •

State agency 9 • • • • •

State agency 10 • • • • •

State agency 11 • • • • •

State agency 12 • • • • •

State agency 13 • • • • •

State agency 14 • • • • •

State agency 15 • • • • •

State agency 16 • • • • •

State agency 17 • • • •

State agency 18 • • • •

State agency 19 • • • •

State agency 20 • • • •

Oregon

State agency 1 • • • • •

State agency 2 • • • •

South Dakota

State agency • • • • •

Utah

State agency • • • • •

Wisconsin

Private company • • • •
Appendix III

Safeguards Used in Work Programs in Which Inmates Had Access to Personal Information

Page 29 GAO/GGD-99-146 Inmates’ Access to Personal Information

No photocopy

machines

Monitored

telephone calls

Computer

program with

privacy

safeguards

Incoming

 calls only

Personal

information

segmented

among inmates

No paper or

writing

instruments Other

•

j

•

• •

• •

• •

• •

• •

• •

• •

• • •

• • •

• • •

• • •

• • •

• • •

• • •

• • •

• •

• •

• •

• •

• • • • •

k

• • • • •

k

• • • •

• • •

• •

l

Note 1: Personal information means information that can be used to threaten an individual’s physical,

psychological, or financial well-being. This information would include (1) credit card numbers

(personal or business); (2) Social Security numbers; or (3) names in combination with physical

descriptions or financial, medical, or motor vehicle information.

Note 2: A blank means that the questionnaire respondent did not report using the safeguard in the

work program.

Note 3: According to the questionnaire respondents, the data from Idaho represent the combined

information from two contracts, and the data from New Hampshire were combined from five contracts.

Illinois’ data represent one contract situated in two geographic locations.

a

Confidentiality agreements were agreements signed by the inmates not to release information

obtained through a work program.

b

Prison staff conducted random inspections of work and housing areas.
Appendix III

Safeguards Used in Work Programs in Which Inmates Had Access to Personal Information

Page 30 GAO/GGD-99-146 Inmates’ Access to Personal Information

c

Security cameras were located in the work area.

d

Inmates were not allowed to make telephone calls in the work area.

e

Telephones located in the work area were auto-dialed.

f

Records could not enter or leave secure area at work site except in custody of civilian state employee

or bonded courier.

g

Inmates signed shop rules and procedures.

h

No telephones were located in the work area.

i

No telephones or computers were located in the work area.

j

Inmates could not take paper or writing instruments into or out of the work area.

k

Prison staff searched inmates’ desks.

l

Prison staff prescreened documents to ensure that they did not contain certain types of information.

Inmates were subject to pat searches.

Source: GAO survey of correctional industry officials.
Appendix IV

Procedures, Statutes, and Pending Bills

Page 31 GAO/GGD-99-146 Inmates’ Access to Personal Information

Jurisdiction Prison procedures Statutes and pending bills

Federal

Bureau of Prisons Inmates who were convicted of counterfeiting or

computer fraud offenses or had extensive computer

knowledge were excluded

Pending Bill H.R. 369 (1999): would prohibit the use of

prison inmate labor for, among other tasks, data

processing of personal information about children

State

Arkansas Inmates must meet requirements for minimum security;

inmates convicted of rape or who had life sentences were

excluded

California Inmates are screened by type of offense as per California

Penal Code, Section 5071

California Penal Code, Section 5071: in general,

prohibits prison inmates convicted of offenses involving,

for example, misuse of a computer, misuse of

personal/financial information of another person, or a

sex offense from performing prison employment

functions that provide such inmates with access to

certain types of personal informationa

See also California Welfare Institutions Code, Section

219.5: (language similar to above code section--

applicable to juveniles) a

Florida Inmates were screened for disciplinary actions and

appropriate education level

Illinois Inmates were referred to the program by an institutional

committee and must have had a good institutional record

Pending House Bill 70 (1999): would, in general, prohibit

the use of inmates to enter any personally identifiable

information in a computer processible medium or any

other medium

Iowa Selective hiringb Iowa Code, Section 904.801: a statement of intent that

outlines various objectives to be met through the

provision of meaningful work opportunities to inmatesc

Iowa Code, Section 904.809(1)(g): with respect to

private industry employment of inmates of correctional

institutions, various conditions shall apply to all

agreements for such employment, including that the

state director shall implement a system for screening

and security of inmates to protect the safety of the public

Kansas Inmates must have had a good work record and no

disciplinary reports

Table IV.1: Federal and State Prison Procedures, Statutes, and Pending Bills That Address Limitations on Inmates Who

Perform Work Involving Personal Information Where Inmates Had Access to Personal Information on September 30, 1998
Appendix IV

Procedures, Statutes, and Pending Bills

Page 32 GAO/GGD-99-146 Inmates’ Access to Personal Information

Jurisdiction Prison procedures Statutes and pending bills

Kentucky Inmates who had violated the correctional institutions’

rules were excluded

Kentucky revised statutes, Section 97.120: in general,

prohibits certain state agencies from entering into any

contract for the use or employment of prisoners in any

capacity that allows prisoners access to certain types of

information, including, but not limited to, taxpayer

information, Social Security numbers, telephone

numbers, and addresses

Minnesota Program review committee identified high-risk inmates

and prevented their employment

Mississippi All inmates were screened by the Dept. of Corrections

Internal Audit Division for security clearance. No one was

hired with a forgery, counterfeit, or document fraud

conviction.

New Hampshire Selective hiringb

New Jersey Institutional classification New Jersey Pending Assembly Bill 603 (1998): would

prohibit inmates at the Adult Diagnostic and Treatment

Center from being employed in a data entry position or

any other capacity that would provide the inmate access

to certain types of personal information

New Mexico Inmates’ conduct while incarcerated was considered;

inmates with a history of sex crimes, hate crimes, or

violent behavior were excluded

New York Depending on contract, inmates who committed

insurance, motor vehicle, credit card fraud, or extortion

were excluded

New York Pending Assembly Bill 4753 (1999): in

general, inmates involved in correctional institution work

would be prohibited from accessing, collecting, or

processing certain types of personal information

See also New York Pending Assembly Bill 4842 (1999):

(language similar to the above bill)

Oklahoma Inmates must have had at least 8th grade math and

reading skills; other factors, such as attitude, were

considered also

Oregon Security screening, including conviction type, was

employed. Inmates convicted of computer fraud, crimes

with a high degree of violence, and some sex crimes, or

inmates that were considered to be high security risks by

the institution or Department of Corrections were not

employed

South Dakota Selective hiringb
Appendix IV

Procedures, Statutes, and Pending Bills

Page 33 GAO/GGD-99-146 Inmates’ Access to Personal Information

Jurisdiction Prison procedures Statutes and pending bills

Utah Inmates were screened for suitability for employment

based on factors such as previous employment and

prison record

Wisconsin Wisconsin Pending Assembly Bill 31 (1999): would

prohibit the Department of Corrections from entering into

any contract or other agreement if, in the performance of

the contract or agreement, a prisoner would have

access to any personal information of individuals who

are not prisoners

Note: We did not independently verify the completeness of the data provided by the questionnaire

respondents.

a

This section also was identified by the state as requiring that such persons in prison work programs

disclose that fact before taking any personal information from anyone.

b

The criterion by which inmates were selected was not specified.

c

This statute also was identified by the state as containing provisions that related to preventing

inmates from retaining personal information or transferring it to unauthorized inmates or other

persons.

Source: GAO survey of correctional industry officials, state attorneys general, and legal database

searches.
Appendix IV

Procedures, Statutes, and Pending Bills

Page 34 GAO/GGD-99-146 Inmates’ Access to Personal Information

State Statutes and pending bills

Colorado Colorado Revised Statutes, Section 17-24-104: the Correctional Industries Advisory Board, among other things, is to

consider the feasibility of proposed prison industries that would utilize the services of prisoners

Maryland Annotated Code of Maryland, Article 27, Section 681C(3)(ii): authorizes the Board of Public Works to suspend certain

requirements that state agencies utilize correctional industry services when data entry services would involve certain

types of protected information

Michigan Michigan Statutes Annotated, Section 28.1540(7a)(1)(a): prohibits inmates assigned to work in a private manufacturing

or service enterprise from being granted access to certain types of employee; customer; or client information; including,

but not limited to, personal addresses, telephone numbers, E-mail addresses, credit card information, other financial

information, and health records

Texas Texas Government Code, Section 497.098: in general, prohibits inmates who have previously misused information

gained through a work program from participating in work programs that provide inmates with access to personal

information about persons who are not confined in the institutional division

Texas Pending House Bill 812 (1999): in general, would prohibit the Department of Criminal Justice from entering into

contracts that would require or permit certain sex offenders to have access to personal information about persons who

are not confined in facilities operated by or for the departmenta

Texas Pending Senate Bill 420 (1999): in general, would prohibit the Department of Criminal Justice from entering into

contracts that would require or permit an inmate confined in a correctional facility operated by or for the department to

have access to personal information about persons who are not confined in facilities operated by or for the department

Vermont Vermont Pending Bill H.88 (1999): would require offenders engaged in a work activity involving the solicitation of

confidential information from the general public to disclose such offender status and to obtain the consent of the

members of public concerned before proceeding

Washington Revised Code of Washington, Section 72.09: in general, requires work program administrators to ensure that no inmate

convicted of certain sex offenses obtains access to names, addresses, or telephone numbers of private individuals while

performing his or her duties in an inmate work program

Note: We did not independently verify the completeness of the data provided by the questionnaire

respondents.

a

This bill also was identified as containing provisions that related to preventing inmates from physically

retaining personal information or transferring it to unauthorized inmates or other persons, i.e., inmates

having access to certain personal information would be personally searched upon entering or leaving

the work area.

Source: GAO survey of correctional industry officials, state attorneys general, and legal database

searches.

Table IV.2: Statutes and Pending Bills That Address Work Programs Involving Access to Personal Information in States Where

Questionnaire Respondents Reported That Inmates Did Not Have Access to Personal Information on September 30, 1998
Appendix V

Income From Work Programs That Allowed

Inmates Access to Personal Information,

Fiscal Year 1998

Page 35 GAO/GGD-99-146 Inmates’ Access to Personal Information

Jurisdiction/Contractor

Income from

individual

contracts for

FY 1998

Total income

from

contracts for

FY 1998

FY 1998 correctional

industry gross income

Percentage of FY 1998

correctional industry gross

income from personal

information contracts

Federal

 Bureau of Prisons

Federal agency $6,000

 Total $6,000 $568,000,000 <0.1

State

 Arkansas

 State agency 135,000

 Total 135,000 5,600,000 2.4

 California

 State agency 11,962,000

 Total 11,962,000 150,865,000 7.9

 Florida

 State agency 1 N/Aa

 State agency 2 N/Aa

 State agency 3 N/Aa

 State agency 4 N/Aa

 State agency 5 N/Aa

 Total N/Aa 81,000,000

 Idaho

 State agency 144,000

 Total 144,000 652, 000b 22.1

 Illinois

 State agency 1 15,000

 State agency 2 278,000

 Total 293,000 47,435,000 0.6

 Iowa

 State agency N/A

 Total N/A 120,000

 Kansas

 State agency 70,000

 Total 70,000 10,600,000 0.7

 Kentucky

 State agency 294,000

 Total 294,000 12,400,000 2.4

 Minnesota

 Private company 1 73,000

 Private company 2 3,000

 Total 76,000 17,820,000 0.4
Appendix V

Income From Work Programs That Allowed Inmates Access to Personal Information, Fiscal

Year 1998

Page 36 GAO/GGD-99-146 Inmates’ Access to Personal Information

Jurisdiction/ Contractor

Income from

individual

contracts for

FY 1998

Total income

from

contracts for

FY 1998

FY 1998 correctional

Industry gross income

Percentage of FY 1998

correctional industry gross

income from personal

information contracts

 Missouri

 State agency 1 23,000

 State agency 2 13,000

 State agency 3 15,000

 State agency 4 c

 Total 51,000 36,268,000 0.1

 New Hampshire

 State agency 130,000

 Total 130,000 2,500,000 5.2

 New Jersey

 State agency 1 3,000

 State agency 2 3,000

 State agency 3 1,000

 Total 8,000 17,199,000 <.1

 New Mexico

 State agency 1 d

 State agency 2 d

 Total 698,000 4,400,000 15.9

 New York

 State agency 1 2,300,000

 State agency 2 500,000

 Total 2,800,000 60,800,000 4.6

 Oklahoma

 State agency 1 c

 State agency 2 c

 State agency 3 6,000

 State agency 4 9,000

 State agency 5 20,000

 State agency 6 2,000

 State agency 7 28,000

 State agency 8 220,000

 State agency 9 8,000

 State agency 10 200,000

 State agency 11 1,000

 State agency 12 47,000

 State agency 13 13,000

 State agency 14 1,000

 State agency 15 2,000

 State agency 16 150,000

 State agency 17 7,000

 State agency 18 17,000

 State agency 19 84,000

 State agency 20 2,000

 Total 817,000 16,754,000 4.9
Appendix V

Income From Work Programs That Allowed Inmates Access to Personal Information, Fiscal

Year 1998

Page 37 GAO/GGD-99-146 Inmates’ Access to Personal Information

Jurisdiction/Contractor

Income from

individual

contracts for

FY 1998

Total income

from

contracts for

FY 1998

FY 1998 correctional

industry gross income

Percentage of FY 1998

correctional industry gross

income from personal

information contracts

 Oregon

 State agency 1 320,000

 State agency 2 250,000

 Total 570,000 15,000,000 3.8

 South Dakota

 State agency 0e

 Total 0e 261,000

 Utah

 State agency 360,000

 Total 360,000 12,000,000 3.0

 Wisconsin

 Private company 170,000

 Total 170,000 22,844,000 0.7

Note 1: Personal information means information that can be used to threaten an individual’s

physical, psychological, or financial well-being. This information would include (1) credit card

numbers (personal or business); (2) Social Security numbers; or (3) names in combination with

physical descriptions or financial, medical, or motor vehicle information.

Note 2: Dollar amounts were rounded to the nearest thousand. Totals may not add due to rounding.

Percentages were rounded to the nearest tenth.

a

PRIDE Enterprises, a private, not-for-profit corporation that operates industries in correctional

institutions throughout Florida, stated that it contributes over $1 million annually toward incarceration

costs to the state of Florida and 15 percent of total inmate wages to victim restitution.

b

Net income was provided.

c

Less than $1,000.

d

State does not have a breakdown by individual contract.

e

Contract started in June 1998.

Source: GAO survey of correctional industry officials.
Appendix VI

Number of Inmates With Access to Only

Names and Addresses Through Work

Programs

Page 38 GAO/GGD-99-146 Inmates’ Access to Personal Information

Number of inmates

Jurisdiction

Through contracts with

government agencies or

private companies

Through general support

work for correctional

industry programs Total

Federal

 Bureau of Prisons 80 3,109 3,189

State

 Alabama 0 0 0

 Alaska 0 3 3

 Arizona NR NR NR

 Arkansas 7 1 8

 California 0 75 75

 Colorado 11 21 32

 Connecticut 0 0 0

 Delaware 0 20 20

 District of Columbia 0 0 0

 Florida 41 465 506

 Georgia 0 0 0

 Hawaii 0 0 0

 Idaho 31 30 61

 Illinois 8 0 8

 Indiana 0 0 0

 Iowa 0 0 0

 Kansas 10 0 10

 Kentucky 0 0 0

 Louisiana 0 0 0

 Maine 0 0 0

 Maryland 30 30 30a

 Massachusetts 80 0 80

 Michigan 0 26 26

 Minnesota 33 30 63

 Mississippi 19 0 19

 Missouri 15 60 75

 Montana 8 4 8a

 Nebraska 112 43 112a

 Nevada 26 12 38

 New Hampshire 0 0 0

 New Jersey 58 0 58

 New Mexico 90 36 126

 New York 6 0 6

 North Carolina 0 0 0

 North Dakota 0 0 0

 Ohio NR NR NR

 Oklahoma 255 116 371

 Oregon 145 8 153

 Pennsylvania 0 0 0

 Rhode Island 0 0 0

 South Carolina 10 0 10

 South Dakota 8 6 14

 Tennessee NR NR NR
Appendix VI

Number of Inmates With Access to Only Names and Addresses Through Work Programs

Page 39 GAO/GGD-99-146 Inmates’ Access to Personal Information

Number of inmates

Jurisdiction

Through contracts with

government agencies or

private companies

Through general support

work for correctional

industry programs Total

 Texas 0 0 0

 Utah 100 0 100

 Vermont 0 0 0

 Virginia 0 45 45

 Washington 42 109 151b

 West Virginia 28 6 34

 Wisconsin 105 0 105

 Wyoming 3 0 3

Total 1,361 4,255 5,539a

Note 1: Names and addresses mean names and one or more of the following: work or home

addresses or telephone numbers, names of employer, or job titles but no other item that we defined

as personal information.

Note 2: States with “NR” in each category did not return a questionnaire. We received a questionnaire

from Arizona’s privately run facilities. These facilities did not have any inmates who had access to

names, addresses, telephone numbers, or other types of personal information. A representative from

Ohio’s state-run facilities informed us that inmates involved in data entry work programs did not have

access to credit card numbers or Social Security numbers. We did not receive any information from

respondents in state-run correctional facilities in Arizona or Tennessee.

a

Columns do not add across to the total column because the same inmate may have had access to

names and addresses or telephone numbers through both contracts and support work. Totals indicate

the maximum number of inmates with access.

b Inmates had access to names, work addresses, and work telephone numbers only; they did not have

access to home addresses or home telephone numbers.

Source: GAO survey of correctional industry officials.
Appendix VII

Type of Work Performed in Work Programs in

Which Inmates Had Access to Only Names

and Addresses

Page 40 GAO/GGD-99-146 Inmates’ Access to Personal Information

Jurisdiction

Order

fulfillment Data entry Shipping Printing

Manufacturing

or customer

support Order taking Telemarketing

Federal

Bureau of Prisons C/S C S S S

State

Alaska S S S S

Arkansas C

California S S S

Colorado S

Delaware S

Florida S C S C S S

Idaho S C/S S S S

Illinois C C

Kansas

Maryland C/S C/S

Massachusetts C C C C

Michigan

Minnesota C S C

Mississippi C C

Missouri S C S S S

Montana S S C S S C

Nebraska C/S C S C S C

Nevada S S S S C

New Jersey C

New Mexico C/S C S C S C

New York C

Oklahoma C/S C S C S S C/S

Oregon C C S C S S C

South Carolina

South Dakota C/S S C

Utah C C

Virginia S

Washingtonr C C C/S C C

West Virginia S C

Wisconsin C

Wyomings
Appendix VII

Type of Work Performed in Work Programs in Which Inmates Had Access to Only Names and

Addresses

Page 41 GAO/GGD-99-146 Inmates’ Access to Personal Information

Bulk mailing

Complaint

resolution

Document

duplication

Computer-aided

design

Document

scanning

Geographic

information

system Other

C S Sa

S Sb

Sc

Sd

Ce/Sf

Sg

C S C C C C Sd

S C

C

Ch

C/S

Si

Cj

C C

C Sf

S

C Ck

C S C

Cl

S C C Cm

C C C C C Sn

Co

C Sd

C Cp

Sq

S C

Legend

C = Type of work performed by inmates who had access to information through work program

contracts, which is a formal or informal agreement to produce a specific product or perform a specific

service.

S = Type of work performed by inmates who had access to information through support work, which is

not associated with a specific contract, but tasks such as order taking or shipping that supported

overall industry work program operations.

C/S = Inmates performed this type of work both on contracts and through support work.

Note: Names and addresses mean names and one or more of the following: work or home

addresses or telephone numbers, names of employer, or job titles but no other item that we defined

as personal information.
Appendix VII

Type of Work Performed in Work Programs in Which Inmates Had Access to Only Names and

Addresses

Page 42 GAO/GGD-99-146 Inmates’ Access to Personal Information

a

Customer billing.

b

Installation.

c

Sending invoices to agencies.

d

Clerical work.

e

Response to public inquiry regarding corporate information from Secretary of State database via

telephone.

f

Delivery.

g

Furniture refurbishing and auto maintenance.

h

Telephone answering.

i

Purchasing regulations.

j

Coding.

k

Telephone (incoming calls only).

l

Providing information via telephone.

m

Production of various signs.

n

Calling for quotes, prices, and availability.

o

Travel reservations.

p

Sales and purchasing.

q

Truck loading.

r

Inmates working in Washington’s correctional facilities have access to names, work addresses, and

work telephone numbers only.

s

Wyoming failed to designate type of work performed by inmates.

Source: GAO survey of correctional industry officials.
Appendix VII

Type of Work Performed in Work Programs in Which Inmates Had Access to Only Names and

Addresses

Page 43 GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix VIII

Safeguards Used in Work Programs in Which

Inmates Had Access to Only Names and

Addresses

Page 44 GAO/GGD-99-146 Inmates’ Access to Personal Information

Jurisdiction Close supervision

Security check

at exit

Selective

hiring

Security check at

entrance

Monitored telephone

calls

Federal

Bureau of Prisons C/S C/S S

State

Alaska S

Arkansas S C/S S

California S S S

Colorado C/S C/S C/S C/S C

Delaware S S S S

Florida C/S C/S C/S C/S C/S

Idaho C/S C/S C/S C/S

Illinois C C C C C

Kansas C C C

Maryland C/S C/S C/S C/S C/S

Massachusetts C C C C C

Michigan S S S

Minnesota C/S C/S C/S C/S C/S

Mississippi C C C C C

Missouri C/S S S S

Montana C/S C/S C/S C/S C/S

Nebraska C/S C/S C/S C/S C/S

Nevada C/S C/S C/S S C/S

New Jersey C C C C C

New Mexico C/S C/S C/S C/S C/S

New York C C C

Oklahoma C/S C/S C/S C/S C/S

Oregon C/S C/S C/S C/S C/S

South Carolina C C C C C

South Dakota C/S C/S C/S C/S C/S

Utah C C C C C

Virginia S S

Washingtonn C/S C/S C/S C/S C/S

West Virginia C/S C/S C/S C/S

Wisconsin C C C C

Wyoming C C C C
Appendix VIII

Safeguards Used in Work Programs in Which Inmates Had Access to Only Names and

Addresses

Page 45 GAO/GGD-99-146 Inmates’ Access to Personal Information

Computer

program with

privacy

safeguards

Incoming

 calls only

No photocopy

machines

Confidentiality

agreementa

Personal

information given

only to

noninmates

No paper or

writing

instruments Other

C C Cb/Sc

S

S Sd

S S S

C C C C

S Se

C/S C/S C C/S C Cf

C

C C C

C C

C/S C/S C/S C/S

C C C C

S Sg

C C C S Sh

C C Ci

S C

C/S S C/S C Sj

S C

C C C C

C/S C/S S C/S S

C C

C/S C C/S C/S Ck/Sk

C/S C/S C/S C S Cl

C C C C

S

C C C C Cm

C/S S C C Cl

C/S Co/So

C C C Cp

C C

Legend

C = Safeguard applied to inmates who had access to types of information through a contract, which is

a formal or informal agreement to produce a specific product or perform a specific service.

S = Safeguard applied to inmates who had access to types of information through performing support

work, which is not associated with a specific contract, but tasks such as order taking or shipping that

supported overall industry work program operations.

C/S = Safeguard applied to inmates who had access to types of information as a result of employment

on both contracts and through support work.
Appendix VIII

Safeguards Used in Work Programs in Which Inmates Had Access to Only Names and

Addresses

Page 46 GAO/GGD-99-146 Inmates’ Access to Personal Information

Note 1: Names and addresses mean names and one or more of the following: work or home

addresses or telephone numbers, names of employer, or job titles but no other item that we defined

as personal information.

Note 2: A blank means that the questionnaire respondent did not report using the safeguard.

Note 3: This table does not include inmates who had access to names and addresses or telephone

numbers and any other item(s) that we defined as personal information. See appendix III for a list of

safeguards that respondents reported using for inmates who had access to personal information.

a

Confidentiality agreements were agreements signed by the inmates not to release information

obtained through a work program.

b

Prison staff conducted random inspections of work and housing areas.

c

Prison staff conducted random inspections of work and housing areas. Prison staff screened

outgoing business documents. Telephones in work area were auto-dialed.

d

No telephones or computers were used by inmates in work area.

e

Inmates were required to make uniform changes in work area.

f

Inmates had access to telephones, computers, and fax machines connected to network only under

direct supervision. Personal information was segmented among inmates. All documents in and out

are monitored.

g

Information was screened by prison staff before being accessed by inmates. Inmates were subject to

body and cell searches.

h

Inmates did not have access to telephones in work area.

I

Personal information was segmented among inmates. Surveillance mirrors, security cameras,

restricted work area, raw materials/supplies control, and random strip searches were employed.

j

Prison staff conducted area shakedowns. Personal information was segmented among inmates.

k

Personal information was segmented among inmates.

l

Telephones in work area were auto-dialed.

m

Telephones located in the work area were auto-dialed. Telephone calls were monitored and taped.

n

Inmates working in Washington’s correctional facilities had access to names, work addresses, and

work telephone numbers only.

o

Inmates were not allowed to take anything except tobacco into or out of the work area.

p

Prison staff prescreened documents, and inmates were subject to pat searches.

Source: GAO survey of correctional industry officials.
Appendix VIII

Safeguards Used in Work Programs in Which Inmates Had Access to Only Names and

Addresses

Page 47 GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix IX

Incidents of Misuse of Personal Information

by Inmates

Page 48 GAO/GGD-99-146 Inmates’ Access to Personal Information

State Date and description of incident Safeguards reported

California (Youth Authority) In 1991, while on parole an inmate used credit

card numbers previously obtained from a prison

telemarketing work program.

•Selective hiring

•Security check at entrance to work area

•Security check at exit from work area

•Monitored telephone calls

•Incoming calls only to work area

•No photocopy machines in work area

•Close supervision while working

New Mexico In 1995, an inmate wrote a letter to a Medicare

patient identified from information obtained in a

data entry work program.

•Selective hiring

•Computer programs with privacy safeguards

•Close supervision while working

•Confidentiality agreement signed by inmates

New York In the mid-90s, an inmate participating in a work

program provided another inmate with a name

and address obtained through the work

program. The second inmate wrote a letter to

the individual whose name and address were

provided.

•Selective hiring

•Monitored telephone calls

•Incoming calls only to work area

•Close supervision while working

•Personal information given only to noninmates

Oklahoma In about 1990, an inmate obtained information,

through participating in a data entry work

program, about an individual’s medical

expenses and wrote the individual a letter.

•Selective hiring

•Security check at entrance to work area

•Security check at exit from work area

•Computer programs with privacy safeguards

•Monitored telephone calls

•Close supervision while working

•Confidentiality agreement signed by inmates

•Personal information segmented among

different inmates

Oklahoma In 1995, two inmates attempted to smuggle

copies of birth certificates obtained through a

work program out of prison through the U.S.

mail system. The birth certificates were sent

back to the prison via return mail.

•Selective hiring—no misconduct for 6

months

•Security check at exit from work area

•Computer programs with privacy safeguards

•Incoming calls only to work area

•No photocopy machines in work area

•Close supervision while working

•Confidentiality agreement signed by inmates

•Personal information segmented among

different inmates

South Carolina In 1995, an inmate continued to call a particular

individual identified through a work program that

telemarketed local newspaper subscriptions.

•Selective hiring—interviews and previous

work history

•Computer programs with privacy safeguards

•Monitored telephone calls

•Close supervision while working

•Personal information given only to noninmates
Appendix IX

Incidents of Misuse of Personal Information by Inmates

Page 49 GAO/GGD-99-146 Inmates’ Access to Personal Information

Program continued after

incident

How safeguards failed Sanctions against inmate Yes No Changes to safeguards

Unknown Inmate charged and convicted •

a

Inmate was not searched when

leaving work area

Inmate was given disciplinary

segregation time and was not

allowed to work for Correctional

Industries

• N/A

Inmate left the premises with the

information

Inmate was removed from the

work program

• Existing securities were reviewed

and reinforced

Inmate memorized the address Inmate was given a written

reprimand, placed in restrictive

housing, and barred from future

employment in industry work

programs

•

Despite the fence around the

work area and pat down

procedures, these papers were

removed

Both inmates were given written

reprimands, fired from the work

program, and transferred from

this particular area of the prison

• Monitors were placed on the gate to

watch the area

Inmate was not monitored while

making telephone calls

Inmate was given a written

reprimand for disobeying orders

• N/A
Appendix IX

Incidents of Misuse of Personal Information by Inmates

Page 50 GAO/GGD-99-146 Inmates’ Access to Personal Information

State Date and description of incident Safeguards reported

South Dakota In 1990 or 1991, an inmate used a credit card

number, obtained from a work program making

motel reservations, for personal purchases.

•Unknown to questionnaire respondent

Texas In the early 1990’s, an inmate wrote a letter to

an individual identified through a data entry

work program and included personal

information also obtained through the work

program.

Unknown to questionnaire respondent

Washington In 1997, an inmate sent a Christmas card to an

individual identified through a 1-800

information line. The individual had called for

information on state parks.

•Selective hiring—offense history

•Security check at entrance to work area

•Security check at exit from work area

•No photocopy machines in work area

• Monitored telephone calls
Appendix IX

Incidents of Misuse of Personal Information by Inmates

Page 51 GAO/GGD-99-146 Inmates’ Access to Personal Information

Program continued after

incident

How safeguards failed Sanctions against inmate Yes No Changes to safeguards

Unknown Inmate was prosecuted • N/A

Unknown Case is in litigation • N/A

Lack of supervision; failed to use

available technology

Inmate was disciplined and

terminated from work program;

manager was demoted and

subsequently reassigned

•

b N/A

Note: Incidents of misuse of personal information means any action that had threatened or caused

injury to the physical, psychological, or financial well-being of any member of the public. Some of

these incidents involved only names and addresses or telephone numbers, not “personal information”

as we defined it for this report.

a Program was discontinued in 1998.

b

Telemarketing activities were eliminated as a correctional industries business.

Source: GAO survey of correctional industry officials.
Appendix X

Comments From the Bureau of Prisons

Page 52 GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix XI

Comments From the Correctional Industries

Association, Inc.

Page 53 GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix XII

GAO Contacts and Staff Acknowledgments

Page 54 GAO/GGD-99-146 Inmates’ Access to Personal Information

Brenda Bridges, (202) 512-8777

Mary Lane Renninger

Nancy A. Briggs

Geoffrey R. Hamilton

David P. Alexander

Stuart M. Kaufman

Michael H. Little

GAO Contacts

Acknowledgments
Page 55 GAO/GGD-99-146 Inmates’ Access to Personal Information
Page 56 GAO/GGD-99-146 Inmates’ Access to Personal Information
Ordering Information

The first copy of each GAO report and testimony is free. Additional

copies are $2 each. Orders should be sent to the following address,

accompanied by a check or money order made out to the

Superintendent of Documents, when necessary. VISA and

MasterCard credit cards are accepted, also. Orders for 100 or more

copies to be mailed to a single address are discounted 25 percent.

Order by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

or visit:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders may also be placed by calling (202) 512-6000 or by using fax

number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and testimony.

To receive facsimile copies of the daily list or any list from the past

30 days, please call (202) 512-6000 using a touch-tone phone. A

recorded menu will provide information on how to obtain these

lists.

For information on how to access GAO reports on the INTERNET,

send e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov
United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Rate

Postage & Fees Paid

GAO

Permit No. G100

(182833)