Social Security Numbers: OMB and Federal Efforts to Reduce Collection, Use, and Display
Published: 2017-05-23T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: SSNs are key pieces of identifying information that potentially may be used to perpetrate identity theft. Thieves find SSNs valuable because they are the identifying link that can connect an individual's information across many agencies, systems, and databases.
This statement summarize GAO's draft report that: (1) describes what governmentwide initiatives have been undertaken to assist agencies in eliminating their unnecessary use of SSNs and (2) assesses the extent to which agencies have developed and executed plans to eliminate the unnecessary use and display of SSNs and have identified challenges associated with those efforts. For the draft report on which this testimony is based, GAO analyzed documentation, administered a questionnaire, and interviewed officials from the 24 CFO Act agencies that led or participated in SSN elimination efforts.
section_title: What GAO Found
paragraphs: In its draft report, GAO noted that several governmentwide initiatives aimed at eliminating the unnecessary collection, use, and display of Social Security numbers (SSN) have been underway in response to recommendations that the presidentially appointed Identity Theft Task Force made in 2007 to the Office of Personnel Management (OPM), the Office of Management and Budget (OMB), and the Social Security Administration (SSA). However, these initiatives have had limited success. In 2008, OPM proposed a new regulation requiring the use of an alternate federal employee identifier but withdrew its proposed regulation because no such identifier was available. OMB required agencies to develop SSN reduction plans and continues to require annual reporting on SSN reduction efforts. SSA developed an online clearinghouse of best practices associated with the reduction of SSN use; however, the clearinghouse is no longer available online.
All 24 agencies covered by the Chief Financial Officers (CFO) Act developed SSN reduction plans and reported taking actions to curtail the use and display of the numbers. Nevertheless, in their responses to GAO's questionnaire and follow-up discussions, the agencies cited impediments to further reductions, including (1) statutes and regulations mandating the collection of SSNs, (2) the use of SSNs in necessary interactions with other federal entities, and (3) technological constraints of agency systems and processes.
Further, poor planning by agencies and ineffective monitoring by OMB have limited efforts to reduce SSN use. Lacking direction from OMB, many agencies' reduction plans did not include key elements, such as time frames and performance indicators, calling into question their utility. In addition, OMB has not required agencies to maintain up-to-date inventories of their SSN holdings or provided criteria for determining “unnecessary use and display,” limiting agencies' ability to gauge progress. In addition, OMB has not ensured that agencies update their annual progress nor has it established performance metrics to monitor agency efforts to reduce SSN use. Until OMB adopts more effective practices for guiding agency SSN reduction efforts, overall governmentwide reduction will likely remain limited and difficult to measure, and the risk of SSNs being exposed and used to commit identity theft will remain greater than it need be.
section_title: What GAO Recommends
paragraphs: GAO's draft report contains five recommendations to OMB to require agencies to submit complete plans for ongoing reductions in the collection, use, and display of SSNs; require inventories of systems containing SSNs; provide criteria for determining “unnecessary” use and display of SSNs; ensure agencies update their progress in reducing the collection, use, and display of the numbers in annual reports; and monitor agency progress based on clearly defined performance measures.

section_title: Letter
paragraphs: Thank you for inviting me to testify at today’s hearing on executive branch  efforts to reduce the unnecessary use of Social Security numbers (SSN).  As you know, SSNs are key pieces of personally identifiable information  (PII) that potentially may be used to perpetrate identity theft. Thieves find  SSNs especially valuable because they are the identifying link that can  connect an individual’s PII across many agencies, information systems,  and databases.
As requested, this statement summarizes key preliminary findings based  on our draft report that (1) describes governmentwide initiatives that have  been undertaken to assist agencies in eliminating their unnecessary use  of SSNs, and (2) assesses the extent to which agencies have developed  and executed plans to eliminate the unnecessary use and display of  SSNs and have identified challenges associated with those efforts. The  draft report is currently out for comment. We anticipate issuing the report  later this summer.
In conducting our work for that report, we addressed the first objective by  analyzing documents, including reports by the presidentially appointed  Identity Theft Task Force on strengthening efforts to protect against  identity theft; Office of Management and Budget (OMB) guidance to  agencies on protecting SSNs and other PII; and Office of Personnel  Management (OPM) guidance on protecting federal employee SSNs. We  also interviewed officials from OMB, OPM, and the Social Security  Administration (SSA), which led or participated in efforts to eliminate the  unnecessary use of SSNs on a governmentwide basis.
To address the second objective, we analyzed documentation obtained  from the 24 agencies covered by the Chief Financial Officers (CFO) Act, including their SSN reduction plans and annual updates, and compared  them to key elements of effective performance plans, as defined in  federal guidance and the Government Performance and Results Act  Modernization Act of 2010. We also administered a questionnaire to  these agencies and interviewed relevant officials to gain additional insight  on the agencies’ efforts and the associated challenges.
All the work on which this statement is based was conducted or is being  conducted in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform audits to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: In 1936, following the enactment of the Social Security Act of 1935, the  newly-formed Social Security Board (which later became SSA) created  the 9-digit SSN to uniquely identify and determine Social Security benefit  entitlement levels for U.S. workers. Originally, the SSN was not intended  to serve as a personal identifier but, due to its universality and  uniqueness, government agencies and private sector entities now use it  as a convenient means of identifying people. The number uniquely links  identities across a very broad array of public and private sector  information systems. As of September 2016, SSA had issued  approximately 496 million unique SSNs to eligible individuals.
In 2006, the President issued an Executive Order establishing the Identity  Theft Task Force to strengthen efforts to protect against identity theft.  Because the unauthorized use of SSNs was recognized as a key element  of identity theft, the task force assessed the actions the government could  take to reduce the exposure of SSNs to potential compromise. In April  2007, the task force issued a strategic plan, which advocated a unified  federal approach, or standard, for using and displaying SSNs. The plan  proposed that OPM, OMB, and SSA play key roles in restricting the  unnecessary use of the numbers, offering guidance on substitutes that  are less valuable to identity thieves, and promoting consistency when the  use of SSNs was found to be necessary or unavoidable.
section_title: OPM, OMB, and SSA Have Had Limited Success in Assisting With Governmentwide Reduction in the Collection, Use, and Display of SSNs
paragraphs: In response to the recommendations of the Identity Theft Task Force,  OPM, OMB, and SSA undertook several actions aimed at reducing or  eliminating the unnecessary collection, use, and display of SSNs.  However, in our draft report, we determined that these actions have had  limited success.
subsections: section_title: OPM Issued Guidance and a Proposed Rule That was Subsequently Cancelled
paragraphs: OPM took several actions in response to the task force  recommendations. Using an inventory of its forms, procedures, and  systems displaying SSNs that it had developed in 2006, the agency took  action to change, eliminate, or mask the use of SSNs on OPM  approved/authorized forms, which are used by agencies across the  government for personnel records. In addition, in 2007, OPM issued  guidance to other federal agencies on actions they should take to protect  federal employee SSNs and combat identity theft. The guidance  reminded agencies of existing federal regulations that restricted the  collection and use of SSNs and also specified additional measures.
In addition to issuing this guidance, in January 2008, OPM proposed a  new regulation regarding the collection, use, and display of SSNs that  would have codified the practices outlined in its 2007 guidance and that  also required the use of an alternate identifier. However, in January  2010, after reviewing comments it had received, OPM withdrew the  notice of proposed rulemaking because the agency determined that it  would be impractical to issue the rule without an alternate  governmentwide employee identifier in place.
In 2015, OPM briefly began exploring the concept of developing and  using multiple alternate identifiers for different programs and agencies. As  envisioned, an SSN would be collected only once, at the start of an  employee’s service, after which unique identifiers specific to relevant  programs, such as healthcare benefits or training, would be assigned as  needed. However, officials from OPM’s Office of the Chief Information  Officer stated that work on the initiative was suspended in 2016 due to a  lack of funding.
section_title: OMB Established Reporting Requirements for Agency SSN Reduction Efforts
paragraphs: In May 2007, OMB issued a memorandum officially requiring agencies to  review their use of SSNs in agency systems and programs to identify  instances in which the collection or use of the number was superfluous.  Agencies were also required to establish a plan, within 120 days from the  date of the memorandum, to eliminate the unnecessary collection and  use of SSNs within 18 months. Lastly, the memorandum required  agencies to participate in governmentwide efforts, such as surveys and  data calls, to explore alternatives to SSN use as a personal identifier for  both federal employees and in federal programs.
Since issuing its May 2007 memorandum requiring the development of  SSN reduction plans, OMB has instructed agencies to submit updates to  their plans and documentation of their progress in eliminating  unnecessary uses of SSNs as part of their annual reports originally  required by the Federal Information Security Management Act of 2002  and now required by the Federal Information Security Modernization Act  of 2014 (FISMA).
section_title: SSA Established, but Then Discontinued, an Online Information Sharing Clearinghouse
paragraphs: The Identity Theft Task Force recommended that, based on the results of  OMB’s review of agency practices on the use of SSNs, SSA should  establish a clearinghouse of agency practices and initiatives that had  minimized the use and display of SSNs. The purpose of the  clearinghouse was to facilitate the sharing of “best” practices—including  the development of any alternative strategies for identity management— to avoid duplication of effort, and to promote interagency collaboration in  the development of more effective measures for minimizing the use and  display of SSNs.
In 2007, SSA established a clearinghouse on an electronic bulletin board  website to showcase best practices and provided agency contacts for  specific programs and initiatives. However, according to officials in SSA’s  Office of the Deputy Commissioner, the clearinghouse is no longer active.  The officials added that SSA did not maintain any record of the extent to  which the clearinghouse was accessed or used by other agencies when it  was available online. Further, the officials said SSA has no records of  when or why the site was discontinued.
section_title: Agencies Reported Reducing Their Use and Display of SSNs and Cited Ongoing Challenges; Moreover, Poor Planning and Ineffective Monitoring Have Limited Their Efforts
paragraphs: Based on their responses to our questionnaire on SSN reduction efforts in  our draft report, all of the 24 CFO Act agencies reported taking a variety  of steps to reduce such collection, display, and use. However, officials  involved in the reduction efforts at these agencies stated that SSNs  cannot be completely eliminated from federal IT systems and records. In  some cases, no other identifier offers the same degree of universal  awareness or applicability. Even when reductions are possible,  challenges in implementing them can be significant. In our draft report,  three key challenges were frequently cited by these officials:
Statutes and regulations require collection and use of SSNs. In their  questionnaire responses and follow-up correspondence with us,  officials from 15 agencies who were involved in their agencies’ SSN  reduction efforts noted that they are limited in their ability to reduce  the collection of SSNs because many laws authorize or require such  collection. These laws often explicitly require agencies to use SSNs to  identify individuals who are engaged in transactions with the  government or who are receiving benefits disbursed by federal  agencies.
Interactions with other federal and external entities require use of the  SSN. In their questionnaire responses and follow-up correspondence  with us, officials from 16 agencies noted that the necessity to  communicate with other agencies and external entities limited their  reduction efforts. Federal agencies must be able to cite a unique,  common identifier to ensure that they are matching their information to  the correct records in the other entities’ systems in order to exchange  information about individuals with other entities, both within and  outside the federal government. The SSN is typically the only identifier  that government agencies and external partners have in common that  they can use to match their records.
Technological hurdles can slow replacement of SSNs in information  systems. In their questionnaire responses and follow-up  correspondence with us, officials from 14 agencies who were involved  in their agency SSN reduction efforts cited the complexity of making  required technological changes to their information systems as a  challenge to reducing the use, collection and display of SSNs.
Our preliminary results indicate that SSN reduction efforts in the federal  government also have been limited by more readily addressable  shortcomings. Lacking direction from OMB, many agencies’ reduction  plans did not include key elements, such as time frames and performance  indicators, calling into question the plans’ utility. In addition, OMB has not  required agencies to maintain up-to-date inventories of SSN collections  and has not established criteria for determining when SSN use or display  is “unnecessary,” leading to inconsistent definitions across the agencies.  Finally, OMB has not ensured that all agencies have submitted up-to-date  status reports on their SSN reduction efforts and has not established  performance measures to monitor progress on those efforts.
Agency SSN Reduction Plans Lacked Key Elements, Limiting Their  Usefulness  As previously mentioned, in May 2007, OMB issued a memorandum  requiring agencies to develop plans to eliminate the unnecessary  collection and use of SSNs, an objective that was to be accomplished  within 18 months. OMB did not set requirements for agencies on  creating effective plans to eliminate the unnecessary collection and use of  SSNs. However, other federal laws and guidance have established key  elements that performance plans generally should contain, including:
Performance goals and indicators: Plans should include tangible and  measurable goals against which actual achievement can be  compared. Performance indicators should be defined to measure  outcomes achieved versus goals.
Measurable activities: Plans should define discrete events, major  deliverables, or phases of work that are to be completed toward the  plan’s goals.
Timelines for completion: Plans should include a timeline for each  goal to be completed that can be used to gauge program  performance.
Roles and responsibilities: Plans should include a description of the  roles and responsibilities of agency officials responsible for the  achievement of each performance goal.
Our preliminary results show that the majority of plans that the 24 CFO  Act agencies originally submitted to OMB in response to its guidance  lacked key elements of effective performance plans. For example, only  two agencies (the Departments of Commerce and Education) developed  plans that addressed all four key elements. Four agencies’ plans did not  fully address any of the key elements, 9 plans addressed one or two of  the elements, and the remaining 9 plans addressed three of the elements.
Agency officials stated that, because OMB did not set a specific  requirement that SSN reduction plans contain clearly defined  performance goals and indicators, measurable activities, timelines for  completion, or roles and responsibilities, the officials were not aware that  they should address these elements. Yet, without complete performance  plans containing clearly defined performance goals and indicators,  measurable activities, timelines for completion, and roles and  responsibilities, it is difficult to determine what overall progress agencies  have achieved in reducing the unnecessary collection and use of SSNs  and the concomitant risk of exposure to identity theft. Continued progress  toward reducing that risk is likely to remain difficult to measure until  agencies develop and implement effective plans.
Not all agencies maintain an up-to-date inventory of their SSN  collections  Developing a baseline inventory of systems that collect, use, and display  SSNs and ensuring that the inventory is periodically updated can assist  managers in maintaining an awareness of the extent to which they collect  and use SSNs and their progress in eliminating unnecessary collection  and use. Standards for Internal Control in the Federal Government state  that an accurate inventory provides a detailed description of an agency’s  current state and helps to clarify what additional work remains to be done  to reach the agency’s goal.
Of the 24 CFO Act agencies we reviewed, 22 reported that, at the time  that they developed their original SSN reduction plans in fiscal years 2007  and 2008, they compiled an inventory of systems and programs that  collected SSNs. However, as of August 2016, 6 of the 24 agencies did  not have up-to-date inventories: 2 agencies that had no inventories  initially and 4 agencies that originally developed inventories but  subsequently reported that those inventories were no longer up-to-date.
These agencies did not have up-to-date inventories, in part, because  OMB M-07-16 did not require agencies to develop an inventory or to  update the inventory periodically to measure the reduction of SSN  collection and use. However, OMB has issued separate guidance that  requires agencies to maintain an inventory of systems that “create,  collect, use, process, store, maintain, disseminate, disclose, or dispose of  PII.” This guidance states that agencies are to maintain such an  inventory, in part, to allow them to reduce PII to the minimum necessary.  Without enhancing these inventories to indicate which systems contain  SSNs and using them to monitor their SSN reduction efforts, agencies will  likely find it difficult to measure their progress in eliminating the  unnecessary collection and use of SSNs.
Agency definitions of “unnecessary” collection and use have been  inconsistent  Achieving consistent results from any management initiative can be  difficult when the objectives are not clearly defined. Standards for Internal  Control in the Federal Government state that management should define  objectives in measurable terms so that performance toward achieving  those objectives can be assessed. Further, measurable objectives should  generally be free of bias and not require subjective judgments to  dominate their measurement.
In our draft report, we noted that of the 24 CFO Act agencies, 4 reported  that they had no definition of “unnecessary collection and use” of SSNs.  Of the other 20 agencies, 8 reported that their definitions were not  documented. Officials from many agencies stated that the process of  reviewing and identifying unnecessary uses of SSNs was an informal  process that relied on subjective judgments.
These agencies did not have consistent definitions of the “unnecessary  collection and use” of SSNs, in part, because OMB M-07-16 did not  provide clear criteria for determining what would be an unnecessary  collection or use of SSNs, leaving agencies to develop their own  interpretations.
Given the varying approaches that agencies have taken to determine  whether proposed or actual collections and uses of SSNs are necessary,  it is doubtful that the goal of eliminating unnecessary collection and use of  SSNs is being implemented consistently across the federal government.  Until guidance for agencies is developed in the form of criteria for making  decisions about what types of collections and uses of SSNs are  unnecessary, agency efforts to reduce the unnecessary use of SSNs  likely will continue to vary, and, as a result, the risk of unnecessarily  exposing SSNs to identity theft may not be thoroughly mitigated.
Agencies have not always submitted up-to-date status reports, and  OMB has not set performance measures to monitor agency efforts  In its Fiscal Year 2008 Report to Congress on Implementation of the  Federal Information Security Management Act of 2002, OMB recognized  that agencies’ SSN reduction plans needed to be monitored. OMB  reported that the reduction plans that agencies submitted for fiscal year  2008 displayed varying levels of detail and comprehensiveness and  stated that agency reduction efforts would require ongoing oversight.  Subsequently, OMB required agencies to report on the progress of their  SSN reduction efforts through their annual FISMA reports.
However, preliminary findings in our draft report show that annual  updates submitted by the 24 CFO Act agencies as part of their FISMA  reports from fiscal year 2013 through fiscal year 2015 did not always  include updated information about specific agency efforts and results achieved, making it difficult to determine the status of activities that had  been undertaken. Further, the annual updates did not include  performance metrics. OMB did not establish specific performance metrics  to monitor implementation of planned reduction efforts. Its guidance  asked agencies to submit their most current documentation on their plans  and progress, but it did not establish performance metrics or ask for  updates on achieving the performances metrics or targets that agencies  had defined in their plans.
Although in 2016, OMB began requesting additional status information  related to agency SSN reduction programs, it did not establish metrics for  measuring agency progress in reducing the unnecessary collection and  use of SSNs. Without performance metrics, it will remain difficult for OMB  to determine whether agencies have achieved their goals in eliminating  the unnecessary collection and use of SSNs or whether corrective actions  are needed.
In conclusion, based on preliminary information from our study of federal  SSN reduction efforts, the initiatives that the 24 CFO Act agencies have  undertaken show that it is possible to identify and eliminate the  unnecessary use and display of SSNs. However, it is difficult to determine  what overall progress has been made in achieving this goal across the  government. Not all agencies developed effective SSN reduction plans,  maintained up-to-date inventories of their SSN collection and use, or  applied consistent definitions of “unnecessary” collection, use, and  display of SSNs. Further, agencies have not always submitted up-to-date  status reports to OMB, and OMB has not established performance  measures to monitor agency efforts. Until OMB and agencies adopt better  and more consistent practices for managing their SSN reduction  processes, overall governmentwide reduction efforts will likely remain  limited and difficult to measure; moreover, the risk of SSNs being  exposed and used to commit identity theft will remain greater than it need  be.
Accordingly, our draft report contains five recommendations to OMB to  improve the consistency and effectiveness of governmentwide efforts to  reduce the unnecessary use of SSNs and thereby mitigate the risk of  identity theft. Specifically, the report recommends that OMB:  specify elements that agency plans for reducing the unnecessary  collection, use, and display of SSNs should contain and require all  agencies to develop and maintain complete plans;  require agencies to modify their inventories of systems containing PII  to indicate which systems contain SSNs and use the inventories to  monitor their reduction of unnecessary collection and use of SSNs; provide criteria to agencies on how to determine unnecessary use of  SSNs to facilitate consistent application across the federal  government;  take steps to ensure that agencies provide up-to-date status reports  on their progress in eliminating unnecessary SSN collection, use, and  display in their annual FISMA reports; and establish performance measures to monitor agency progress in  consistently and effectively implementing planned reduction efforts.
Chairman Johnson and Hurd, Ranking Members Larson and Kelly, and  Members of the Subcommittees, this completes my prepared statement. I  would be pleased to respond to any questions that you may have at this  time.
section_title: Contact and Acknowledgments
paragraphs: If you have any questions regarding this statement, please contact  Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this statement. GAO staff who  made key contributions to this testimony are John A. de Ferrari (assistant  director), Marisol Cruz, Quintin Dorsey, David Plocher, Priscilla Smith,  and Shaunyce Wallace.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.