Social Security Numbers: OMB and Federal Efforts to Reduce Collection, Use, and Display
Released: 2017-05-23T00:00:00

Letter

Background

In 1936, following the enactment of the Social Security Act of 1935, the newly-formed Social Security Board (which later became SSA) created the 9-digit SSN to uniquely identify and determine Social Security benefit entitlement levels for U.S. workers. Originally, the SSN was not intended to serve as a personal identifier but, due to its universality and uniqueness, government agencies and private sector entities now use it as a convenient means of identifying people. The number uniquely links identities across a very broad array of public and private sector information systems. As of September 2016, SSA had issued approximately 496 million unique SSNs to eligible individuals.

In 2006, the President issued an Executive Order establishing the Identity Theft Task Force to strengthen efforts to protect against identity theft. Because the unauthorized use of SSNs was recognized as a key element of identity theft, the task force assessed the actions the government could take to reduce the exposure of SSNs to potential compromise. In April 2007, the task force issued a strategic plan, which advocated a unified federal approach, or standard, for using and displaying SSNs. The plan proposed that OPM, OMB, and SSA play key roles in restricting the unnecessary use of the numbers, offering guidance on substitutes that are less valuable to identity thieves, and promoting consistency when the use of SSNs was found to be necessary or unavoidable.

OPM, OMB, and SSA Have Had Limited Success in Assisting With Governmentwide Reduction in the Collection, Use, and Display of SSNs

In response to the recommendations of the Identity Theft Task Force, OPM, OMB, and SSA undertook several actions aimed at reducing or eliminating the unnecessary collection, use, and display of SSNs. However, in our draft report, we determined that these actions have had limited success.

OPM Issued Guidance and a Proposed Rule That was Subsequently Cancelled

OPM took several actions in response to the task force recommendations. Using an inventory of its forms, procedures, and systems displaying SSNs that it had developed in 2006, the agency took action to change, eliminate, or mask the use of SSNs on OPM approved/authorized forms, which are used by agencies across the government for personnel records. In addition, in 2007, OPM issued guidance to other federal agencies on actions they should take to protect federal employee SSNs and combat identity theft. The guidance reminded agencies of existing federal regulations that restricted the collection and use of SSNs and also specified additional measures.

In addition to issuing this guidance, in January 2008, OPM proposed a new regulation regarding the collection, use, and display of SSNs that would have codified the practices outlined in its 2007 guidance and that also required the use of an alternate identifier. However, in January 2010, after reviewing comments it had received, OPM withdrew the notice of proposed rulemaking because the agency determined that it would be impractical to issue the rule without an alternate governmentwide employee identifier in place.

In 2015, OPM briefly began exploring the concept of developing and using multiple alternate identifiers for different programs and agencies. As envisioned, an SSN would be collected only once, at the start of an employee’s service, after which unique identifiers specific to relevant programs, such as healthcare benefits or training, would be assigned as needed. However, officials from OPM’s Office of the Chief Information Officer stated that work on the initiative was suspended in 2016 due to a lack of funding.

OMB Established Reporting Requirements for Agency SSN Reduction Efforts

In May 2007, OMB issued a memorandum officially requiring agencies to review their use of SSNs in agency systems and programs to identify instances in which the collection or use of the number was superfluous. Agencies were also required to establish a plan, within 120 days from the date of the memorandum, to eliminate the unnecessary collection and use of SSNs within 18 months. Lastly, the memorandum required agencies to participate in governmentwide efforts, such as surveys and data calls, to explore alternatives to SSN use as a personal identifier for both federal employees and in federal programs.

Since issuing its May 2007 memorandum requiring the development of SSN reduction plans, OMB has instructed agencies to submit updates to their plans and documentation of their progress in eliminating unnecessary uses of SSNs as part of their annual reports originally required by the Federal Information Security Management Act of 2002 and now required by the Federal Information Security Modernization Act of 2014 (FISMA).

SSA Established, but Then Discontinued, an Online Information Sharing Clearinghouse

The Identity Theft Task Force recommended that, based on the results of OMB’s review of agency practices on the use of SSNs, SSA should establish a clearinghouse of agency practices and initiatives that had minimized the use and display of SSNs. The purpose of the clearinghouse was to facilitate the sharing of “best” practices—including the development of any alternative strategies for identity management— to avoid duplication of effort, and to promote interagency collaboration in the development of more effective measures for minimizing the use and display of SSNs.

In 2007, SSA established a clearinghouse on an electronic bulletin board website to showcase best practices and provided agency contacts for specific programs and initiatives. However, according to officials in SSA’s Office of the Deputy Commissioner, the clearinghouse is no longer active. The officials added that SSA did not maintain any record of the extent to which the clearinghouse was accessed or used by other agencies when it was available online. Further, the officials said SSA has no records of when or why the site was discontinued.

Agencies Reported Reducing Their Use and Display of SSNs and Cited Ongoing Challenges; Moreover, Poor Planning and Ineffective Monitoring Have Limited Their Efforts

Based on their responses to our questionnaire on SSN reduction efforts in our draft report, all of the 24 CFO Act agencies reported taking a variety of steps to reduce such collection, display, and use. However, officials involved in the reduction efforts at these agencies stated that SSNs cannot be completely eliminated from federal IT systems and records. In some cases, no other identifier offers the same degree of universal awareness or applicability. Even when reductions are possible, challenges in implementing them can be significant. In our draft report, three key challenges were frequently cited by these officials:

Statutes and regulations require collection and use of SSNs. In their questionnaire responses and follow-up correspondence with us, officials from 15 agencies who were involved in their agencies’ SSN reduction efforts noted that they are limited in their ability to reduce the collection of SSNs because many laws authorize or require such collection. These laws often explicitly require agencies to use SSNs to identify individuals who are engaged in transactions with the government or who are receiving benefits disbursed by federal agencies.

Interactions with other federal and external entities require use of the SSN. In their questionnaire responses and follow-up correspondence with us, officials from 16 agencies noted that the necessity to communicate with other agencies and external entities limited their reduction efforts. Federal agencies must be able to cite a unique, common identifier to ensure that they are matching their information to the correct records in the other entities’ systems in order to exchange information about individuals with other entities, both within and outside the federal government. The SSN is typically the only identifier that government agencies and external partners have in common that they can use to match their records.

Technological hurdles can slow replacement of SSNs in information systems. In their questionnaire responses and follow-up correspondence with us, officials from 14 agencies who were involved in their agency SSN reduction efforts cited the complexity of making required technological changes to their information systems as a challenge to reducing the use, collection and display of SSNs.

Our preliminary results indicate that SSN reduction efforts in the federal government also have been limited by more readily addressable shortcomings. Lacking direction from OMB, many agencies’ reduction plans did not include key elements, such as time frames and performance indicators, calling into question the plans’ utility. In addition, OMB has not required agencies to maintain up-to-date inventories of SSN collections and has not established criteria for determining when SSN use or display is “unnecessary,” leading to inconsistent definitions across the agencies. Finally, OMB has not ensured that all agencies have submitted up-to-date status reports on their SSN reduction efforts and has not established performance measures to monitor progress on those efforts.

Agency SSN Reduction Plans Lacked Key Elements, Limiting Their Usefulness As previously mentioned, in May 2007, OMB issued a memorandum requiring agencies to develop plans to eliminate the unnecessary collection and use of SSNs, an objective that was to be accomplished within 18 months. OMB did not set requirements for agencies on creating effective plans to eliminate the unnecessary collection and use of SSNs. However, other federal laws and guidance have established key elements that performance plans generally should contain, including:

Performance goals and indicators: Plans should include tangible and measurable goals against which actual achievement can be compared. Performance indicators should be defined to measure outcomes achieved versus goals.

Measurable activities: Plans should define discrete events, major deliverables, or phases of work that are to be completed toward the plan’s goals.

Timelines for completion: Plans should include a timeline for each goal to be completed that can be used to gauge program performance.

Roles and responsibilities: Plans should include a description of the roles and responsibilities of agency officials responsible for the achievement of each performance goal.

Our preliminary results show that the majority of plans that the 24 CFO Act agencies originally submitted to OMB in response to its guidance lacked key elements of effective performance plans. For example, only two agencies (the Departments of Commerce and Education) developed plans that addressed all four key elements. Four agencies’ plans did not fully address any of the key elements, 9 plans addressed one or two of the elements, and the remaining 9 plans addressed three of the elements.

Agency officials stated that, because OMB did not set a specific requirement that SSN reduction plans contain clearly defined performance goals and indicators, measurable activities, timelines for completion, or roles and responsibilities, the officials were not aware that they should address these elements. Yet, without complete performance plans containing clearly defined performance goals and indicators, measurable activities, timelines for completion, and roles and responsibilities, it is difficult to determine what overall progress agencies have achieved in reducing the unnecessary collection and use of SSNs and the concomitant risk of exposure to identity theft. Continued progress toward reducing that risk is likely to remain difficult to measure until agencies develop and implement effective plans.

Not all agencies maintain an up-to-date inventory of their SSN collections Developing a baseline inventory of systems that collect, use, and display SSNs and ensuring that the inventory is periodically updated can assist managers in maintaining an awareness of the extent to which they collect and use SSNs and their progress in eliminating unnecessary collection and use. Standards for Internal Control in the Federal Government state that an accurate inventory provides a detailed description of an agency’s current state and helps to clarify what additional work remains to be done to reach the agency’s goal.

Of the 24 CFO Act agencies we reviewed, 22 reported that, at the time that they developed their original SSN reduction plans in fiscal years 2007 and 2008, they compiled an inventory of systems and programs that collected SSNs. However, as of August 2016, 6 of the 24 agencies did not have up-to-date inventories: 2 agencies that had no inventories initially and 4 agencies that originally developed inventories but subsequently reported that those inventories were no longer up-to-date.

These agencies did not have up-to-date inventories, in part, because OMB M-07-16 did not require agencies to develop an inventory or to update the inventory periodically to measure the reduction of SSN collection and use. However, OMB has issued separate guidance that requires agencies to maintain an inventory of systems that “create, collect, use, process, store, maintain, disseminate, disclose, or dispose of PII.” This guidance states that agencies are to maintain such an inventory, in part, to allow them to reduce PII to the minimum necessary. Without enhancing these inventories to indicate which systems contain SSNs and using them to monitor their SSN reduction efforts, agencies will likely find it difficult to measure their progress in eliminating the unnecessary collection and use of SSNs.

Agency definitions of “unnecessary” collection and use have been inconsistent Achieving consistent results from any management initiative can be difficult when the objectives are not clearly defined. Standards for Internal Control in the Federal Government state that management should define objectives in measurable terms so that performance toward achieving those objectives can be assessed. Further, measurable objectives should generally be free of bias and not require subjective judgments to dominate their measurement.

In our draft report, we noted that of the 24 CFO Act agencies, 4 reported that they had no definition of “unnecessary collection and use” of SSNs. Of the other 20 agencies, 8 reported that their definitions were not documented. Officials from many agencies stated that the process of reviewing and identifying unnecessary uses of SSNs was an informal process that relied on subjective judgments.

These agencies did not have consistent definitions of the “unnecessary collection and use” of SSNs, in part, because OMB M-07-16 did not provide clear criteria for determining what would be an unnecessary collection or use of SSNs, leaving agencies to develop their own interpretations.

Given the varying approaches that agencies have taken to determine whether proposed or actual collections and uses of SSNs are necessary, it is doubtful that the goal of eliminating unnecessary collection and use of SSNs is being implemented consistently across the federal government. Until guidance for agencies is developed in the form of criteria for making decisions about what types of collections and uses of SSNs are unnecessary, agency efforts to reduce the unnecessary use of SSNs likely will continue to vary, and, as a result, the risk of unnecessarily exposing SSNs to identity theft may not be thoroughly mitigated.

Agencies have not always submitted up-to-date status reports, and OMB has not set performance measures to monitor agency efforts In its Fiscal Year 2008 Report to Congress on Implementation of the Federal Information Security Management Act of 2002, OMB recognized that agencies’ SSN reduction plans needed to be monitored. OMB reported that the reduction plans that agencies submitted for fiscal year 2008 displayed varying levels of detail and comprehensiveness and stated that agency reduction efforts would require ongoing oversight. Subsequently, OMB required agencies to report on the progress of their SSN reduction efforts through their annual FISMA reports.

However, preliminary findings in our draft report show that annual updates submitted by the 24 CFO Act agencies as part of their FISMA reports from fiscal year 2013 through fiscal year 2015 did not always include updated information about specific agency efforts and results achieved, making it difficult to determine the status of activities that had been undertaken. Further, the annual updates did not include performance metrics. OMB did not establish specific performance metrics to monitor implementation of planned reduction efforts. Its guidance asked agencies to submit their most current documentation on their plans and progress, but it did not establish performance metrics or ask for updates on achieving the performances metrics or targets that agencies had defined in their plans.

Although in 2016, OMB began requesting additional status information related to agency SSN reduction programs, it did not establish metrics for measuring agency progress in reducing the unnecessary collection and use of SSNs. Without performance metrics, it will remain difficult for OMB to determine whether agencies have achieved their goals in eliminating the unnecessary collection and use of SSNs or whether corrective actions are needed.

In conclusion, based on preliminary information from our study of federal SSN reduction efforts, the initiatives that the 24 CFO Act agencies have undertaken show that it is possible to identify and eliminate the unnecessary use and display of SSNs. However, it is difficult to determine what overall progress has been made in achieving this goal across the government. Not all agencies developed effective SSN reduction plans, maintained up-to-date inventories of their SSN collection and use, or applied consistent definitions of “unnecessary” collection, use, and display of SSNs. Further, agencies have not always submitted up-to-date status reports to OMB, and OMB has not established performance measures to monitor agency efforts. Until OMB and agencies adopt better and more consistent practices for managing their SSN reduction processes, overall governmentwide reduction efforts will likely remain limited and difficult to measure; moreover, the risk of SSNs being exposed and used to commit identity theft will remain greater than it need be.

Accordingly, our draft report contains five recommendations to OMB to improve the consistency and effectiveness of governmentwide efforts to reduce the unnecessary use of SSNs and thereby mitigate the risk of identity theft. Specifically, the report recommends that OMB: specify elements that agency plans for reducing the unnecessary collection, use, and display of SSNs should contain and require all agencies to develop and maintain complete plans; require agencies to modify their inventories of systems containing PII to indicate which systems contain SSNs and use the inventories to monitor their reduction of unnecessary collection and use of SSNs; provide criteria to agencies on how to determine unnecessary use of SSNs to facilitate consistent application across the federal government; take steps to ensure that agencies provide up-to-date status reports on their progress in eliminating unnecessary SSN collection, use, and display in their annual FISMA reports; and establish performance measures to monitor agency progress in consistently and effectively implementing planned reduction efforts.

Chairman Johnson and Hurd, Ranking Members Larson and Kelly, and Members of the Subcommittees, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time.

Contact and Acknowledgments

If you have any questions regarding this statement, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are John A. de Ferrari (assistant director), Marisol Cruz, Quintin Dorsey, David Plocher, Priscilla Smith, and Shaunyce Wallace.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.