In 1995, the latest year for which complete data were available, about 65 percent (or about 647,000) of the inmates in custody in federal and state places of confinement participated in 1 or more types of work programs.These work programs included prison industries (e.g., involving the manufacture of license plates, wood products, and textiles); facility support services (e.g., doing office and administrative work, food service, laundry, and building maintenance); farming/agriculture; and public works assignments (i.e., inmates working outside the facility on road, park, or other public maintenance work). Data entry was the type of work that most often allowed inmates access to personal information. One mission of the Federal Prison Industries (FPI), a BOP component, is to employ and provide skills training to the greatest practicable number of inmates and to produce market priced quality goods in a self-sustaining manner that minimizes potential impact on private business and labor. FPI markets about 150 types of products and services to federal agencies. Some states had similar programs and provisions. For example, Alabama generally requires state departments, institutions, and political subdivisions to purchase their products and services from Alabama Correctional Industries, to the extent to which they can be supplied. In addition, only those entities can purchase Correctional Industries products. According to the Alabama Correctional Industries purpose statement, it exists primarily for the purpose of providing a work-training program for inmates of the Department of Corrections. Another important purpose is to assist all state departments, institutions, and political sub- divisions of the State to secure their requirements to the greatest possible extent. To obtain information on the assignment objectives, we surveyed BOP and state correctional industry officials by mail. We asked the officials to answer questions on correctional industry work programs in federal, state, and privately run facilities for which the federal or state government or state-appointed organizations had oversight. We limited the questionnaire to work programs associated with secure, confined facilities, including youth authorities but excluding programs associated with prerelease facilities and city and county jails. We asked if on September 30, 1998, they had inmates who, through performing (1) work on correctional industry work program contracts that were either in progress or were agreed to but the work had not been started or (2) support work for the industry work program operations, had access to personal information or only names and addresses or telephone numbers; what prison procedures, statutes, regulations, pending legislation, or other guidelines provided guidance on (1) limiting which inmates perform work involving access to personal information and (2) preventing personal information from being retained by inmates or being transferred to unauthorized inmates or other persons; what the total gross income was for the correctional industry work program and the income generated by those contracts that resulted in inmates having access to personal information in the most recently completed fiscal year; and what incidents of misuse occurred as a result of inmates having access to the information through correctional industry work programs. We received responses from BOP, 47 states, and the District of Columbia. We did not independently verify the information provided by questionnaire respondents. We did, however, compare the questionnaire responses to the results of our current literature and legal database searches. After we consolidated the data received from the questionnaire respondents in the tables included in this report, we faxed the compiled information to all of the questionnaire respondents for confirmation of the accuracy of the data displayed and made corrections as necessary. We interviewed BOP and state officials. We also contacted states' attorneys general to obtain information on (1) incidents of misuse of which they were aware and (2) state statutes or regulations, pending legislation, or other guidelines that provided guidance on work programs involving personal information. We requested comments on a draft of this report from BOP and the Correctional Industries Association, Inc. They provided written comments that are summarized at the end of this report and are reprinted in appendixes X and XI. We performed our work from June 1998 to June 1999 in accordance with generally accepted government auditing standards. Appendix I provides more details on our objectives, scope, and methodology. On September 30, 1998, about 1,400 inmates in BOP and 19 state prison systems had access to personal information through correctional industry work programs, according to the questionnaire respondents. This number accounts for (1) about one-tenth of 1 percent of all inmates in custody as of June 30, 1998, (or approximately 1.2 million) and (2) about 2 percent of all inmates participating in correctional industry work programs (approximately 61,500). Almost all of the inmates who had access to personal information were being held in federal or state-run facilities (1,332 inmates) as opposed to privately run facilities (25 inmates). The number of inmates with access to personal information in each of the 19 states ranged from 6 in New Jersey to 426 in California. The types of information to which the largest number of inmates had access were (1) names and dates of birth or (2) Social Security numbers. About 30 percent of the inmates had access to names and (1) drivers' license numbers or (2) vehicle makes and models. Appendix II shows the number of inmates in BOP and individual state prison systems that had access to personal information on September 30, 1998, and the types of information to which they had access. Most of the inmates who had access to personal information were performing work for federal, state, or local governments (93 percent) as opposed to private sector companies (7 percent). Over half of the inmates with access to personal information were involved in data entry work. Another about 25 percent of the inmates were duplicating or scanning documents. Types of information processed in these work programs included medical records; state, county, or local licenses; automobile registrations; unemployment records; student enrollment data; and accident reports. The length of time the contracts that resulted in inmates having access to personal information had been in effect ranged from less than 1 year to 19 years. About 1 quarter of the contracts had been in place from 10 to 19 years; the remainder were more recent. The reasons BOP and states most commonly identified for selecting the contracts that resulted in inmates having access to personal information were the contracts provided valuable job skills training, satisfied a need or demand for a service, were needed to provide work for more inmates, were profitable, and provided work that was relatively easy for training inmates. Questionnaire respondents from 11 states said they planned to add and/or expand existing correctional industry work programs that allow inmates access to personal information. Respondents from 29 states said they did not plan to add or expand existing work programs that would allow inmates access to personal information, and respondents from 8 states said they did not know whether their states had plans to add and/or expand existing correctional industry work programs that would allow inmates access to personal information. In response to our survey, 29 states indicated that inmates did not have access to personal information on September 30, 1998. The more commonly stated reasons were that the opportunity had not presented itself, the prisons prohibited such work programs, and public opinion limited the feasibility of implementing such work programs. BOP and each state that had work programs in which inmates had access to personal information reported that they had in place a variety of safeguards to prevent inmates from misusing personal information. In addition, BOP and most of the states in which inmates had access to personal information reported that they had prison procedures that limited which inmates could perform work that would give them access to personal information. The federal government and seven states in which inmates had access to personal information were identified as having either enacted statutes or had bills pending that related to limiting which inmates could perform work involving personal information. The safeguards most frequently reported as being used when inmates had access to personal information were close supervision; selective hiring (e.g., excluding inmates convicted of sex offenses or fraud); confidentiality agreements; and security checks at the work area exits. Other commonly used safeguards included security checks at the work area entrances, no photocopy machines in the work area, and monitored telephone calls. Appendix III provides additional information on the safeguards cited by questionnaire respondents. BOP and most of the 19 states in which inmates had access to personal information reported that they had prison procedures that placed limitations on which inmates could perform work that would give them access to personal information. Questionnaire respondents from BOP and 18 states said that they screened inmates before hiring them for work programs involving personal information. For example, one state respondent said that inmates who were convicted of rape or who have life sentences were ineligible to work on contracts where they would have access to personal information. In addition, in the course of our work, statutes or proposed legislation related to this issue were identified in seven of the states as well as the federal government in which inmates had access to personal information. A brief summary of these provisions is provided in appendix IV, table IV.1. Further, six states were identified in which inmates did not have access to personal information that had enacted statutes or introduced legislation that related to this issue. For more information on these statutes and pending bills, see appendix IV, table IV.2. Less than one-hundredth of 1 percent of the BOP's annual gross correctional industry income of $568 million was generated from its contract that allowed inmates access to personal information. For those states in which inmates had access to personal information, no more than 22 percent of any state's gross fiscal year 1998 correctional industry income was generated from these contracts; six states reported that less than 1 percent of their gross correctional industry income was earned from these contracts. In total, these states grossed about $18 million in 1998 from correctional industry work program contracts that allowed inmates access to personal information, compared to an annual gross correctional industry income of about $515 million. Appendix V provides information on the income generated from these contracts. About 5,500 inmates, in BOP and 31 state prison systems, had access to only names and addresses or telephone numbers through correctional industry work programs. Over half of these inmates were in the custody of BOP. Appendix VI presents these data by BOP and state. The types of work inmates were performing in the largest number of states in which they had this access were order fulfillment, data entry, shipping, and printing. For additional information on the types of work performed by inmates with access to only names and addresses or telephone numbers, see appendix VII. The safeguards that BOP and most states reported using when inmates had access to only names and addresses or telephone numbers were similar to those reported being used when inmates had access to personal information. The most commonly used safeguards reported by states included close supervision while working, security checks at the exits from the work areas, selective hiring, and security checks at the entrances to the work areas. For additional information on safeguards that BOP and states used when inmates had access to only names and addresses or telephone numbers, see appendix VIII. Questionnaire respondents from eight states reported a total of nine incidents in which inmates misused personal information or names and addresses or telephone numbers that they obtained from a correctional industry work program. We defined misuse of information as any action that threatened or caused injury to the physical, psychological, or financial well-being of any member of the public. Each of these incidents was associated with a different contract. Six of the incidents involved inmates contacting individuals identified through a work program by telephone or by mail (in one of these instances, the inmate in the work program passed information on an individual to another inmate, who then contacted the individual). Two incidents involved inmates using credit card numbers that they obtained through participating in a work program. The other incident involved two inmates' attempts to smuggle copies of documents out of the prison through the U.S. mail. Five of the contracts related to these incidents were terminated after the incident occurred. In three of the four other incidents, the prison responded by either adding new safeguards or reinforcing existing safeguards used on the contract. In the remaining incident, the prison's procedures remained the same. For more information on these incidents, see appendix IX. Questionnaire respondents also provided information on four additional incidents that did not meet the previously described criteria for misuse of personal information. On the basis of one or more of the following reasons, these four incidents were not included in appendix IX: no reported injury, a court finding of no wrongdoing, or termination of the inmate from the work program on the basis of an allegation or suspected wrongdoing. These incidents, however, resulted in some type of program change. The types of program changes ranged from adding or reinforcing policies and safeguards to program termination. Briefly, these incidents, as reported by the respondents, consisted of the following: An inmate was processing accident reports in a data entry work program. He told another inmate, not in the work program, about an individual involved in one of the accident reports he processed. The other inmate contacted the individual involved in the accident. The questionnaire respondent reported that nobody was harmed, safeguards did not fail, and no sanctions were taken. After this incident, the state reportedly reinforced its policies and safeguards associated with this contract. An inmate working in a data entry work program saw, reportedly by accident, a state document that had information about one of his family members. He spoke with another member of his family about the information he saw. A member of his family filed a lawsuit claiming that the inmate should not have had access to this information. The questionnaire respondent reported that the case was dismissed because the information was covered by an open record regulation whereby birth records are considered to be public records. The state, however, canceled the contract for processing this type of information. An inmate working in a telemarketing work program was accused of harassing a customer. The inmate was terminated and transferred to maximum security on the basis of the allegation alone. The state reportedly implemented additional safeguards after the alleged incident was reported. An inmate wrote a letter to an individual, and it was suspected that the inmate obtained the individual's name and address through the work program. According to the survey response, the inmate was disciplined and terminated from the work program, and a measure providing for the closer monitoring of inmates was instituted. In commenting on our report, BOP concurred with our report with one exception. BOP noted that since our survey, it changed its procedures, and no inmates in the BOP prison system have access to personal information. Since our methodology was to report on the number of inmates who had access to personal information on September 30, 1998, we did not eliminate the 25 BOP inmates who we reported as having access to personal information. (See app. X.) The Correctional Industries Association, Inc., in its comments said that our report was fair and thorough and presented the facts objectively. However, it took two exceptions with the report. First, the Association said that the information on inmates' access to personal information is presented largely out of context. We disagree. Our draft report said that of approximately 1.2 million inmates, about 1,400 in BOP and 19 state prison systems had access to personal information through correctional industry work programs. We noted that less than one-hundredth of 1 percent of BOP's and no more than 22 percent of any state's fiscal year 1998 gross correctional industry income was generated from contracts that resulted in inmates having access to personal information. Further, we pointed out that about a quarter of the contracts that resulted in inmates having access to personal information had been in place from 10 to 19 years. Second, the Association said that a benchmark is needed against which the success or failure of correctional industries to control access issues can be measured. We did not judge whether the correctional industries have succeeded or failed in their attempt to prevent the misuse of personal information to which inmates had access as the result of work programs because we are not aware of criteria by which to make such a judgment. However, given that the inmates with access to personal information are individuals who have been incarcerated for crimes, and given that the institutional settings permit work program officials to exercise close scrutiny over the inmates and work places, breaches of security and misuses of personal information are a cause for concern. (See app. XI.) As agreed, unless you announce the contents of this report earlier, we plan no further distribution until 30 days from the date of this letter. At that time, we will send copies of this report to the Honorable Janet Reno, Attorney General; the Honorable Kathleen Hawk Sawyer, Director, BOP; Ms. Gwyn Smith Ingley, Executive Director, Correctional Industries Association, Inc.; the states that responded to our survey; and other interested parties. Copies will also be made available to others upon request. The major contributors to this report are acknowledged in appendix XII. If you or your staff have any questions about the information in this report, please contact me or Brenda Bridges on (202) 512-8777. The objectives of our study were to determine the extent to which inmates in the BOP and state prison systems had access to personal information through correctional industry work programs; identify prison safeguards and procedures, statutes and regulations, and proposed legislation that addressed correctional industry work programs involving personal information; determine the extent to which contracts that provided inmates access to personal information contributed to BOP's and states' correctional industry income; determine the extent to which inmates in the BOP and state prison systems had access to only names and addresses or telephone numbers through correctional industry work programs; and identify incidents of inmates misusing information obtained through a correctional industry work program, including how safeguards failed and what, if any, changes were made as a result of the incidents. For our study, we defined correctional industry work programs as programs that produced products and services for sale to government agencies and/or to the private sector. We excluded institutional work programs, i.e., programs that would involve activities such as housekeeping, food services, day-to-day maintenance, and community service, as well as support programs in which an inmate may have inadvertently seen personal information. The scope of our study included work programs that were (1) overseen by BOP, a state government, or a state-appointed commission; (2) associated with federal, state, or privately run facilities; and (3) associated with secure, confined facilities--including youth authorities--but not programs associated with prerelease facilities or city or county jails. We defined "personal information" as information that could be used to threaten an individual's physical, psychological, or financial well-being. This information would include (1) credit card numbers (personal or business); (2) Social Security numbers; or (3) names in combination with physical descriptions or financial, medical, or motor vehicle information. We also collected data on inmates' access to "names and addresses or telephone numbers," which included a name and one or more of the following: work or home address or telephone number, name of employer, or job title but no other item that we defined as personal information. To meet the assignment objectives, we surveyed, by mail, correctional industry officials in BOP, all 50 states, and the District of Columbia. The questionnaire asked for information on the following: correctional industry work program contracts that involved personal information that were either orders-in-progress or that had been agreed to but had not yet been started on September 30, 1998; the number of inmates who had access to personal information or to names and addresses or telephone numbers through correctional industry work program contracts or support work; safeguards that were in place to prevent inmates from misusing the statutes, regulations, procedures, other guidelines, and proposed legislation that dealt with correctional industry work programs involving personal information; the gross income in the most recently completed fiscal year for the correctional industry work program overall and for those contracts that involved personal information; and incidents of misuse of information that occurred at any time as a result of inmate access to the information through a correctional industry work program. We asked questionnaire respondents for information on inmates who had access to (1) personal information or (2) names and addresses or telephone numbers, either through working on a correctional industry work program contract or through performing support work for the industry work program operations. We defined a contract as a formal or informal agreement to produce a specific product or perform a specific service. We defined inmates who were performing support work as inmates who were not associated with a specific correctional industry work program contract but who performed tasks--such as order taking, order fulfillment, manufacturing or customer support, complaint resolution, or shipping--that supported the industry work program operations. In designing our questionnaire, we received input from the Correctional Industries Association, Inc. (a nonprofit professional organization representing individuals and agencies engaged in and concerned with correctional industries) and federal and state correctional industry officials. We revised the questionnaire based on the feedback these officials provided. We made further changes based on input from correctional industry officials as a result of pilot testing the survey instrument in Maryland and Virginia. To identify questionnaire recipients, we called the contact point for each state's correctional industry program as identified in the 1998 Correctional Industries Association, Inc., Directory. We informed them of our assignment and asked whether they would be the proper recipients for the questionnaire. We asked these officials if their state had any privately run prisons that housed inmates from their state prison system or from other states' prison systems. If they had such facilities, we asked them to identify the individual who had oversight responsibilities for work programs in these facilities. To further ensure that we had a respondent for each privately run facility that met our criteria (i.e., the facility was a secure, confined facility-- including youth authorities--but not a prerelease facility or city or county jail, and any work programs in the facility would be overseen by BOP, a state government, or a state-appointed commission), we obtained a list of privately run correctional facilities from the Private Corrections Project Internet web site. We then contacted the individuals whom we had identified as overseeing work programs at privately run facilities to ensure that they had responsibility for each facility that met our criteria. If they stated that they did not have responsibility, we asked them who did and repeated this procedure until we reached the appropriate party. We mailed a total of 63 questionnaires: 1 to BOP, 1 to each state and the District of Columbia, 1 to a youth authority, 1 to a joint venture program, and 1 each to 9 privately run facilities that had been identified by the method described above. Representatives from two states, Arizona and Tennessee, informed us that they would not be participating in our survey. Ohio's representative also indicated that he would not be completing the questionnaire but told us that Ohio does not permit inmates involved in data entry to have access to credit card numbers or Social Security numbers. When we received the questionnaires, we followed-up by telephone on missing or incomplete data, consolidated the data into the tables displayed in this report, faxed the completed tables to all questionnaire respondents for confirmation of the accuracy of the data displayed, and made corrections as necessary. Questionnaire respondents were provided only with compiled data concerning their individual states. We also conducted literature and legal database searches to identify published articles, reports, studies, statutes, proposed bills, and other documents dealing with the assignment objectives. We contacted representatives from various organizations to determine what information they may have that related to our assignment objectives. These organizations included the American Correctional Association; Correctional Industries Association, Inc.; American Jail Association; American Federation of Labor and Congress of Industrial Organizations; and Union of Needletraders, Industrial and Textile Employees. We contacted each state's attorney general's office and the District of Columbia's Corporation Counsel to identify any additional (1) incidents of inmates misusing information obtained through correctional industry work programs and (2) state statutes or regulations, proposed legislation, or other guidance that dealt with correctional industry work programs involving personal information. We did not verify the completeness of the information provided. We contacted various federal agencies with investigatory responsibilities to determine if they were aware of instances of inmates misusing personal information that they obtained through correctional industry work programs. Within the Department of the Treasury, we contacted the Internal Revenue Service's Criminal Investigation Division and the U.S. Secret Service. Within the Department of Justice, we contacted the Federal Bureau of Investigation. Finally, we contacted the U.S. Postal Service and the Social Security Administration. We performed our work between June 1998 and June 1999 in accordance with generally accepted government auditing standards. Oklahoma (cont.) State agency 20 Oregon State agency 1 State agency 2 Pennsylvania Rhode Island South Carolina South Dakota Vermont Virginia Washington West Virginia Wisconsin 84 Note 1: Personal information means information that can be used to threaten an individual's physical, psychological, or financial well-being. This information would include (1) credit card numbers (personal or business); (2) Social Security numbers; or (3) names in combination with physical descriptions or financial, medical, or motor vehicle information. This table does not include inmates who had access to only names and one or more of the following: work or home address or telephone number, name of employer, or job title. For that information, see appendix VI. Note 2: States with "NR" in each category did not return a questionnaire. We received a questionnaire from Arizona's privately run facilities. These facilities did not have any inmates who had access to names, addresses, telephone numbers, or other types of personal information. A representative from Ohio's state-run facilities informed us that inmates involved in data entry work programs did not have access to credit card numbers or Social Security numbers. We did not receive any information from respondents in state-run correctional facilities in Arizona or Tennessee. Note 3: The numbers shown above represent the maximum numbers of inmates who would have had access to each type of personal information. Some inmates worked on more than one contract. Consequently, as in Oklahoma, totals are not the sum of the number of inmates shown for each contract. Also, we asked respondents for the types of personal information to which inmates had access. However, each inmate may not have had access to all of the types of personal information involved in a contract. Note 4: According to the questionnaire respondents, the data from Idaho represent the combined information from two contracts, and the data from New Hampshire were combined from five contracts. Illinois' data represent one contract situated in two geographic locations. Note 1: Personal information means information that can be used to threaten an individual's physical, psychological, or financial well-being. This information would include (1) credit card numbers (personal or business); (2) Social Security numbers; or (3) names in combination with physical descriptions or financial, medical, or motor vehicle information. Note 2: A blank means that the questionnaire respondent did not report using the safeguard in the work program. Note 3: According to the questionnaire respondents, the data from Idaho represent the combined information from two contracts, and the data from New Hampshire were combined from five contracts. Illinois' data represent one contract situated in two geographic locations. California Penal Code, Section 5071: in general, prohibits prison inmates convicted of offenses involving, for example, misuse of a computer, misuse of personal/financial information of another person, or a sex offense from performing prison employment functions that provide such inmates with access to certain types of personal informationSee also California Welfare Institutions Code, Section 219.5: (language similar to above code section-- applicable to juveniles) New York Pending Assembly Bill 4753 (1999): in general, inmates involved in correctional institution work would be prohibited from accessing, collecting, or processing certain types of personal information See also New York Pending Assembly Bill 4842 (1999): (language similar to the above bill) Wisconsin Pending Assembly Bill 31 (1999): would prohibit the Department of Corrections from entering into any contract or other agreement if, in the performance of the contract or agreement, a prisoner would have access to any personal information of individuals who are not prisoners This section also was identified by the state as requiring that such persons in prison work programs disclose that fact before taking any personal information from anyone. Percentage of FY 1998 correctional industry gross income from personal information contracts Note 1: Personal information means information that can be used to threaten an individual's physical, psychological, or financial well-being. This information would include (1) credit card numbers (personal or business); (2) Social Security numbers; or (3) names in combination with physical descriptions or financial, medical, or motor vehicle information. Note 2: Dollar amounts were rounded to the nearest thousand. Totals may not add due to rounding. Percentages were rounded to the nearest tenth. Less than $1,000. State does not have a breakdown by individual contract. Note 1: Names and addresses mean names and one or more of the following: work or home addresses or telephone numbers, names of employer, or job titles but no other item that we defined as personal information. Note 2: States with "NR" in each category did not return a questionnaire. We received a questionnaire from Arizona's privately run facilities. These facilities did not have any inmates who had access to names, addresses, telephone numbers, or other types of personal information. A representative from Ohio's state-run facilities informed us that inmates involved in data entry work programs did not have access to credit card numbers or Social Security numbers. We did not receive any information from respondents in state-run correctional facilities in Arizona or Tennessee. C = Type of work performed by inmates who had access to information through work program contracts, which is a formal or informal agreement to produce a specific product or perform a specific service. S = Type of work performed by inmates who had access to information through support work, which is not associated with a specific contract, but tasks such as order taking or shipping that supported overall industry work program operations. C/S = Inmates performed this type of work both on contracts and through support work. Inmates working in Washington's correctional facilities have access to names, work addresses, and work telephone numbers only. Wyoming failed to designate type of work performed by inmates. C C = Safeguard applied to inmates who had access to types of information through a contract, which is a formal or informal agreement to produce a specific product or perform a specific service. S = Safeguard applied to inmates who had access to types of information through performing support work, which is not associated with a specific contract, but tasks such as order taking or shipping that supported overall industry work program operations. C/S = Safeguard applied to inmates who had access to types of information as a result of employment on both contracts and through support work. Note 1: Names and addresses mean names and one or more of the following: work or home addresses or telephone numbers, names of employer, or job titles but no other item that we defined as personal information. Note 2: A blank means that the questionnaire respondent did not report using the safeguard. Note 3: This table does not include inmates who had access to names and addresses or telephone numbers and any other item(s) that we defined as personal information. See appendix III for a list of safeguards that respondents reported using for inmates who had access to personal information. IPersonal information was segmented among inmates. Surveillance mirrors, security cameras, restricted work area, raw materials/supplies control, and random strip searches were employed. Inmates working in Washington's correctional facilities had access to names, work addresses, and work telephone numbers only. Date and description of incident In 1991, while on parole an inmate used credit card numbers previously obtained from a prison telemarketing work program. In 1995, an inmate wrote a letter to a Medicare patient identified from information obtained in a data entry work program. In the mid-90s, an inmate participating in a work program provided another inmate with a name and address obtained through the work program. The second inmate wrote a letter to the individual whose name and address were provided. In about 1990, an inmate obtained information, through participating in a data entry work program, about an individual's medical expenses and wrote the individual a letter. In 1995, two inmates attempted to smuggle copies of birth certificates obtained through a work program out of prison through the U.S. mail system. The birth certificates were sent back to the prison via return mail. In 1995, an inmate continued to call a particular individual identified through a work program that telemarketed local newspaper subscriptions. Date and description of incident In 1990 or 1991, an inmate used a credit card number, obtained from a work program making motel reservations, for personal purchases. In the early 1990's, an inmate wrote a letter to an individual identified through a data entry work program and included personal information also obtained through the work program. In 1997, an inmate sent a Christmas card to an individual identified through a 1-800 information line. The individual had called for information on state parks. Mary Lane Renninger Nancy A. Briggs Geoffrey R. Hamilton David P. Alexander Stuart M. Kaufman Michael H. Little The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touch-tone phone. A recorded menu will provide information on how to obtain these lists.

Summary:
Pursuant to a congressional request, GAO provided information on: (1) the extent to which inmates in the Bureau of Prisons (BOP) and state prison systems had access to personal information through correctional industry work programs; (2) prison safeguards and procedures, statutes and regulations, and proposed legislation that addressed correctional industry work programs involving personal information; (3) the extent to which contracts that provided inmates access to personal information contributed to BOP's and states' correctional industry income; (4) the extent to which BOP and state prison inmates had access to only names and addresses or telephone numbers through correctional industry work programs; and (5) incidents of inmates misusing information obtained through correctional industry work programs, including how safeguards failed and what, if any, changes were made as a result of the incidents. GAO noted that: (1) on September 30, 1998, of approximately 1.2 million inmates, about 1,400 in BOP and 19 state prison systems had access to personal information through correctional industry work programs, based on the questionnaire responses from correctional industry officials; (2) of these 1,400 inmates, about 1,100 had access to names and dates of birth or Social Security numbers; (3) these inmates were performing work, such as data entry, for the federal, state, or local governments; (4) BOP and all the 19 states reported using a variety of safeguards to prevent inmates from misusing the information; (5) the safeguards cited by the largest number of states were close supervision, selective hiring (e.g., excluding inmates convicted of sex offenses or fraud), confidentiality agreements, and security checks at the exits from the work areas; (6) the federal government and seven states in which inmates had access to personal information were identified as having either enacted statutes or had bills pending that related to limiting which inmates could perform work involving personal information; (7) less than one-hundredth of 1 percent of BOP's and no more than 22 percent of any state's fiscal year 1998 gross correctional industry income was generated from contracts that resulted in inmates having access to personal information; (8) six states reported that less than 1 percent of their gross correctional industry income was earned from these contracts; (9) about 5,500 inmates in BOP and 31 state prison systems had access to only names and addresses or telephone numbers through correctional industry work program contracts or support work; (10) the three safeguards that the largest number of states and BOP reported using were similar to those used when inmates had access to personal information--close supervision, security checks at the exits from the work areas, and selective hiring; (11) questionnaire respondents described nine incidents in which inmates misused personal information or names and addresses or telephone numbers obtained from correctional industry work programs; (12) in four of the nine incidents, inmates removed information from the work areas, either physically or by memorization; and (13) in five of the incidents, the work programs were discontinued.