Because the SSN is unique for every individual, both the public and private sectors increasingly use it as a universal identifier. It is particularly useful to government for data matching or identity verification to ensure that individuals are eligible for program benefits or services. Though the use of SSNs by government entities is often mandated or authorized by law, there is no one law that regulates the overall use of SSNs by all levels and branches of government, and state laws pertaining to SSN display vary in terms of the restrictions they impose on both use and disclosure. Due to the pervasive use of SSNs, individuals are routinely asked to disclose their SSNs along with other personal, identifying information, for numerous purposes. In some instances where individuals provide their SSNs to government entities, documents containing the SSN are routinely made available to the public for inspection. Generally, the overall use and disclosure of SSNs by the federal government is restricted under the Privacy Act, which, broadly speaking, seeks to balance the government’s need to maintain information about individuals with the rights of individuals to be protected against unwarranted invasions of their privacy. Section 7 of Public Law 93-579 requires that any federal, state, or local government agency, when requesting an SSN from an individual, tell individuals whether disclosing their SSN is mandatory or voluntary, cite the statutory or other authority under which the request is being made, and state what uses it will make of the individual’s SSN. Based on a survey for prior work, we reported that while nearly all government entities we surveyed collect and use SSNs for a variety of reasons, many of these entities reported they do not provide individuals the information required under this statute when requesting their SSNs. Further, it is unclear who has responsibility for overseeing these requirements placed on state and local governments. The growth in the use of SSNs is important to individual SSN holders because these numbers, along with names and birth dates, are among the three personal identifiers most often sought by identity thieves, and recent statistics indicate that the incidence of identity theft is growing. The widespread disclosure of SSNs in public records has raised concern because it can put individuals at increased risk for identity theft. The passage of identity theft legislation by the federal government and state governments indicates that this type of crime is widely recognized as a serious problem. Some of these laws include limits or restrictions on the display of SSNs, and government agencies have taken other measures to restrict the exposure of SSNs as well. For instance, most states have modified their policies on placing SSNs on state drivers’ licenses, some prohibit the use of SSNs as a student identification number, and others have removed SSNs from checks and benefit statements. These actions suggest that the risk of SSN exposure is also widely recognized. As governments move increasingly to electronic record keeping, access to documents that include Social Security numbers has become easier. To the extent that such records are available through the Internet, ease of access can increase exponentially. The growth of electronic record keeping has, in fact, made it easier for some agencies to provide or even sell their data in bulk. In our previous research, a few government agencies and courts reported to us that they were also considering the prospect of expanding the volume and type of public records that would be available on their Web sites. Currently, congressional lawmakers are considering legislation to curtail such exposures, looking at both public and private sector uses. Not all records held by government or public agents are “public” in terms of their availability to any inquiring person. Governments hold many records that are not generally available and other records that are protected from public access. For example, adoption records are generally sealed. Personnel records are often not readily available to the public, although newspapers may publish the salaries of high, elected officials. Furthermore, governments may release portions of records but protect sensitive information within them, which includes Social Security numbers. Treatment of similar types of records varies among federal, state, and local governments. Furthermore, there is no common definition of public records. For this report, however, we refer to public records as those records generally made available to the public in their entirety for inspection by a federal, state, or local government agency. Such documents are typically accessed in a public reading room, clerk’s office, or on the Internet. In our previous review of government use of SSNs, we found that they are prevalent in records held by government agencies, some of which were available to the public. We also learned that courts at all three levels of government maintain public records containing SSNs, such as divorce decrees, child support orders, and bankruptcy cases. At that time, some officials who maintained these records told us their primary responsibility was to preserve the integrity of these records rather than protect the privacy of the individual SSN holder. However, we also found that some agencies were trying to better safeguard the SSN by using innovative approaches, such as by modifying their processes or their forms. Some agencies and courts also reported limiting the practice of placing public records containing SSNs on Web sites. The most far-reaching efforts we identified took place in states that had established statewide policies and procedures. However, this research focused, in general, on how and why governments use SSNs, and did not examine in detail, the extent to which SSNs are exposed to the general public and potentially available for misuse. We found that SSNs are widely exposed to public view in state and local records, but less so in federally held records. Specifically, 41 states and the District of Columbia reported displaying SSNs in public records, and we estimate that over three-quarters of counties do so as well. The number and type of records in which SSNs are displayed varies greatly for both states and counties, but they are most often found in court records and local property records. For federal executive branch agencies, records are covered by the Privacy Act of 1974, which generally prohibits disclosure of SSNs and other personal information. However, we found that SSNs are available in some federal court records. According to our survey, most states maintain at least one type of public record that reveals individual SSNs. Agencies in 41 states as well as the District of Columbia reported holding at least one type of public record that shows the SSN. This may understate their exposure, however, given that we received responses from only 62 percent of the state agencies we surveyed. Nevertheless, we received responses from agencies in every state. The number of these reported records ranged from 1 to 9 for most states, but was much higher for a few states. (See table 1.) (Appendix III provides a complete list of state and state function response rates). Among the types of records reported by the 338 state agencies responding, we found no one public record in which the SSN was always displayed. The most frequently cited, however, were those held by state courts. These ranged from criminal proceedings and litigation and civil case files to traffic records and records of judgments. (See fig. 1.) Appendix IV shows how state agencies responded to our question on whether SSNs are displayed in public records. We estimate that individuals’ SSNs are displayed in some public records in 80 to 94 percent of U.S. counties. While not everyone would be identified in such records, we estimate that this exposure could potentially affect any one of the estimated 91 to 97 percent of the U.S. population that lives in these counties. According to our survey, the county records in which SSNs are most often revealed are those held by recorders and court clerks. (For a description of the types of records held by each program area see app. V.) Specifically, we estimate that 58 to 68 percent of records held by courts and 50 to 68 percent held by recording offices contain publicly accessible SSNs, while only 5 to 9 percent of records held by all other functions included in our survey contain SSNs. Figure 2 shows our estimates of the percent of records that display SSNs to the public held by different types of local government offices. Courts and recording offices hold a substantial variety of records. For example, courts hold criminal proceedings, civil cases files, and traffic records, among others. Recorders also maintain a variety of records, including many concerning property ownership. We estimate that 80 to 94 percent of U.S. counties have publicly available court or property ownership records with SSNs. Specifically, SSNs are available to the public in records of criminal proceedings in 44 to 64 percent of counties and in divorce records in 12 to 26 percent of counties—two kinds of records that are often held by courts. SSNs are also displayed in some other types of records—including, military discharge records and Uniform Commercial Code (UCC) filings. Figure 3 shows the percent of counties in which specific types of records display SSNs to the public. While we know of no particular type of record relevant to all individuals in a given county, there are some records that may pertain to a large number of residents. These would be records that document activities or transactions many people engage in—for instance, home mortgage records or voter registrations. To illustrate the potential for an individual’s SSN to be identified in a public record, we have estimated the percent of the population that lives in counties in which SSNs are available in certain types of records. For instance, we estimate that 27 to 41 percent of the population lives in counties in which SSNs are available to the public in traffic records. Further, from 49 to 63 percent of the population lives in counties in which SSNs are available in mortgage and real property transfer records, and from 16 to 28 percent lives in counties in which SSNs are available in divorce records. While the federal government compiles a wide range of information on individuals that often includes SSNs, the Privacy Act of 1974 may prohibit their disclosure, along with other personal information, without the consent of the individual. Specifically, SSNs in record systems—specific groups of records—held by federal executive agencies are generally not available to the public. SSNs that are not held in a system of records, however, may not be governed by any other law or regulation and, therefore, may be exposed on a limited basis. However, there was no way to ascertain where they might be or the degree of any public access. Nevertheless, officials we interviewed in 5 selected agencies reported that they were not aware of any records maintained by their agencies—in a system or otherwise—that display SSNs to the public. Federal court records are generally available to the public, but the courts have supervisory power to withhold certain information from public examination. Statutes also require records disclosure in some instances. Social Security numbers are sometimes found in these records. According to officials of the Administrative Office of the U.S. Courts, SSNs are available in certain types of records because the SSNs are required by law. Occasionally, but not routinely, SSNs are available in other files throughout the federal court system when attorneys of record include this information in documents filed with the court. In the last 2 years, however, the Judicial Conference of the United States, which establishes policy for the federal judiciary, revised federal policy in bankruptcy cases so that only the last four digits of any SSN will be visible to the general public in new record entries. State and local government respondents to our survey reported frequently using SSNs in public records to verify identities or to meet state legal requirements, but some agencies said they had no need for them. For state agencies, the second most frequently cited purpose for using SSNs was to match information in other records or databases. Among local government agencies the second most frequently cited reason was to comply with state law or regulations. However, some state and local offices reported that they had no specific use for the SSNs in certain records, although they were often contained in documents submitted to their offices. The federal courts reported routinely collecting SSNs to ascertain the identities and holdings of debtors involved in bankruptcy filings. Courts also reported routinely collecting SSNs for Social Security claims cases. Identity verification was the most frequent reason given by our state survey respondents for collecting or using SSNs that are shown in public records. Fifty-four state agencies representing 30 states cited this reason. Ten agencies, representing 8 states, indicated there was no specific reason for collecting or using the SSN in a particular type of public record. Table 2 shows the reasons cited for collecting or using SSNs in public records and the number of state agencies that gave each reason. Other reasons state agencies gave were primarily to collect fines, fees, or judgments, and because the SSNs were already included in documents that became part of the public records. Some of these respondents gave specific examples of how the SSN is used for identify verification or benefits determination. Three respondents noted that SSNs are used to facilitate investigations of wrongdoing. SSNs in local government public records are most often collected or used for identity verification. After identity verification, other common reasons include complying with state laws and regulations and matching with other records. Additionally, quite a few offices maintain public records that contain SSNs for which they have no use. Figure 4 shows reasons that SSNs are in local public records and our estimates for the percent of such records that contain SSNS for each purpose. Reasons for collecting SSNs in public records varied across different functional areas at the county level. Among local courts, identity verification is the single most common use of SSNs in public records, while recording offices collect or use SSNs in public records to comply with state laws or regulations more often than any other specific purpose. Among all other functions, SSNs are most frequently used for identity verification, matching with other records, and complying with state laws or regulations. Recorders also frequently maintain records that contain SSNs for which they have no use. On the basis of our survey, we estimate that 25 to 51 percent of records with SSNs held by recording offices contain the number for no specific purpose. In addition, the survey responses of some recording officials indicated that SSNs are not required or requested by their offices, but they may appear in records filed in their offices nonetheless. Some respondents indicated that their job is to maintain the record only—they cannot amend or change it. Table 3 is a sample of responses from those who checked the “other” option to the question asking why SSNs are collected or used in specific types of public records. (For the complete survey question and response categories, see appendix II.) Federal agencies engage in a wide range of required or permitted uses of SSNs, such as electronic matching of information in databases. Various federal laws and regulations require or permit federal agencies to collect and use SSNs when administering federal programs. However, as noted above, due to Privacy Act provisions, in most cases these SSNs are not available to the public. Concerning the federal judiciary, SSNs are generally required for bankruptcy and Social Security claims cases. SSNs are generally not required with regard to other civil or criminal cases. Storage methods and forms of public access to records with SSNs vary somewhat among the different levels of government, but hard copy is the most common form of access for the public, and some agencies have begun to reduce SSN exposure. State government offices tend to store such records electronically, while most such local government records are stored on microfiche or microfilm. However, for both these levels of government, inspection of paper copies is the most commonly available method for public access to such records. Few state agencies make them available on the Internet. In counties, however, we estimate that offices in as many as 15 to 28 percent—several hundred—do so. For the future, however, few state or local offices reported any plans to place additional records on the Internet. Some state and local offices reported that in recent years they had begun to restrict access to SSNs in public records. At the federal level, the National Archives stores many federal agency documents, with access restricted by law. For its part, the federal court system has recently taken action to restrict access to SSNs in its public bankruptcy records, including those on the Internet. State agencies responding to our survey generally store public records that display SSNs electronically. Electronic databases or indexes was the most frequently cited storage method. Microfiche or microfilm and computer usable media such as DVDs, CD-ROMs, diskettes, or tapes were also frequently cited. Figure 5 shows the number of state agencies using each storage method we asked about in our survey. Many state offices also use more than one method to store the same type of records. This pattern could be due to retention of older records in noncomputerized formats such as microfiche/film and placement of newer records into computerized formats, rather than having a single record available in multiple formats. Table 4 shows the extent of this practice. While state agencies generally store most public records displaying SSNs electronically, in most cases, members of the public are not able to access the records electronically. Despite reliance on electronic storage methods, based on our survey responses, walk-in inspection of paper copies and mail requests are the most commonly available forms of access to state public records containing SSNs. Fifty-four state agencies—out of 90 where public records display SSNs—reported these were the only way for the public to access such records. Comparatively few state agencies responding to our survey provided Internet access to records containing SSNs. In most offices where it is available, a fee or user registration is required. Of those offices that make records available on the Internet, more reported making court records and UCC filings available than any other type of record. Figure 6 compares the extent of Internet access with walk-in inspections and on site electronic databases. Based on their responses to our survey, state agencies are not planning to significantly expand Internet access to public records that show SSNs. Only 4 state agencies indicated plans to make such records available on the Internet, and one agency plans to remove them from Internet access. Three agencies plan changes in Internet access. One said that a state law, with limited exceptions, barred the release of SSNs held by any state government entity. Another agency plans to charge a fee for Internet access to records it maintains. The third agency plans to remove SSNs and place records on the Internet Our survey results show that state offices have recently taken some measures to change the way they display or share SSNs in public records. Again, because of the number of nonrespondents, the results may not account for all such measures. As figure 7 shows, state agencies most often have either redacted—covered or otherwise hidden from view— SSNs from public versions of records or restricted access. Specific restrictions and other actions state agencies reported taking included blocking or removing SSNs from electronic versions of records, allowing individuals identified in records to keep their SSNs out of publicly available versions, replacing SSNs with alternative identifiers, and restricting access only to individuals identified in the records. A number of state agencies also described broader policy changes taken by their state governments in the last 2 years. According to survey respondents, at least 8 states have enacted new laws to restrict public disclosure of SSNs. These states, with brief descriptions of the newly enacted laws are listed in table 5. We previously reported that Washington and Minnesota had enacted comprehensive policies to restrict the display of SSNs. Minnesota’s law— the Minnesota Government Data Practices Act—among other provisions specifically classifies SSNs collected by state and local government agencies as nonpublic. Washington’s policy was implemented through an executive order signed by the governor in April 2000. In response, state agencies removed SSNs from forms and documents where their display was found to be not vital to the business of the agency. They also changed the format of certain public records to limit disclosure of SSNs, such as recording SSNs on portions of forms or duplicate forms that are not released to the public. In October 2002, the Conference of Chief Justices and the Conference of State Court Administrators issued a report (CCJ/COSCA Guidelines) for state court systems regarding public access to court records, which recommended that courts take various means to protect SSNs within the court records they maintain. One strategy discussed in the Guidelines would be for courts to have SSNs be available in records only when viewed at a court facility. Such records might be available electronically, but only through workstations in a court facility. The Guidelines also suggest that parties to a case or individuals identified in records be allowed to request additional restrictions for good cause. Finally, the Guidelines advise state court systems not to disclose SSNs protected by any state or federal law. Overall, microfiche or microfilm are the most commonly used methods of storing local government public records that contain SSNs—38 to 52 percent of such records are stored in these manners. To a lesser degree, county offices use DVDs and CD-ROMs, electronic text files, portable data files, and electronic databases. We found no real variation in the storage methods used by different functions. Overall, the predominant methods for gaining access to local government public records containing SSNs are by visiting an office in person to inspect paper copies or requesting a copy through the mail. Records containing SSNs are available in onsite electronic databases in 49 to 68 percent of counties. According to our survey, the Internet is the least common form of access, although records with SSNs are accessible on the Internet in 15 to 28 percent of U.S. counties. We estimate that 34 to 48 percent of the population lives in these counties. Figure 8 shows the estimates for the percent of counties in which different methods can be used to access public records with SSNs. According to our survey, few or no offices other than courts or recording offices currently make records containing SSNs available via the Internet. With regard to future plans, while we estimate that offices in only 2 to 8 percent of counties plan to introduce Internet access to records containing SSNs, this may have consequences for the 13 to 25 percent of the U.S. population that lives in those counties. In the past 2 years, the vast majority of local government offices have not made changes to the way they display or share SSNs in particular records. However, we estimate that offices in 13 to 27 percent of counties have begun redacting SSNs on copies of records provided to the public and offices in 12 to 26 percent of counties have begun restricting access to records containing SSNs. Some offices also have begun using partial SSNs in public records. Federal agencies transfer paper records containing SSNs to records centers operated by the National Archives and Records Administration (NARA) for storage. Access to these records remains under the legal authority of the transferring agencies, which, as noted previously, generally do not make SSNs accessible to the public. According to NARA officials, NARA is considering adding electronic records storage services to the records center program, but the same rules of access would apply to those records. At the end of the period in which the agency records are expected to be needed, those that have continuing value are transferred into the National Archives and NARA’s legal custody. NARA provides public access to archival records unless the records have access restrictions. Some records are subject to restrictions prescribed by statute, executive order, or by restrictions specified in writing in accordance with 44 U.S.C. 2108 by the agency that transferred the records to the National Archives of the United States. Additionally, the Archivist of the United States imposes general restrictions to certain kinds of information or classes of records. NARA has many series of federal agency records in its legal custody that contain SSNs. NARA officials told us that it has two broad categories of archival records with SSNs: (1) name retrievable records and (2) operations records that are not name retrievable. NARA is unable to screen the latter records for SSNs unless the records must be screened for another restriction. In response to requests for name retrievable records made under the Freedom of Information Act, NARA screens the records and redacts SSNs (if the individual is not deceased) prior to public disclosure or release. NARA also masks the SSNs of living individuals in archival databases that NARA makes available to the public on its Internet Web site. We discussed Judicial Conference policies and procedures pertaining to privacy and SSNs with officials from the Administrative Office of the U.S. Courts. They told us that the Conference has taken a number of actions in recent years to increase privacy and reduce Internet access to SSNs that are in federal court documents. These actions include (1) implementing a rule for bankruptcy cases, effective December 1, 2003, that requires SSNs, except for the last four digits, to be redacted from electronically available (Internet) documents accessible to the public; (2) issuing a “model local rule” for criminal cases that eliminates SSNs from documents filed with the court, unless necessary, and includes only the last four digits of SSNs in publicly available paper and electronic versions of such documents; and (3) issuing privacy policy guidance for electronically available court documents in civil cases. Citing its bankruptcy case rule and model local rule for criminal cases, the Conference also advises attorneys for parties filing court documents to include only the last four digits of SSNs. In its report, the committee that developed the policy noted that there should be “consistent, nationwide policies in federal courts in order to ensure that similar privacy protections and access presumptions apply regardless of which federal court is the custodian of a particular case file.” Although they are not displayed in public records en masse, we found that millions of SSNs are still subject to exposure on individual identity cards issued under federal auspices. Although some agencies are taking action to address this display of the SSN, we found that, currently, an estimated 42 million Medicare cards display entire nine-digit SSNs, as do some Department of Defense insurance cards and approximately 8 million identification cards, as well as 7 million Department of Veterans Affairs (VA) beneficiary cards. In addition, approximately 830,000 federal employees carry health insurance cards issued through Federal Employees Health Benefits Program that display the bearer’s full SSN. Such cards are used at the point of service – at pharmacies, medical offices, or merely to enter buildings – and are usually carried almost everywhere, circulating through many hands and even photocopiers, increasing opportunities for the card and the SSN on it to be stolen, copied, or even lost. Three of four federal agencies have begun taking action to remove SSNs from such health insurance or identification cards issued under their auspices. In 2003, the federal Office of Personnel Management, which handles personnel for executive branch agencies, directed all health insurance carriers affiliated with the Federal Employee Health Benefit Program to eliminate SSNs from insurance cards as soon as it is operationally and financially practical. As of August 2004, about 57 percent of these insurers were using numbers others than SSNs on their cards— this represents over 79 percent of the subscribers in the FEHBP. The office projected that by the end of 2005 only 3.7 percent of FEHBP subscribers will have their SSNs on their health insurance cards, as more insurance companies have signaled their intention to replace the SSN. Meanwhile, VA is eliminating SSNs from 7 million VA identification cards and is replacing cards with SSNs or issuing new cards without SSNs from 2004 through 2009, until all such cards have been replaced. In 2004, the Department of Defense (DoD) began replacing approximately 6 million health insurance cards that display SSNs with cards that do not display the bearer’s SSN, but continues to include SSNs on approximately 8 million military identification cards. In addition, the Centers for Medicare and Medicaid Services (CMS), with the largest number of cards displaying the entire nine-digit SSN, does not plan to remove the SSN from Medicare identification cards. During 2003, CMS’s Office of Financial Management, Program Integrity Group conducted a study of identity theft issues, during which they considered the possibility of removing SSNs from Medicare cards. CMS officials who served on the workgroup told us that the group had concluded that eliminating SSNs from 40 million Medicare cards would be cost prohibitive. The Social Security Administration (SSA), which is the issuer of Social Security cards (displaying the bearer’s SSN), addresses this vulnerability differently than the other agencies. SSA recommends that cards be kept in a safe place and that a person “not carry” it with them unless it is needed “to show it to an employer or service provider.” In contrast, CMS instructs Medicare participants to show the card whenever medical care is provided, and to carry the card when traveling, but to keep the number as safe as they would a credit card number. While the Social Security Administration advises individuals to avoid exposure of their SSN card, we found no federal policy regarding its display on identity and insurance cards. Specifically, there is no presidential executive order, federal law, or common federal policy in effect. Although SSA has authority to issue policies and procedures over the Social Security cards that it issues, it does not have authority over how other federal agencies use and display SSNs. While the Office of Management and Budget has issued guidance for managing federal information resources and protecting records on individuals, it has not provided guidance for the display of SSNs on cards. Rather, the Centers for Medicare and Medicaid Services, the Office of Personnel Management, VA, and DoD each have their own policies for the cards issued under their authority. Today, the SSN has become a universal identifier; as such, it offers government as well as the private sector an efficient way to verify the identity and the qualifications of people for programs or activities ranging from taxes to health benefits to worker’s compensation payments. As a single, unique number assigned to one person, the SSN also allows for tracking that individual through more than one database and comparing information for a variety of uses, including police work. In short, SSNs are a lynchpin to other personal information held in a variety of records. The extent to which they are exposed to public view, of course, increases the likelihood that they will be misused for inappropriate mining of personal information, violation of privacy, and identity theft. The increased use of SSNs in both the public and private sectors means that SSNs are more widely circulated and more likely to appear in public records that document common life events and transactions, such as marriages and home purchases. The continued visibility of SSNs in public records in virtually every corner of the country presents continued risk of widespread, albeit small-scale, identity theft. Since the public usually obtains such records in individual hard copies, the risk of SSN theft in large volume from public records may be small. Indeed, a variety of government agencies and oversight bodies appear to be taking steps to eliminate the open display of SSNs, but there is no uniform practice or policy at the federal, state, or local level to protect them. Such initiatives to protect the SSN may slow its misuse, but the absence of uniform and comprehensive policy is likely to leave many individuals vulnerable. For example, the 15 to 28 percent of counties that we estimate post some records with SSNs on the Internet creates a broad vulnerability that, together with the lack of uniform protections, makes it difficult for any one individual to mitigate. In one of our previous reports, we recommended that a representative group of federal, state, and local officials develop a unified approach to safeguarding SSNs used in all levels of government and particularly those displayed in public records. We still believe such an approach would be constructive. On another front, there is jeopardy in the display of SSNs on identity and eligibility cards issued under government auspices. The cardholder is usually required to use his or her card at the point of service—which means a practical need to carry and display it often—thus increasing the likelihood for accidental loss, theft, or visual exposure. The risk this poses has been both recognized and addressed by, among other things, prohibitions against using SSNs as student identification numbers and policy changes concerning use of SSNs on drivers’ licenses. While we did not examine the phenomenon of SSN display on identification cards across all federal programs, it is clear that the lack of a broad, uniform policy allows for inconsistent, but persistent exposure. To address the overall problem of exposure for the SSN, congressional lawmakers are considering legislation that would, among other things, curtail display of SSNs in both the private and public sectors. For its part, the public sector has already demonstrated that it is possible, for example, to substitute another number for the SSN on displayable cards, and link it to actual SSNs in a protected database. Given the size of federal programs, the lack of such safeguards across all agencies currently leaves millions of people unprotected. To address this potential vulnerability, we recommend that the Director, Office of Management and Budget, identify all those federal activities that require or engage in the display of nine-digit SSNs on health insurance, identification, or any other cards issued to federal government personnel or program beneficiaries, and devise a governmentwide policy to ensure a consistent approach to this type of display. We provided a draft of this report to the Administrative Office of the United States Courts, the Centers for Medicare and Medicaid Services, the Department of Defense, the National Archives and Records Administration, the Office of Management and Budget, the Office of Personnel Management, the Social Security Administration, and the Department of Veterans Affairs for comment. Officials at each agency confirmed that they had reviewed the draft and generally agreed with its findings and recommendation. Officials from the Administrative Office of the United States Courts, the Department of Defense, and the Office of Personnel Management provided us with technical comments, which we have incorporated into the report as appropriate. We received formal comments from officials from the Department of Defense, the Office of Personnel Management, and the Social Security Administration; those comments are included in appendixes VI through VIII. We did not receive formal written comments for this report from the Centers for Medicare and Medicaid Services, the National Archives and Records Administration, or the Department of Veterans Affairs, though officials from each confirmed that they generally agreed. Additionally, OMB did not provide formal written comments, but officials from OMB’s Office of General Counsel and Office of Information and Regulatory Affairs confirmed that they generally agreed with the report and that they would take our recommendation into consideration for future action. We are sending copies of this report to the Director of the Administrative Office of the U.S. Courts, the Administrator of the Centers for Medicare and Medicaid Services, the Secretary of Defense, the Archivist of the National Archives and Records Administration, the Director of the Office of Management and Budget, the Director of the Office of Personnel Management, the Commissioner of the Social Security Administration, and the Secretary of Veterans Affairs, and appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on GAO’s Web site at http://www.gao.gov/. If you have any questions concerning this report, please contact Barbara Bovbjerg at (202) 512-7215. See appendix IX for other contacts and staff acknowledgments. To complete the objectives for this assignment, we collected original information at the federal, state, and local government levels. We reviewed previous GAO reports on Social Security numbers (SSN), identity theft, data mining, information security, record linkage and privacy, and related topics. In addition we reveiwed various studies of state SSN use, privacy laws such as the Information Technology Management Reform Act of 1996 (Clinger-Cohen Act), the Privacy Act of 1974, the Freedom of Information Act, the Family Educational Rights and Privacy Act of 1974, Health Insurance Portability and Accountability Act of 1996, the Computer Matching and Privacy Protection Act of 1988, the Identity Theft and Assumption Deterrence Act of 1998, several memoranda from the Office of Management and Budget (OMB), and other related documents. We used different methods for selecting units of study and for collecting data for each of the three levels of government reviewed for this engagement. The methods used in the three studies are detailed in the following sections. We conducted personal interviews with officials of 10 federal agencies: the Administrative Office of the United States Courts, the Centers for Medicare and Medicaid Services, the Department of Defense, the National Archives and Records Administration, the Office of Management and Budget, the Office of Personnel Management, the President’s Council on Integrity and Efficiency, the Social Security Administration, the Department of Agriculture, and the Department of Veterans Affairs. We selected these agencies because they have responsibility for implementing the Privacy Act, the Freedom of Information Act, or programs that are generally known to include SSNs. We obtained information from six federal agencies using an interview guide based on federal privacy laws and OMB’s general and/or agency- specific disclosure criteria. The interview guide also addressed each agency’s own privacy regulations and practices. Additional queries dovetailed with questions asked at the state and local levels: public access to the agencies’ public records that contain SSNs, availability of these records on the Internet, privacy and protecting records about individuals and other issues unique to the agency. The interview guide has face validity and was used as a talking point instrument. To gather information about public records that contain SSNs and whether they are made available to the public at the state and local levels, we surveyed state and local government officials in program areas that were determined likely to maintain or collect public records. We developed a list of questions to be used for both surveys, although the state survey was Web-based and the county survey was administered by mail. The survey was designed to address questions about multiple public records while allowing for analysis on specific types of records. To this end, we developed a standardized two-page questionnaire, which could be replicated for various types of public records and could be used at both the state and the county level. In addition, the survey design allowed for specific groupings of different types of records to be sent to different respondents. For instance, court clerks were sent forms concerning types of records different from those sent to public health officials. The questionnaire include such items as accessibility of records displaying SSNs to the public; reasons for collecting or using SSNs in the record; formats for storing records with SSNs; plans for changing those formats; methods by which the public can access or view records with SSNs, including Internet usage and changes the office has made in the past 2 years in the way records with SSNs are displayed to the public. We selected 35 different types of public records for our review. We developed the list based on research we conducted on public records, the results of a prior GAO survey concerning government use of SSNs, expert reviewers, and pretesting of the survey instrument. These records can be grouped in the following major categories: court records (e.g., records of criminal proceedings, child support/child custody, divorce, etc); law enforcement records (e.g., criminal arrest warrants, prison records); motor vehicle records; lien and security interest records; vital records (birth, death, and marriage); health records (immunizations and communicable diseases); and “other” category which includes professional licensing, military discharge records, and social service records among others. Appendix V includes a full list of the 35 record types. For the development of both the list of records types and the survey questions, we obtained assistance from both internal and external expert reviewers. Data gathering for the state level consisted of a Web-based survey to state officials in previously identified program areas or functions in all 50 states and the District of Columbia. These program areas, identified in our previous work on government use of SSNs as likely to maintain public records containing SSNs, included: (1) courts/judiciary, (2) law enforcement, (3) human services, (4) health and vital statistics, (5) selected professional licensing offices, (6) labor, (7) corrections, and (8) public safety. Several steps were involved in the preparation of and conduct of the survey. We obtained the names and e-mail addresses of state officials in these offices from a list used for our earlier work and updated names, telephone numbers, and Web addresses using the “Yellow Book Leadership Directories” provided in our Intranet. Two contractors made telephone calls to verify the titles and names and to obtain the e-mail address of each of the entries. We sent a notification e-mail to each of the department heads of the selected state agencies informing them about the survey. Within 2 weeks of the notification, we sent an activation e-mail with the instructions on how to access and complete the survey, including a survey link, and a unique username and password to each selected state official. To increase the response rate, we sent a reminder e-mail after the activation email to those department heads that had not responded; about 2 weeks later, we sent a second e-mail to nonrespondents. Contractors followed-up nonrespondents with telephone calls about 2 weeks after the second reminder e-mail. The survey was available on line from February 23, 2004, to July 31, 2004. We surveyed 542 officials in the 50 states and the District of Columbia. We received responses from 338 state agencies out of 542. In 12 states, we received responses from half or fewer of the agencies surveyed. For three of the program areas, we received responses from about half or fewer of the states with agencies serving those functions. The response rates for three program areas that we believe are most likely to maintain records with information about large proportions of state residents (though not necessarily a majority of residents) are: Courts/Judiciary–61 percent; human services–69 percent; health services and vital statistics–60 percent. These compare with our overall response rate of 62 percent. We administered a questionnaire by mail to the study population of local government officials in a two-stage probability sample designed to reflect the population of U.S. counties. This allowed us to estimate to the entire population of U.S. counties and to develop population-based estimates. The program areas were: (1) courts, (2) law enforcement, (3) public health, (4) recorders, (5) social services, (6) tax assessment, and (7) voter registration. We developed a list of contact information with addresses for local government officials using address lists obtained from the National Association of Counties (NACO) and BRB Publications, Inc., as well as the Yellowbook leadership directory and information obtained from state and local government websites. Address collection was done between November 2003 and February 2004. To identify incumbent government officials in a sample of counties, we used address lists of county government officials purchased from BRB Publications and NACO and supplemented them with the name and address list used in our prior work and by searching Web sites and making telephone calls. We sent out packets of questionnaires to 1996 officials in 200 counties (including minor civil divisions in 24 counties). The number or type of records mailed to each official depended on the research team’s judgment of the type of records each official would be likely to maintain given his or her function. For example, we sent immunization and communicable disease questionnaires to public health directors. We provided for an “Other” type of record that respondents could fill out for records they maintained and for which we did not supply a questionnaire. A few weeks after the initial survey was mailed, we sent a reminder letter without replacement questionnaires. A week after the first reminder letter, we began sending a second wave of reminder letters with replacement questionnaires. While we received a completed survey from at least one program area in each county, the response rates within each county varied from 1 program area in a county to all program areas. The overall response rate for the county survey was 81 percent. Response rates for each program area were courts (79 percent), health departments (79 percent), law enforcement (80 percent), recording officials (88 percent), social services (79 percent), tax assessors (85 percent), and voter registrars (86 percent). We developed a U.S. county sample that would reflect the U.S. population and allow making estimates related to persons. The probability sample of 200 counties included 35 counties with the largest populations with certainty and the remaining counties selected using probability proportional to size of the population. The measure of size used for sampling was the square root of the 2002 estimated population; use of the square root function dampens some of the variability in county-level population sizes (from ~100 to ~ 10,000,000). To avoid having a sparsely populated county having large influence on population-related estimates, two counties with 2002 estimated populations less than 150 are combined with neighboring counties, using geographic information from the U.S. Bureau of the Census’s TIGER system; this is the one situation where sampling units are not individual counties. We determined that for the sampled counties in some states (24 total: Connecticut (2), Maine (2), Massachusetts (2), Michigan (9), New Hampshire (1), New Jersey (3), Wisconsin (5)), it was appropriate to survey local government officials within subcounty units called “Minor Civil Divisions” (MCD) because either county governments do not exist (e.g., Connecticut and Massachusetts) or the MCD governments perform many functions that usually are performed by county governments in other areas. This second stage probability sample consisted of 59 MCDs from the specified set of counties, consisting of the 11 MCDs that have 2002 estimated populations of 100,000 or more, and 48 MCDs (2 from each of the 24 counties), selected using probability proportional to the size of the population. During the implementation of the survey, we identified respondents who were not in the target population. Table 6 provides a summary of the reasons for these out of sample respondents. In implementing our survey, we also had many respondents who completed surveys on behalf of several offices. For instance, in some counties and states where courts are centrally administered, we received just one completed survey on behalf of all courts in a county or in a state. In addition, in some states certain functions, such as social services, are state government programs, but are administered by local or regional offices. In some of these cases, we received one completed survey from a state official on behalf of some or all local or regional program offices. The results of the county survey were weighted to make the results generalizable to the entire population of U.S. counties. For each stratum, we formed estimates by weighting the data by the reciprocal of the selection probability. The margins of error for the county survey results varied because we made estimates for different subpopulations. For all the estimates shown here, we are 95 percent confident that when sampling error is considered, the results are within +/- 7 percentage points unless otherwise indicated. All population estimates based on the survey of local government officials are for the target population defined as local government officials in 7 program areas and courts within a sample of 200 U.S. counties. The survey of local government officials is subject to sampling error. There was no sampling error for the census survey of state officials. The effects of sampling errors, due to the selection of a sample from a larger population, can be expressed as confidence intervals based on statistical theory. Sampling errors occur because we use a sample to draw conclusions about a larger population. As a result, the sample was only one of a large number of samples of counties that might have been drawn. If different samples had been taken, the results might have been different. To recognize the possibility that other samples might have yielded other results, we express our confidence in the precision of our particular sample’s results as a 95 percent confidence interval. The 95 percent confidence intervals are expected to include the actual results for 95 percent of samples of this type. We calculated confidence intervals for this sample using methods that are appropriate for the sample design used. For local government survey estimates in this report, we are 95 percent confident that when sampling error is considered, the results we obtained are within +/- 7 percentage points of what we would have obtained if we had surveyed officials in all of the entire study population, unless otherwise noted. In addition to sampling error, other potential sources of errors associated with surveys, such as question misinterpretation, may be present. Nonresponse may also be a source of nonsampling error. We took several steps to reduce these other sources of error. We conducted pretests of the questionnaire using a paper version with 11 incumbents of the functions/roles selected for our review in four different counties in three states to account for differing local government structures and to ensure the questionnaire: (1) was clear and unambiguous, (2) did not place undue burden on individuals completing it, and (3) was independent and unbiased. In addition, we conducted seven pretests with state officials in 2 states. The first six were conducted using a paper version of the questionnaire and the final test was conducted using the Web version to test for functionality. After pre-testing we modified the questionnaire as needed for clarity, respondent comprehension, and objectivity. Most of the items in the questionnaire were closed-ended but provided for multiple responses to each question as well as possibility for respondent comments regarding public access to records with SSNs. We performed our work in Washington, D.C., from March 2003 through September 2004 in accordance with generally accepted government auditing standards. The overall response rate for the state survey was 62 percent. We received responses from at least one agency in every state. In 37 states and D.C., we received responses from more than half of the agencies surveyed. With regard to the specific functions we surveyed, we received responses from about half or fewer of the states in three functions: law enforcement, cosmetology licensing, and notary public licensing. For 8 of the 12 functions, we received responses from 60 percent or more of the states. Because of variation in local governments, each type of record is not always maintained by the same type of office across all counties. Furthermore, program areas that are separate in some counties are combined in others. For instance, in many counties the clerk or recorder performs functions such as voter registration or tax assessment, which operate independently in other counties. Due to these variations, it is not always possible to pinpoint which office within a county maintains a particular type of record. Unless we had specific information indicating what records are maintained in a specific office within a specific county, in administering our survey to local government officials, we sent the same set of forms (each with the same set of questions, but for a specific type of record) to officials within each program area or function. For example, we sent immunization and communicable disease questionnaires to public health directors. We also provided an “Other” record form that all respondents could fill out for records they maintained and for which we did not supply a questionnaire. Table 9 shows the types of forms that were sent to each program area. Due to the variations mentioned above, we received responses about some types of records from more than one program area. Survey responses concerning the following types of records were most often returned by recording officials, but not infrequently by courts: mortgage and real property transfer records, property ownership records, records of property liens and other judgments, Uniform Commercial Code (UCC) filings, divorce records, marriage licenses or applications, hunting and fishing licenses, military discharge and induction records, business or professional licenses, public utility usage records, notary commissions, and vehicle or vessel registrations. The following team members contributed to all aspects of this report: Dennis Gehley, Ron La Due Lake, Joel Marus, Nila Garces Osorio, and John Trubey. In addition, Margaret Armen, Susan Bernstein, Carolyn Boyce, Richard Burkard, Stefanie Bzdusek, Melissa Hinton, Catherine Hurley, Chris Moriarity, and Caroline Sallee made contributions to this report.

Summary: While the use of Social Security numbers (SSN) can be very beneficial to the public sector, SSNs are also a key piece of information used for committing identity crimes. The widespread use of SSNs by both the public and private sectors and their display in public records have raised concern over how SSNs might be misused and how they should be protected. In light of this concern, GAO was asked to examine (1) the extent to which SSNs are visible in records made available to the public, (2) the reasons for which governments collect SSNs in records that display them to the public, and (3) the formats in which these records are stored and ways that the public gains access to them. As well as looking at public records, GAO also examined the practices of several federal agencies regarding the display of entire nine-digit SSNs on health insurance and other identification cards issued under their authority. Social Security numbers appear in any number of records exposed to public view almost everywhere in the nation, primarily at the state and local levels of government. State agencies in 41 states and the District of Columbia reported visible SSNs in at least one type of record and a few states have them in as many as 10 or more different records. SSNs are most often to be found in state and local court records and in local property ownership records, but they are also scattered throughout a variety of other government records. In general, federal agency display of SSNs in public records is prohibited under the Privacy Act of 1974. While the act does not apply to the federal courts, they have taken action in recent years to prevent public access. With regard to the SSNs maintained in public records, various state and local officials commonly reported needing them for identity verification. A few, however, said they had no use for the SSN, but that documents submitted to their offices often contained them. States also commonly reported using the SSN to facilitate the matching of information from one record to another. The federal courts largely collect SSNs when required by law to do so; however, due to privacy concerns, SSNs are not in documents that are available electronically to the public. Public records with SSNs are stored in a multiplicity of formats, but public access to them is most often limited to the inspection of individual paper copies on site or via mail by request. Few state agencies make records with SSNs available on the Internet; however, 15 to 28 percent of the nation's 3,141 counties do place them on the Internet and this could affect millions of people. Overall, GAO found that the risk of exposure for SSNs in public records at the state and local levels is highly variable and difficult for any one individual to anticipate or prevent. Another form of SSN exposure results from a government practice that does not involve public records per se. GAO found that SSNs are displayed on cards issued to millions of individuals under the authority of federal agencies for identity purposes and health benefits. This involves approximately 42 million Medicare cards, 8 million Department of Defense identification cards, as well as some insurance cards, and 7 million Veterans Affairs identification cards, which display the full nine-digit SSN. While some of these agencies are taking steps to remove the SSNs, there is no governmentwide federal policy that prohibits their display. Although we did not examine this phenomenon across all federal programs, it is clear that the lack of a broad, uniform policy allows for unnecessary exposure of personal Social Security numbers.