The child support enforcement (CSE) program is a joint federal and state partnership mandated in 1975 under Title IV-D of the Social Security Actthrough which noncustodial parents are located, paternity is established, and child support orders are issued and enforced. State CSE programs are responsible for carrying out these basic activities. These activities may take place through judicial action or an expedited administrative process, depending on the state where the action takes place. In a judicial process, the courts have the authority to make certain decisions and take certain actions, and proceedings take place in a legal setting, typically involving district, state, or county attorneys, judges, and other parties. By contrast, in an expedited administrative process, the state CSE program has the authority to administer certain aspects of state child support law or regulation without court approval being required for legally binding actions. Although the states administer the child support enforcement program, the federal government plays a major role. This includes funding most of the program and requiring states to develop certain policies and procedures to help locate noncustodial parents and enforce child support orders. The Office of Child Support Enforcement (OCSE), in conjunction with regional HHS offices, is responsible for overseeing and monitoring state CSE programs’ compliance with federal requirements. The Personal Responsibility and Work Opportunity Reconciliation Act (PRWORA) of 1996 amended portions of the Social Security Act, including some provisions that pertained to child support enforcement. One such provision mandates that states enact laws requiring state agencies to collect SSNs for child support enforcement purposes. Under PRWORA, SSNs are to be recorded when individuals apply for certain licenses such as commercial driver’s licenses, occupational and professional licenses, and marriage licenses. This provision also mandates placing SSNs in records related to divorce decrees, death certificates, child support orders, and paternity establishments. The Balanced Budget Act of 1997 expanded this requirement to include the collection of SSNs from applicants for all driver’s licenses—commercial and noncommercial—and also made it effective for applicants of recreational licenses. Additionally, the Balanced Budget Act initially made the effective date of this provision retroactive to October 1996, as if it had been included in PRWORA. In 1998, however, the effective date of this provision was extended to October 1, 2000. This provision only required that SSNs be collected, not that they be displayed on driver’s licenses. A second provision of PRWORA requires that states enact laws requiring procedures to suspend licenses of noncustodial parents who owe past-due child support. Licenses subject to suspension include commercial and noncommercial driver’s licenses, and occupational and professional licenses. Additionally, as part of their CSE plans, states are required to provide OCSE with information on how they will implement the procedures prescribed in their laws. CSE programs use SSNs to help locate noncustodial parents and enforce support orders. SSNs are important in these endeavors because, by virtue of being unique numbers, they help ensure that the correct person has been identified as the noncustodial parent. This accurate identification is essential in situations in which databases contain several individuals with the same or similar names and birthdates. When SSN data are not available, child support officials said that it is more likely that the wrong person will be identified as the noncustodial parent. Efforts to confirm identity by other means can be labor-intensive and time-consuming. When SSNs are available, child support programs use them as one component in their efforts to identify the whereabouts, income and assets of noncustodial parents by matching them against those in state and federal databases. For example, child support programs use these matches to obtain address information to locate noncustodial parents, to obtain employment information to enforce support orders, and to identify the driver’s licenses of noncustodial parents who are candidates for license suspension. Although CSE programs obtain SSNs from a variety of sources, including MVAs, CSE programs themselves are not generally a source of SSNs for other agencies. Generally, CSE programs may disclose SSNs only to other CSE programs or social service agencies. While MVAs’ use of SSNs varies, some MVAs accept a valid Social Security card as one form of identification to issue a driver’s license. MVAs also use SSNs to control fraudulent driver’s license applications, for internal administrative purposes, or to track fines or fees. For these reasons 35 of the MVAs collected SSNs from all drivers before being required to do so by the federal government. Most MVAs (47 out of 53) collect SSNs from all applicants for driver’s licenses, but OCSE has taken limited or no steps to promote such collection in states not currently doing so. Almost two-thirds of the MVAs collecting SSNs collected them from all driver’s license applicants prior to the passage of the Social Security Act’s requirement to do so. Of the 6 states that are not collecting SSNs from all applicants for driver’s licenses, the legislatures in 5 (Georgia, Kansas, Maryland, Minnesota, and Oregon) have not introduced laws requiring collection of SSNs in this manner, and, although the remaining state (Michigan) has passed such a law, the MVA has not implemented it. OCSE did not take any action against 1 state (Michigan) because of a lawsuit, did not take formal action against 2 states (Georgia, and Minnesota), and did not know that 3 states were not collecting SSNs from all applicants for driver’s licenses. Table 1 shows that almost two-thirds of the MVAs were collecting SSNs from all driver’s license applicants before the date of the legislation requiring this practice, August 5, 1997. There are two opportunities for MVAs to collect SSNs on all applicants, at license issuance and renewal. Of the 6 states not collecting SSNs from all driver’s license applicants at the time of our review, 2 performed such collections during the 1980s or 1990s. MVA-collected SSNs are used in at least one of two ways by CSE programs in all but 2 of the 47 states that adhere to this federal requirement. The first way that CSE programs use MVA-collected SSNs, along with SSNs from other sources, is to help initially establish or verify the SSNs of noncustodial parents. CSE programs consult a variety of sources simultaneously when doing this, often through electronic networks that link state agencies, including MVAs, or federal agencies. The second way that MVA-collected SSNs are used in most states is to identify the driver’s licenses of noncustodial parents who are candidates for suspension. This is normally done through computer matches, where the SSN from the CSE program, the SSN from the MVA, and several other pieces of information must match prior to suspending the driver’s license of a particular noncustodial parent. CSE officials from 44 of the 47 states that are collecting SSNs found them useful, while 3 did not find them useful. The officials who found them useful said that the SSN is one of many sources that their programs consult and some of these officials elaborated on factors that make MVA- collected SSNs useful. Several explained that MVA-collected SSNs were helpful because this source included SSNs on almost everyone in the CSE system. This is presumably because MVAs have access to a wide range of people—everyone who wants a driver’s license. Others added that MVAs were particularly helpful for obtaining the SSNs of noncustodial parents who were self-employed, unemployed, or working for cash because the SSNs of these individuals tend not to be found in other more commonly used SSN sources, such as state and federal agencies that maintain employment or tax records. Finally, others explained that MVAs were particularly important for identifying the driver’s licenses of noncustodial parents who were candidates for license suspension. CSE officials in the 3 states that did not find SSNs useful, as well as in other states, cited various drawbacks to MVA-collected SSNs. First, in states where MVAs only recently began collecting SSNs, they often do not have SSNs from enough individuals for them to be of much use to the CSE program. Second, MVA SSNs can be unreliable because most MVAs do not have procedures in place for verifying that drivers are providing their correct SSN. Only 14 of the 49 MVA survey respondents who answered this question reported that they verify the SSNs that they collect with the agency that issues SSNs, the Social Security Administration. Third, in two states, CSE program officials prefer to use other sources. As of the time of our survey, six states were not complying with the Social Security Act’s requirements that they pass and implement laws mandating SSN collection on all drivers’ license applications. Three of these states— Georgia, Michigan, and Oregon—were not collecting SSNs from any applicants. Three states—Kansas, Maryland, and Minnesota— were doing so for some, but not all, applicants. The legislatures in all of the states, except Michigan, did not pass laws requiring the collection of SSNs from all applicants for driver’s licenses. Officials from the MVAs and CSE programs in these five states indicated that this noncompliance occurred, at least in part, because their programs either did not bring the need for such laws to their legislatures’ attention or did not sufficiently highlight the need. For example, a CSE official in Oregon told us that the state legislature was required to pass various laws to comply with the Social Security Act’s requirements and the need to pass a law requiring collection of SSNs on driver’s license applications was simply overlooked until sometime in 2000 or 2001. CSE officials in Maryland and Kansas told us that they mistakenly thought that the MVAs in their states were collecting SSNs from all driver’s license applicants and thus never proposed that their legislatures pass such legislation. CSE and MVA officials from these five states stated that their legislatures would most likely debate the privacy implications of this requirement should legislation be proposed. However, privacy was not characterized as the overriding reason for not trying to get such legislation passed. Other reasons included the concern that proposing SSN legislation might detract from pursuing other child support priorities, a belief that the MVA already had the authority to collect SSNs in this manner, and concerns about the cost of implementing this requirement. Michigan differs from the other five states that were not collecting SSNs in that its legislature passed a law in 1998 requiring its MVA to collect SSNs from all driver’s license applicants. However, the secretary of state, who oversees the state’s MVA, did not want to implement this law for some of the same reasons cited in other states—cost and privacy. Michigan’s attorney general filed suit against the federal government in early 2001 challenging the constitutionality of the act’s requirement. The court ruled against Michigan in October of 2001 and as a result the MVA is now planning to implement the state law. OCSE is responsible for overseeing the states’ adoption and implementation of federally mandated requirements related to child support enforcement. This includes tracking state passage and implementation of conforming laws and taking formal action when necessary to promote compliance with such requirements. OCSE has not fulfilled these responsibilities in regard to the six states not in compliance with the Social Security Act’s requirements regarding the collection of SSNs. This is largely because OCSE officials did not know about the noncompliance in four states and did not take formal actions against the other two states. State plans describe the nature and scope of a state’s CSE program. Child support staff located in the regional offices of OCSE’s parent agency, HHS, review and approve these plans, and approval is a condition for federal funding of state CSE programs. As part of the state plan approval process, OCSE and regional offices track whether states have passed federally mandated laws. CSE programs are required to update these plans at various times, including when their states pass new laws to comply with federal requirements. HHS regional office staffs are responsible for reviewing these updates to ensure that they comply with all federal requirements. One tool that regional staff use for reviews is the legislative analysis checklist, a list of federally mandated laws that states are required to follow. OCSE learned from us about the noncompliance in three (Kansas, Maryland, and Oregon) of the six states at the end of November 2001,well after the implementation deadline. This was more than 4 years after the SSN collection requirement was made part of the Act (August 5, 1997) and nearly 14 months after the deadline for implementation (October 1, 2000). With regard to two other states, OCSE became aware that one (Georgia) was not in compliance sometime prior to September 2000 and the other (Minnesota), in December of 2000. For the remaining state (Michigan) we were unable to determine when OCSE learned that it was noncompliant. Because regional staff were unaware of state noncompliance at the time that they were reviewing state plans, they erroneously approved four of the six state plans. One HHS regional staff member mistakenly believed that MVAs’ collecting SSNs from some, but not all, driver’s license applicants was in accordance with the act. Thus, this staff member, although responsible for monitoring this state, did not know that the state was not in compliance with this requirement until we raised this issue in July 2001. Regional staff responsible for three other states were unaware that the states were not collecting SSNs from all licensed drivers. Regional staff for these four states may not have been closely reviewing the SSN requirement because the Act established many new requirements and OCSE senior officials indicated that the requirement for MVAs to collect SSNs was not their highest priority. Once OCSE officials and regional staff learn about noncompliant states, they are responsible for taking action to try to bring the states into compliance. They can take informal action—discussing the situation with state CSE program officials and other relevant parties—or, in the case of OCSE, formal action. OCSE officials take two types of formal actions. The first is to disapprove a state plan, which will result in a state losing all federal funds for its CSE program until it brings the program into compliance with federal requirements. The second is to conduct targeted audits focused on specific areas of noncompliance, which could result in a state being subjected to graduated monetary penalties based on how long it takes for the state to address the problem. As of December 2001, OCSE officials had not taken formal action against the two states that they knew were not complying with the federal requirement that states pass and implement laws requiring collection of SSNs. Regional staff took informal actions, including sending a letter in April 2001 to a CSE program in one state indicating that it may receive a Notice of Intent to Disapprove State Plan in the future if it does not comply with the SSN requirement. When asked why formal action has not yet been initiated in these two states, officials responded that OCSE’s strategy is to first try to bring about compliance through informal discussions. One senior official also informed us in December 2001 that OCSE has asked HHS regional staff to determine the extent to which the states that they are responsible for overseeing are complying with the MVA requirement as well as the requirement that other licensing agencies collect SSNs from licensees. Once such determinations are complete, OCSE in conjunction with HHS will decide what formal actions, if any, to take against noncomplying states. OCSE officials were not able to tell us when such determinations would be made. State officials and privacy experts we spoke with generally did not express privacy concerns regarding the policy that MVAs collect SSNs for child support enforcement. Although many of these individuals did express concern about the increased dissemination of SSNs throughout society, most did not extend this concern to MVA-collected SSNs. This low level of concern may reflect the facts that CSE programs are widely viewed as having a legitimate need for SSNs and that federal and state laws greatly limit the extent to which MVAs can provide SSNs to others. Privacy, however, can be compromised if SSNs are not properly safeguarded. Our survey of MVAs indicates potential weaknesses in this area. Generally, state officials and privacy experts we spoke with did not express privacy concerns related to MVAs collecting SSNs for child support enforcement. Most state child support enforcement officials, MVA officials, attorney general officials, and state legislators did not view this requirement as one that raised privacy concerns, reported no widespread objections to the requirement from members of the public, or did not consider this requirement one of the current major threats to privacy in their states. Additionally, privacy experts we contacted tended not to identify this requirement as an issue of concern. Many of these same individuals, however, expressed general privacy concerns related to the increased dissemination of SSNs throughout society because such dissemination increases opportunities for their unauthorized use and disclosure. These concerns focused on the dissemination of SSNs in the private sector and the belief that SSNs are too easily accessible. For example, concerns were expressed about the use of SSNs in commercial transactions, as a student identification number, or as a library card number. Concerns were also expressed about how easily SSNs can be obtained from the Internet or through companies that collect and sell personal information. The low level of concern about MVAs collecting SSNs for child support enforcement on the part of those we spoke with may be because SSNs are being collected in support of a federal program and federal law restricts how MVAs can use and share them. For example, officials of the Texas and Georgia attorney general’s offices and MVA officials in Texas and North Carolina pointed to government’s purpose in collecting SSNs to facilitate the payment of child support as a reason why they are not concerned about privacy. Children’s advocacy groups echoed this belief, and noted that SSNs are particularly important for facilitating the collection of payments when noncustodial parents or their income and assets are not in the same state as the child. Furthermore, federal law greatly restricts the extent to which MVAs can provide SSNs to other entities. Federal law protects individual privacy by affirming the principle that the individual has a right to control personal information released about oneself to others, by giving consent to such disclosures. The Driver’s Privacy Protection Act of 1994 (DPPA)explicitly defines SSNs as “highly restricted personal information,” a category of information that may not be disclosed without “express consent” of the individuals affected by the requests, except for certain “permissible uses.” According to MVA officials, the DPPA’s consent provision has led MVAs to discontinue the bulk disclosure and sale of personal information, including SSNs, to private-sector entities. Additionally, entities authorized to receive data under the DPPA must also comply with the law’s provisions—that is, generally, they may not redisclose SSNs without the driver’s consent. Moreover, MVAs are free to adopt policies that are more restrictive than those in the DPPA. For example, the Texas MVA only shares SSNs with two other entities, both of which are government agencies, and places redisclosure restrictions on these agencies. Additionally, according to responses to our survey, when asked to identify entities that receive SSN data from their agencies, MVA officials in 30 states identified only other government agencies as receiving such data. States can also enact laws or require written agreements to further restrict the extent to which entities that receive SSNs from MVAs can disclose those SSNs to other entities. Based on survey responses, 33 MVAs operate under such laws, written agreements, or both. State officials in the six states not collecting SSNs from all driver’s license applicants expressed the most concern about the SSN requirement. Although privacy was not the only nor the overriding reason these individuals cited for not complying with this requirement, it was one factor. These individuals mentioned that privacy concerns have been expressed within their own agencies, by members of the public in their states, or in their state legislatures. Such concerns were linked to the belief that government use of SSNs can intrude on privacy, for example, by exposing people to the risk of identity theft or by allowing government agencies access to personal information that some people would rather not provide to them. Privacy can be compromised if there are computer security weaknesses because they raise the possibility that SSNs and other data stored in MVA computers could be improperly accessed and misused. The federal government has established guidelines for effective computer security programs in federal agencies; however, there are no uniform guidelines for MVAs. While most MVA officials believe that their agencies are adequately protecting the SSNs that they collect, our survey, which asked about several of the components included in the federal guidelines, points to potential weaknesses in the computer security programs at these agencies. The federal government has established guidelines identifying practices essential to effective computer security. These guidelines have emphasized the need to continually assess and mitigate risk. The Office of Management and Budget (OMB) and the National Institute of Standards and Technology (NIST) have issued standards for federal agency computer security. Further, in 1999, we issued the Federal Information System Controls Audit Manual (FISCAM), a comprehensive guide to conducting computer security audits that is consistent with the OMB and NIST standards. In 2000, the Congress passed Government Information Security Reform (GISRA) provisions that codified existing federal computer security guidance. GISRA provisions include requirements for risk assessment, agencywide security plans, independent audits, and appropriate control techniques. This last category includes techniques such as monitoring external access and appropriate policies for the selection and use of passwords. GISRA requires federal agencies to adopt computer security programs, but it does not require that state agencies do so. Furthermore, although computer security standards have been established for state child support agency systems, there are no nationwide standards or guidelines for MVA computer security programs and computer security was not addressed in the federal laws related to SSNs at the MVAs. MVAs as a group have not developed computer security standards. Moreover, officials from the American Association of Motor Vehicle Administrators (AAMVA) told us that the association did not have a program to promote computer security standards or best practices among MVAs. AAMVA officials said, however, that AAMVA would be willing to do so if the Congress decides that such standards are needed. Furthermore, although the Social Security Act requires MVAs to collect SSNs for child support enforcement purposes and restricts their use to those purposes, the law did not address computer security at MVAs. Similarly, while the DPPA addressed the disclosure of SSNs by MVAs, it did not address computer security practices that MVAs should adopt to safeguard SSNs on their systems. Nearly all MVA officials we spoke with believed that the SSNs stored on their agencies’ computers are safe from unauthorized access. Our survey asked MVA officials how easy or difficult it would be for MVA employees or outside individuals to improperly access SSNs in their agencies’ computer systems. Of the 48 MVA officials responding, only 4 said that such access would be easy for MVA employees and none said such access would be easy for individuals not employed by MVAs. We obtained more detailed information on the security programs during site visits at five MVAs. Officials at these sites described the computer policies and procedures that they believe make unauthorized access of MVA-collected SSNs difficult. These included firewalls to detect and prevent individuals not employed by MVAs from accessing MVA computer systems. We did not perform any audit tests to verify MVA responses. When asked about their computer security programs, MVA officials in 40 states said at least one of five components of computer security in our survey was missing in their programs. This number included the 4 officials who said that unauthorized access was easy at their agencies and most of those who said that it was difficult. These elements are important for protecting all personal information on driver’s license applicants that MVAs collect, not just SSNs. Other types of personal information include names, addresses, and telephone numbers. In MVA programs, at least one of the following elements was missing: risk assessments to identify and explore how to mitigate potential vulnerabilities; agencywide security plans to describe an agency’s overall security audits to evaluate an agency’s security program; access monitoring of an agency’s computer system; and appropriate password selection and use. GISRA specifically established a requirement for risk assessments and agencywide security plans, among others. Periodic risk assessments provide the foundation for other aspects of computer security management. These risk assessments not only help an agency identify risks and determine which controls will most effectively mitigate them, but they also increase awareness and support for adopted policies and controls. Such policies and controls should be described in agencywide security plans. These written plans are important, according to government and private security experts, to clearly and comprehensively describe all of the security policies and procedures that an agency must follow. These plans also serve as the primary mechanism by which management communicates such requirements to an agency. It is important to have both risk assessments and agencywide security plans because each of these components influences the other. That is, security plans should include policies and procedures about when and how to conduct risk assessments and conducting risk assessments can lead to revising security plans. Table 2 shows, however, that fewer than half of the MVA officials responding to our survey reported that their agencies conduct risk assessments or have agencywide security plans. Moreover, seven officials reported that their agencies did not conduct risk assessments nor have agencywide security plans. GISRA and FISCAM call for computer security audits, which are also important to an agency’s computer security program. Such audits can help agencies obtain objective assessments of their computer security risks and provide information for agencies to use in developing their risk assessments and agencywide security plans. According to our survey, officials at 21 MVAs reported that they have not obtained any independent audits, reviews, or studies. Moreover, of the seven MVAs that lack both risk assessments and security plans, six have never obtained independent audits. GISRA and the FISCAM also include two components of computer security that are part of a broader category, known as control techniques or access controls. These two components are monitoring who is accessing computerized data and adherence to appropriate policies for password selection and use. These are important because they can provide reasonable assurance that computerized data are protected against unauthorized disclosure. Monitoring consists of procedures to detect unusual access activity, such as access by an unauthorized individual or repeated failed attempts to log into a computer system. Passwords are reportedly used by almost all MVAs to distinguish users from one another. Policies about their selection and use ensure that they cannot be easily guessed, copied, or overheard by someone attempting unauthorized access. FISCAM includes nine typical policies for protecting passwords. These typical policies for protecting passwords include changing them periodically and setting a minimum length of characters or numbers. Table 3 shows that officials in 31 MVAs reported that their agencies monitor access to their computer systems and adhere to five or more of the nine typical policies on password selection and use. Officials at 19 other MVAs reported that their agencies do not monitor access, do not adhere to at least five of the nine password policies, or do not do either. (See table 4.) The password policies that MVA officials reported most often as not being followed were requiring that passwords consist of both numbers and letters and encrypting passwords. Although MVA officials reported that their computer security programs lacked at least one of five basic components of information security included in our survey, we are not recommending specific action because at this time, no federal agency has responsibility related to computer security at state MVAs. CSE officials in 35 states told us that their programs use driver’s license suspension extensively and our work shows that, when used, this process can result in collecting payments. All CSE programs have policies and procedures in place for driver’s license suspension, including criteria specifying the level of delinquency noncustodial parents must attain before a CSE program begins the driver’s license suspension process. Although CSE officials in most states said that their programs use this tool extensively, CSE officials in 16 states told us that their programs were not using this tool in all cases that met their state’s delinquency criteria for use. When used, the driver’s license suspension process can result in collecting child support payments in some cases. Our analysis of the use of this tool in four states, for example, found that it led to collecting payments in 29 percent of the cases for which it was used. All states have driver’s license suspension policies and procedures in place. Driver’s license suspension is the end result of a process that starts with the identification of potential noncustodial parents who are candidates for suspension because they are delinquent in their child support payments. After initial identification, a warning letter is usually issued notifying the noncustodial parent who is delinquent in paying child support that his or her driver’s license may be suspended within a specified number of days unless the noncustodial parent pays the delinquent amount, establishes a payment plan, or requests a hearing to appeal the suspension. If noncustodial parents do not respond within this time period, they become candidates for driver’s license suspension. One key difference in driver’s license suspension among states is the level of delinquency that qualifies a noncustodial parent for suspension. Such delinquency criteria is based on the amount of past-due support owed, the length of time in which a payment has not been made, or a combination of the two. Among the states with a delinquency criteria of past-due support owed the amount ranges from $500 to $5,000 or the amount of support that would accumulate in 1 to 12 months. The criteria also may specify a length of time in which a payment has not been made, and it ranges from 1 to 6 consecutive months. A second key difference in driver’s license suspension among states is the agency that has authority to initiate and carry out this process. In 13 states, suspending a driver’s license because of nonpayment of child support is a judicial process in which courts can order a license suspension after holding a hearing. In 31 states, it is an administrative process in which the CSE program can suspend the license, usually after the program has given the noncustodial parent an opportunity to contest the suspension. Finally, 10 states use both judicial and administrative processes, meaning that both CSE programs and courts can initiate and order driver’s license suspension. CSE officials we spoke with in 35 states indicated that their programs are using driver’s license suspension extensively. Officials in more than half of these states said their programs initiate the driver’s license suspension process in all cases that meet their states’ delinquency criteria. The remaining officials in these 35 states characterized their programs’ use of driver’s license suspension as routine or frequent or, as in the case of one state, provided us with data on use of license suspension indicating that it is used in many cases. CSE officials we spoke with in 16 states told us that their programs were not using driver’s license suspension to its full extent. These officials said that, although their states use driver’s license suspension, it is not used in all cases that meet their states’ delinquency criteria primarily due to factors related to the discretionary nature of judges’ authority and to cumbersome administrative processes. Almost all of these officials indicated that the child support programs in their states could benefit from increased use of this tool and characterized driver’s license suspension as an effective tool for obtaining payments from noncustodial parents who are delinquent in paying child support. In 11 of the 16 states in which CSE officials reported that driver’s license suspension is not used fully, licenses are suspended through a judicial process and, according to CSE officials, many judges are reluctant to order it. The CSE officials from judicial states who believed that some judges were not fully using driver’s license suspension characterized such judges as being reluctant about suspension in general, as opposed to deciding that it was inappropriate on a case-by-case basis. The main reason CSE officials cited for judges’ reluctance to use driver’s license suspension was concern that suspending driver’s licenses would deny noncustodial parents transportation to and from work, making it more difficult for the parents to generate earnings and pay child support. Driver’s license suspension is an administrative process in 5 of the 16 states, and CSE officials in these 5 states said that they would like their programs to use it more often for the collection of child support payments. These officials said that their programs were not fully using license suspension primarily because the process for suspending licenses was cumbersome. For example, as officials from 2 states reported, the monitoring of noncustodial parents’ responses to the initial warning letter can be time-consuming and can make CSE staff reluctant to initiate the license suspension process. Even when a noncustodial parent responds to the warning letter by making payments, CSE staff must monitor the payments for years after sending the letter because the driver’s license can be suspended at any time that the parent stops making payments. In addition, officials in other states reported that difficulties working with MVAs made the license suspension process cumbersome and limited its use. In 1 state, for example, officials said that the MVA’s computer system matches delinquent parents with their driver’s license primarily by first and last name, and the system cannot identify the correct driver’s license to suspend if the delinquent parent has a common name. Consequently, the CSE program may not be able to suspend the driver’s licenses of those noncustodial parents with common names. In the remaining 3 states it was not possible to gauge CSE program use of driver’s license suspension at the time of our review. One state has recently relaxed its delinquency criteria, and the CSE official in that state believes the program will use driver’s license suspension more extensively as a result. The CSE program in the second state was in the process of implementing this tool. Finally, in the third state, the CSE officials said they were making major changes to its implementation procedures that should result in driver’s license suspension being used frequently. Driver’s license suspension alone, or in conjunction with other enforcement actions, does lead some noncustodial parents with past-due support to make their child support payments. We obtained data on driver’s license suspension in calendar year 2000 in four states—Colorado, Maryland, Pennsylvania, and Washington. We found that in nearly one out of every three cases, parents who were subjected to this action made at least one child support payment after being notified that their licenses could be, or were being, suspended for nonpayment of child support. In calendar year 2000, 104,608 noncustodial parents in the four states we examined had their driver’s licenses threatened or suspended and the total amount of child support collected from these parents was $48 million. In three of these states, the CSE programs were able to break their suspension data into two groups: cases in which noncustodial parents were warned of a possible suspension and cases in which the noncustodial parents’ licenses were actually suspended. Table 4 shows that in 80 percent of the cases, the states threatened suspension but did not actually suspend the license. Moreover, in 28 percent of the cases, noncustodial parents who were threatened with suspension made at least one payment, resulting in $35 million in support payments. In addition, in 25 percent of the cases, noncustodial parents whose licenses were suspended made at least one payment, resulting in payments totaling $6 million. Although no one tool is always effective in collecting payments in all cases, CSE officials in 51 states believe, and our data analysis shows, that suspension does result in some noncustodial parents paying the support they owe. Specifically, many CSE officials characterized driver’s license suspension as effective for reaching one or both of the following types of noncustodial parents: (1) those who have a source of income from which CSE programs cannot directly collect payments and (2) those who need their license for work or transportation. Examples of noncustodial parents in the first category are those who are self-employed, informally employed, or are paid in cash. In these situations, CSE programs cannot withhold wages directly through the noncustodial parent’s employer either because the parent does not have an employer or the CSE program is not able to identify the employer. Examples of noncustodial parents in the second category are those in jobs requiring a driver’s license and those residing in areas in which automobiles are the primary means of transportation. CSE officials also described circumstances in which driver’s license suspension was not effective in motivating noncustodial parents to pay the support they owe. The most common circumstance cited by officials for suspension not being effective was that some noncustodial parents may not be concerned about losing their driver’s licenses. Such parents may, for example, already be driving with expired licenses, or their licenses may have been suspended for reasons unrelated to child support enforcement. In addition, several officials noted that some noncustodial parents do not pay the child support they owe regardless of the enforcement action used against them. For example, some CSE officials reported that their programs have tried using every tool available against certain noncustodial parents, and none of these efforts have resulted in child support payments. Furthermore, CSE officials stated that some noncustodial parents do not have the money to make their support payments so that any action taken, including driver’s license suspension, would be ineffective. While most MVAs collect SSNs from all drivers and most CSE programs use them, CSE programs in states where MVAs are not collecting SSNs as required by federal law are not receiving the benefit of SSNs from this source. SSNs from MVAs are particularly valuable because they include the SSNs of noncustodial parents that CSE programs may have had difficulty obtaining from other sources. As the oversight office for state CSE programs, OCSE should know whether MVAs are collecting SSNs from all driver’s license applicants and take action, which may result in state monetary penalties, when they are not. To ensure that all states are following the federal requirements that states enact and implement laws requiring the collection of SSNs from all driver’s license applicants for child support enforcement purposes, we recommend that OCSE more effectively track compliance with this requirement and take formal action, when necessary, against states that are not in compliance. OCSE should, for example, ensure that staff effectively use the legislative analysis checklist that is designed to track the adoption and implementation of state laws. The agency should also take formal actions, when necessary, such as disapproving state plans or conducting targeted audits, in an effort to promote compliance with this federal requirement. We received written comments on a draft report from the Department of Health and Human Services’ Administration for Children and Families. These comments are presented and evaluated in appendix III. The department agreed with our findings and said that the Office of Child Support Enforcement will strengthen its efforts to monitor and oversee state plan compliance with regard to SSNs and licenses. Additionally, the department asked that we include more information on OCSE’s approach for ensuring state compliance, which we did. The department said that we incorrectly stated that its OCSE learned about noncompliance in Michigan at the end of November 2001 and the department disagreed strongly with the statement that it did not view MVAs collecting SSNs as a high priority. We dropped this reference to November 2001 and revised the report to reflect that the officials indicated that collecting SSNs was not their highest priority. In addition, the department provided technical comments, which we incorporated in the report as appropriate. As agreed with your offices, unless you publicly release its contents earlier, we will make no further distribution of this report until 30 days after its issue date. At that time, we will send copies of this report to appropriate congressional committees, the secretary of HHS and other interested parties. We will also make copies available to others on request. If you or your staff have questions concerning this report, please call me on (202) 512-8403. Key contributors are listed in appendix IV. The objectives of our review were to (1) determine the extent to which states have implemented the federal requirement that MVAs collect SSNs from all licensed drivers and what OCSE has done to promote compliance in states not adhering to this requirement, (2) identify privacy concerns associated with MVA efforts to collect and safeguard SSNs that are used for child support enforcement purposes, and (3) determine the extent to which state CSE programs use driver’s license suspension to collect past- due child support and whether this tool has resulted in collections. We conducted our review from November 2000 through December 2001 in accordance with generally accepted government auditing standards. To accomplish the above objectives, we mailed a survey to 54 MVAs, conducted telephone interviews with 54 CSE programs, conducted site visits in five states, analyzed data on driver’s license suspension from CSE programs in four states, and interviewed officials from HHS’s OCSE and regional offices. We mailed a survey to 54 MVAs—one in each of the 50 states, the District of Columbia, and three of the U.S. territories—and received 53 completed surveys from the MVAs. The intent of the survey was to obtain information about (1) the extent to which MVAs collect SSNs from licensed drivers and (2) their policies and procedures regarding the collection, sharing, and safeguarding of SSNs. We took steps during survey design and data analysis to minimize errors. For example, we pretested the survey in 3 states prior to mailing it to all survey respondents to ensure that we were phrasing questions in the best way. We also contacted respondents to clarify information when needed. Telephone Interviews with We telephoned CSE officials in the 50 states, the District of Columbia, and State CSE Programs	 the same three U.S. territories that received our MVA survey. The overall objectives of these interviews were to obtain information on how CSE programs use MVA-collected SSNs and driver’s license suspension and whether they find them helpful in locating noncustodial parents and getting them to pay the support they owe. Our questions about the use of MVA-collected SSNs focused on (1) whether and how CSE programs use MVA-collected SSNs; (2) the importance attached to this SSN source; and (3) whether privacy concerns were expressed about the requirement that MVAs collect SSNs from all licensed drivers and, if so, whether and how such concerns were addressed. Our questions about the use of driver’s license suspension focused on (1) the policies and procedures that CSE programs follow for driver’s license suspension, (2) the extent to which CSE programs use driver’s license suspension, and (3) whether driver’s license suspension is effective in getting noncustodial parents to pay the support that they owe. We visited five states—California, Georgia, Michigan, North Carolina, and Texas—and held face-to-face meetings with officials from CSE programs, MVAs, and offices of attorney general. In addition, we met with state legislators involved with privacy or child support enforcement issues and privacy experts. We discussed in more detail the topics covered in the CSE program telephone interviews and the questions contained in the MVA survey focusing on computer security and use of SSNs (see app. II). We selected these five states because they are geographically diverse and because they have differing practices with regard to MVA-collected SSNs and use of driver’s license suspension. Specifically, we wanted a mix of states with respect to whether MVAs were collecting SSNs from all licensed drivers and whether driver’s license suspension was a judicial process or an administrative process. Of the five states, three were collecting SSNs from all drivers and two were not and two used administrative procedures to suspend driver’s licenses, two used judicial procedures, and one used both. We analyzed data from CSE programs in four states to determine how often these programs used the driver’s license suspension process in calendar year 2000 and the extent to which this process resulted in collecting payments. The states were Colorado, Maryland, Pennsylvania, and Washington, and we chose them because they had the type of automated data that we required for this analysis and were willing to provide it to us. CSE program personnel extracted the data we requested from their files. We did not verify the accuracy of the data; however, we did review the data for reasonableness, consistency, and suitability for our analysis. The objective of our data analysis was to identify child support payments that could reasonably be attributed to driver’s license suspension. For 56 percent of the cases in which we attributed payments to suspension, this identification was straightforward. That is, the data were sufficient to indicate that these payments were the result of either the threat of driver’s license suspension or an actual suspension. In the other 44 percent of the cases, it was not possible to conclude that the payments were solely the result of driver’s license suspension. This is because the data showed that the CSE programs took other enforcement actions at about the same time as driver’s license suspensions and the data did not indicate which actions were responsible for the payment. In these cases, we concluded that driver’s license suspension, in conjunction with other actions, resulted in payments. The most common action taken in these situations was reporting delinquent payment information to credit bureaus. Other, less common actions included conducting computer matches to identify bank accounts and suspending professional licenses. We counted all payments that were solely or partially attributable to driver’s license suspension in calendar year 2000. Our starting point for counting these payments was the first payment made after a noncustodial parent received a letter stating that his or her driver’s license could be, or was being, suspended. We stopped counting payments at the end of 2000 or when another enforcement action was taken. New enforcement actions would only have been taken if the noncustodial parent had stopped making payments. Because driver’s license suspension is a process that starts with a warning letter and may end with a suspension, we counted the entire process as one action. Thus, if a noncustodial parent received one or more warning letters regarding a possible suspension, but never had his or her license suspended, we counted this as a single action. If a noncustodial parent did not respond to warning letters and had his or her license suspended, we counted this entire process—warning through suspension—as a single action. Finally, if a noncustodial parent went through the driver’s license suspension more than once in 2000, we counted each time as a separate action. For Colorado, Pennsylvania, and Washington, we obtained data on all driver’s license suspension actions occurring during calendar year 2000 and whether these actions were warnings or actual suspensions. Thus, for these states, we could distinguish when actions were warning actions and when they were suspension actions and the amount of payments that resulted from each. For Maryland, however, we could only obtain information on the last driver’s license suspension action taken in a case and could not tell if this action was a warning letter or an actual suspension. We interviewed officials from OCSE and HHS regional offices about federal oversight of the Social Security Act’s requirement about MVA- collected SSNs. We discussed (1) the extent to which states are complying with the SSN requirement, (2) whether OCSE and the regional offices were aware that certain states were not in compliance, (3) what OCSE is doing to promote compliance in these noncompliant states, and (4) OCSE’s role in driver’s license suspension. We also reviewed OCSE program documents, OCSE official communications, and selected states’ laws regarding MVAs collecting SSNs. Finally, we talked with officials from the CSE programs and MVAs in each noncompliant state about why their states were not complying with this federal requirement. The following are GAO’s comments on the Department of Health and Human Services’ Administration for Children and families letter dated February 6, 2002. 1.	 We note in the body of the report that OCSE’s strategy for ensuring state compliance is to first work with states through informal mechanisms. 2. We deleted the reference to the November date in regard to Michigan. 3.	 After further review of the information, we revised the report to reflect that OCSE officials said that collecting SSNs was not their highest priority. 4.	 We revised the text to clarify that disapproving a state plan will result in a state losing all federal funds for its child support enforcement program until the program comes into compliance. 5.	 We revised the statement to reflect that it depends on the state where the action takes place. 6. We corrected the title of the act. In addition to those named above, the following individuals made important contributions to this report: Christopher Morehouse, Cathy Pardee, Kate Kousser, and Yunsian Tai.

Summary: Congress established a national child support enforcement (CSE) program in 1965 to ensure that noncustodial parents financially support their children. In fiscal year 2000, the Office of Child Support Enforcement (OCSE) estimated that $84 billion in past-due child support was owed, but never collected. The Social Security Act contains provisions to help child support agencies collect support when noncustodial parents or their income and assets are hard to find. The Act mandates that states enact laws requiring social security numbers (SSNs) on applications for a driver's license. State CSE programs rely on SSNs to locate the addresses, income, and assets of noncustodial parents. Motor vehicle agencies can be a valuable source of SSNs that CSE programs have difficulty obtaining elsewhere. The Act also requires that states suspend, withhold, or restrict the driver's licenses of noncustodial parents delinquent in child support payments. Most motor vehicle agencies that GAO surveyed collect SSNs from all applicants for driver's licenses, but OCSE has taken few steps to promote such collection in states not currently doing so. Although state officials and privacy experts expressed few concerns about motor vehicle agencies collecting SSNs for child support enforcement, possible weaknesses in the policies and procedures in use to safeguard SSNs indicate the potential for compromising privacy. Child support enforcement officials in 35 states told GAO that their agencies use driver's license suspension extensively, which has led to the collection of some payments.