The growth in information technology, networking, and electronic storage has made it ever easier to collect and maintain information about individuals. An accompanying growth in incidents of loss and unauthorized use of such information has led to increased concerns about protecting this information on federal systems as well as from private- sector sources, such as data resellers that specialize in amassing personal information from multiple sources. As a result, additional laws protecting personally identifiable information collected and maintained by both government and private-sector entities have been enacted since the Privacy Act of 1974, including measures that are particularly concerned with the protection of personal data maintained in automated information systems. Protecting personally identifiable information in federal systems, such as names, date of birth and SSNs, is critical because its loss or unauthorized disclosure can lead to serious consequences for individuals. These consequences include identity theft or other fraudulent activity, which can result in substantial harm, embarrassment, and inconvenience. Identity theft is a serious problem because, among other things, it may take a long period of time before a victim becomes aware that the crime has taken place, and thus can cause substantial harm to the victim’s credit rating. Moreover, while some identity theft victims can resolve their problems quickly, others face substantial costs and inconvenience repairing damage to their credit records. Some individuals have lost job opportunities, been refused loans, or even been arrested for crimes they did not commit as a result of identity theft. Millions of people become victims of identity theft each year. The Federal Trade Commission (FTC) estimates that in 1 year, as many as 10 million people—or 4.6 percent of the U.S. adult population—discover that they are victims of some form of identity theft, translating into reported losses exceeding $50 billion. In 2007, the FTC estimated that the median value of goods and services obtained by identity thieves was $500, with 10 percent of victims reporting the thief obtained $6,000 or more. Similarly, a more recent 2008 industry survey estimated that, 9.9 million adults in the United States were victims of identity fraud. While available data suggest that identity theft remains a persistent and serious problem, the FTC found that most victims of identity theft do not report the crime. Therefore, the total of number of identity thefts is unknown. Several examples we previously identified illustrate the magnitude of the losses that could occur from a single incident and how aggregated personal information can be vulnerable to misuse: A help desk employee at a New York-based software company, which provided software to its clients to access consumer credit reports, stole the identities of up to 30,000 individuals by using confidential passwords and subscriber codes of the company’s customers. The former employee reportedly sold these identities for $60 each. Furthermore, given the explosion of Internet use and the ease with which personally identifiable information is accessible, individuals looking to steal someone’s identity are increasingly able to do so. In our work, we identified a case where an individual obtained the names and SSNs of high-ranking U.S. military officers from a public Web site and used those identities to apply online for credit cards and bank credit. In 2006, an Ohio woman pled guilty to conspiracy, bank fraud, and aggravated identity theft as the leader of a group that stole citizens’ personal identifying information from a local public record keeper’s Web site and other sources, resulting in over $450,000 in losses to individuals, financial institutions, and other businesses. In February 2007, an individual was convicted of aggravated identity theft, access device fraud, and conspiracy to commit bank fraud in the Eastern District of Virginia. The individual, who went by the Internet nickname “John Dillinger,” was involved in extensive illegal online “carding” activities, in which he received e-mails or instant messages containing hundreds of stolen credit card numbers, usually obtained through phishing schemes or network intrusions, from “vendors” who were located in Russia and Romania. In his role as a “cashier” of these stolen credit card numbers, this individual would then electronically encode these numbers to plastic bank cards, make ATM withdrawals, and return a portion to the vendors. Computers seized by authorities revealed over 4,300 compromised account numbers and full identity information (i.e., name, address, date of birth, Social Security number, and mother’s maiden name) for over 1,600 individual victims. Several steps have been taken, both in terms of legislation and administrative actions to combat identity theft at the federal, state and local levels, although efforts to assist victims of the crime once it has occurred remain somewhat piecemeal. While there is no one law that regulates the overall use of personally identifiable information by all levels and branches of government, numerous federal laws place restrictions on public and private sector entities’ use and disclosure of individuals’ personal information in specific instances, including the use and disclosure of SSNs—a key piece of information that is highly valuable to identity thieves. One intention of some of these laws is to prevent the misuse of personal information for purposes such as identity theft. Two primary laws (the Privacy Act of 1974 and the E-Government Act of 2002) give federal agencies responsibilities for protecting personal information, including ensuring its security. Additionally, the Federal Information Security Management Act of 2002 (FISMA) requires agencies to develop, document, and implement agency wide programs to provide security for their information and information systems (which include personally identifiable information and the systems on which it resides). FISMA is the primary law governing information security in the federal government. The act also requires the National Institute of Standards and Technology (NIST) to develop technical guidance in specific areas, including minimum information security requirements for information and information systems. Other laws which help protect personally identifiable information include the Identity Theft and Assumption Deterrence Act, the Identity Theft Penalty Enhancement Act of 1998, the Gramm-Leach-Bliley Act (GLBA), and the Fair and Accurate Credit Transactions Act (FACTA). (See app. I, table 1, for a more detailed description of these and other related laws.) For example, the Identity Theft and Assumption Deterrence Act, enacted in 1998, makes it a criminal offense for a person to “knowingly transfer, possess, or use without lawful authority,” another person’s means of identification, such as their SSN, with the intent to commit, or in connection with, any unlawful activity that constitutes a felony under state or local law. This act also mandated a specific role for the FTC in combating identity theft. To fulfill the mandate, FTC is collecting identity theft complaints and assisting victims through a telephone hotline and a dedicated Web site; maintaining and promoting the Identity Theft Data Clearinghouse, a centralized database of victim complaints that serves as an investigative tool for law enforcement; and providing outreach and education to consumers, law enforcement, and industry. According to FTC, it receives roughly 15,000 to 20,000 contacts per week on the hotline, via its Web site, or through the mail from victims and consumers who want to avoid becoming victims. In addition, the Identity Theft Enforcement and Restitution Act of 2008 requires persons convicted of identity theft to compensate their victims for the value of the time spent by the victim in an attempt to remediate the intended or actual harm incurred. Another law with some provisions to assist victims of identity theft is FACTA. This law has several provisions to help address the difficulties victims often encounter in trying to recover from identity theft, including (1) a requirement that the FTC develop a model summary of rights to be distributed to consumers who believe that they are victims of identity theft, (2) the right for consumers to place fraud alerts on their credit reports, (3) the right to obtain copies of business records involved in transactions alleged to be the result of identity theft, and (4) the right to obtain all information about fraudulently incurred debts that have been turned over to a collection agency. The Office of Management and Budget has also issued numerous memoranda to federal agencies on safeguarding personally identifiable information. These cover such matters as designating a senior privacy official with responsibility for safeguarding information, and developing and implementing a data breach notification plan. (See app. I, table 2, for a more comprehensive list of pertinent OMB memoranda). Numerous federal agencies can have a role in identifying and investigating identity theft. This is, in part, because identity theft is not a “stand alone” crime, but rather a component of one or more complex crimes, such as computer fraud, credit card fraud, or mail fraud. For example, with the theft of identity information, a perpetrator may commit computer fraud when using a stolen identity to fraudulently obtain credit on the Internet. Computer fraud may also be the primary vehicle used to obtain identity information when the offender obtains unauthorized access to another computer or Web site to obtain such information. As a result, if caught, the offender may be charged with both identity theft and computer fraud. Moreover, perpetrators usually prey on multiple victims in multiple jurisdictions. Consequently, a number of federal law enforcement agencies can have a role in investigating identity theft crimes. How the thief obtains and/or uses an individual’s identity usually dictates which federal agency has jurisdiction in the case. For example, if an individual finds that an identity thief has stolen the individual’s mail to obtain credit cards, bank statements, or tax information, the victim should report the crime to the U.S. Postal Inspection Service, the law enforcement arm of the U.S. Postal Service. In addition, violations are investigated by other federal agencies, such as the Social Security Administration Office of the Inspector General, the U.S. Secret Service, the Federal Bureau of Investigation (FBI), the U.S. Department of State, the U.S. Department of Education Office of Inspector General, and the Internal Revenue Service. The Department of Justice may also prosecute federal identity theft cases. (See app. I, table 3, which highlights some of the jurisdictional responsibilities of some key federal agencies.) Many states have laws prohibiting the theft of identity information. For example, New York law makes identity theft a crime. In other states, identity theft statutes also address specific crimes committed under a false identity. For example, Arizona law prohibits any person from using deceptive means to alter certain computer functions or use software to collect bank information, take control of another person’s computer, or prevent the operator from blocking the installation of specific software. In addition, Idaho law makes it unlawful to impersonate any state official to seek, demand, or obtain personally identifiable information of anothe r person. assistance provisions in their laws. For example, Washington state law requires police and sheriffs’ departments to provide a police report or original incident report at the request of any consumer claiming to be a victim of identity theft. Idaho Code § 18-3126A (2005). certain circumstances. Recently, some county governments have also completed or begun redacting or truncating SSNs that are displayed in public records—that is removing the full SSN from display or showing only part of it. Some are responding to state laws requiring these measures, but others have acted on their own based on concerns about the potential vulnerability of SSNs to misuse. While steps have been taken at the federal, state, and local level to prevent identity theft, vulnerabilities remain in both the public and private sectors. These vulnerabilities can be grouped into different areas, including: (1) display and use of Social Security numbers; (2) availability of personal information through private information resellers; and (3) security weaknesses in federal agency information systems that may lead to data security breaches involving personally identifiable information; among others. SSNs are a critical piece of information used to perpetrate identity theft. Although the SSN was created as a means to track workers’ earnings and eligibility for Social Security benefits, it is now also a vital piece of information needed to function in American society. Because of its unique nature and broad applicability, the SSN has become the identifier of choice for public and private sector entities, and it is used for numerous non-Social Security purposes. Today, U.S. citizens generally need an SSN to pay taxes, obtain a driver’s license, or open a bank account, among other things. SSNs, along with names and birth certificates, are among the three personal identifiers most often sought by identity thieves. SSNs play an important role in identity theft because they are used as breeder information to create additional false identification documents, such as drivers’ licenses. Most often, identity thieves use SSNs belonging to real people rather than making one up; however, on the basis of a review of identity theft reports, victims usually (65 percent of the time) did not know where or how the thieves got their personal information. In those instances when the source was known, the personal information, including SSNs, usually was obtained illegally. In these cases, identity thieves most often gained access to this personal information by taking advantage of an existing relationship with the victim. The next most common means of gaining access were by stealing information from purses, wallets, or the mail. Finally, while documents such as public records were traditionally accessed by visiting government records centers, a growing source of identity theft may be via the Internet. This is because some record keepers sell records containing SSNs in bulk to private companies and provide access to records on their own government Web sites. When records are sold in bulk or made available on the Internet, it is unknown how and by whom the records, and the personal identifying information contained in them, are used. Because the sources of identity theft cannot be more accurately pinpointed, it is not possible at this time to determine whether SSNs that are used improperly are obtained most frequently from the private or public sector. Our prior work has documented several areas where potential vulnerabilities exist with respect to protecting the security of SSNs in both the public and private sectors. For example: SSNs are displayed on some government-issued identification cards: We have reported that an estimated 42 million Medicare cards, 8 million Department of Defense (DOD) insurance cards, and 7 million Department of Veterans Affairs (VA) beneficiary cards displayed entire 9- digit SSNs. VA and DOD have begun taking action to remove SSNs from cards. For example, VA is eliminating SSNs from 7 million VA identification cards and will replace cards with SSNs or issue new cards without SSNs until all such cards have been replaced. However, the Centers for Medicare and Medicaid Services, with the largest number of cards displaying the entire 9-digit SSN, has no plans to remove the SSN from Medicare identification cards. examining the availability of SSNs in public records, we found that it is possible to reconstruct an individual’s full nine-digit SSN by combining a truncated SSN from a federally generated lien record with a truncated SSN from an information reseller. These records typically contain an individual’s SSN, name, and address. As a result of these findings, we advised Congress to consider enacting legislation to develop a standardized method of truncating SSNs. Such legislation was introduced in the 110th Congress. Federal law does not currently cover all data or services provided by information resellers, and the personally identifiable information these entities use in the course of their business operations could create potential vulnerability for identity theft, particularly when the information is available on the Internet. For example, information resellers, sometimes referred to as information brokers, are businesses that specialize in amassing personal information from multiple sources and offering informational services, including data on individuals. These entities may provide their services to a variety of prospective buyers, either to specific business clients or to the general public through the Internet. More prominent information resellers such as consumer reporting agencies and entities like LexisNexis provide information to their customers for various purposes, such as building consumer credit reports, verifying an individual’s identity, differentiating records, marketing their products, and preventing financial fraud. These information resellers limit their services to businesses and government entities that establish accounts with them and have a legitimate purpose for obtaining an individual’s personal information. For example, law firms and collection agencies may request information on an individual’s bank accounts and real estate holdings for use in civil proceedings, such as a divorce. Information resellers that offer their services through the Internet (Internet resellers) will generally advertise their services to the general public for a fee. Resellers, whether well-known or Internet-based, collect information from three sources: public records, publicly available information, and nonpublic information. The aggregation of the general public’s personal information, such as SSNs, in large corporate databases and the increased availability of information via the Internet may provide unscrupulous individuals a means to acquire SSNs and other personal information and use them for illegal purposes including identity theft. However, no federal law explicitly requires all information resellers to safeguard all of the sensitive personal information they may hold. For example, the Fair Credit and Reporting Act (FCRA) applies only to consumer information used or intended to be used to help determine eligibility for credit, and GLBA’s safeguarding requirements apply only to customer data held by GLBA-defined financial institutions. Unfortunately, much of the personal information maintained by information resellers that does not fall under FCRA or GLBA is not necessarily required by federal law to be safeguarded, even when the information is sensitive and subject to misuse by identity thieves. Virtually all federal operations are supported by automated systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions and account for their resources without these information assets. However, it is important for agencies to safeguard their systems against risks such as loss or theft of resources (such as federal payments and collections), modification or destruction of data, and unauthorized uses of computer resources or to launch attacks on other computer systems. Without such safeguards, sensitive information, such as taxpayer data, Social Security records, medical records, and proprietary business information could be inappropriately disclosed, browsed, or copied for improper or criminal purposes including identity theft. Our work indicates that persistent weaknesses appear in five major categories of information system controls. As a result, federal systems and sensitive information are at increased risk of unauthorized access and disclosure, modification, or destruction, as well as inadvertent or deliberate disruption of system operations and services. GAO has found that federal agencies continue to experience numerous security incidents that could leave sensitive personally identifiable information in federal records vulnerable to identity theft. Such risks are illustrated by the following examples: In February 2009, the Federal Aviation Administration (FAA) notified employees that an agency computer was illegally accessed and employee personal identity information had been stolen electronically. Two of the 48 files on the breached computer server contained personal information about more than 45,000 FAA employees and retirees who were on the FAA’s rolls as of the first week of February 2006. Law enforcement agencies were notified and are investigating the data theft. In June 2008, the Walter Reed Army Medical Center reported that officials were investigating the possible disclosure of personally identifiable information through unauthorized sharing of a data file containing the names of approximately 1,000 Military Health System beneficiaries. Walter Reed officials were notified of the possible exposure on May 21 by an outside company. Preliminary results of an ongoing investigation identified a computer from which the data had apparently been compromised. Data security personnel from Walter Reed and the Department of the Army think it is possible that individuals named in the file could become victims of identity theft. The compromised data file did not include protected health information such as medical records, diagnosis, or prognosis for patients. During fiscal year 2008, federal agencies reported 16, 843 incidents to the U.S. Computer Emergency Readiness Team (US-CERT)—a 206 percent increase over the 5,503 incidents reported in 2006. Thus, significant weaknesses continue to threaten the confidentiality, integrity, and availability of critical information and information systems used to support the operations, assets, and personnel of federal agencies. The extent to which data breaches result in identity theft is not well known, in large part because it can be difficult to determine the source of the information used to commit identity theft. Available data and interviews with researchers, law enforcement officials, and industry representatives indicate that most breaches have not resulted in detected incidents of identity theft. In 2007, we reported on data breaches in selected sectors of the economy and the potential benefits of breach notifications. As part of this review of the issue, we examined the 24 largest breaches that appeared in the news media from January 2000 through June 2005 and found that 3 breaches appeared to have resulted in fraud on existing accounts, and 1 breach appeared to have resulted in the unauthorized creation of new accounts. When data breaches do occur, notification to the individuals affected and/or the public has clear benefits, allowing individuals the opportunity to take steps to protect themselves against the dangers of identity theft. Moreover, although existing laws do not require agencies to notify the public when data breaches occur, such notification is consistent with federal agencies’ responsibility to inform individuals about how their information is being accessed and used, and promotes accountability for privacy protection. Similarly, in the private sector, representatives of federal banking regulators, industry associations, and other affected parties told us that breach notification requirements have encouraged companies and other entities to improve their data security practices to minimize legal liability or avoid public relations risks that may result from a publicized breach of customer data. Further, notifying affected consumers of a breach gives individuals the opportunity to mitigate potential risk—for example, by reviewing their credit card statements and credit reports, or placing a fraud alert on their credit files. Requiring consumer notification of data breaches may encourage better data security practices and help deter or mitigate harm from identity theft; however, such practices also involve monetary costs and other challenges such as determining an appropriate notification standard. Based on the experience of various federal agencies and private sector organizations in responding to data breaches, we identified the following lessons learned regarding how and when to notify government officials, affected individuals, and the public of a data breach. In particular: Rapid internal notification of key government officials is critical. A core group of senior officials should be designated to make decisions regarding an agency’s response. Mechanisms must be in place to obtain contact information for affected individuals. Determining when to offer credit monitoring to affected individuals requires risk-based management decisions. Interaction with the public requires careful coordination and can be resource-intensive. Internal training and awareness are critical to timely breach response, including notification. Contractor responsibilities for data breaches should be clearly defined. OMB issued guidance in 2006 and 2007 reiterating agency responsibilities under the Privacy Act and FISMA, as well as technical guidance, drawing particular attention to the requirements associated with personally identifiable information. In this guidance, OMB directed, among other things, that agencies encrypt data on mobile computers or devices and follow NIST security guidelines regarding personally identifiable information. However, guidance to assist agency officials in making consistent risk- based determinations about when to offer credit monitoring or other protection services has not been developed. Without such guidance, agencies are likely to continue to make inconsistent decisions about what protections to offer affected individuals, potentially leaving some people more vulnerable than others. We and various agency inspectors general have made numerous recommendations to federal agencies to resolve prior significant control deficiencies and information security program shortfalls. In particular, we have noted that agencies also need to implement controls that reduce the chance of incidents involving data loss or theft, computer intrusions, and privacy breaches. For example, we recommended that the Director of OMB develop guidance for federal agencies on conducting risk analyses to determine when to offer credit monitoring and when to contract for an alternative form of monitoring, such as data breach monitoring, to assist individuals at risk of identity theft as a result of a federal data breach. Other recommendations to agencies include that they need to implement controls that prevent, limit, or detect access to computer resources, and should manage the configuration of network devices to prevent unauthorized access and ensure system integrity. In addition, opportunities also exist to enhance policies and practices necessary for implementing sound information security programs. To implement these programs, agencies must create and maintain inventories of major systems, implement common security configurations, ensure staff receive information security training, test and evaluate controls, take remedial actions for known deficiencies, and certify and accredit systems for operation. While these recommendations are intended to broadly strengthen the integrity of federal information systems, they will also help address many of the vulnerabilities that can contribute to identity theft. Efforts at the federal, state, and local level to protect personally identifiable information and help prevent identity theft are positive steps, but challenges remain. In particular, the use of SSNs by both public and private sector entities is likely to continue given that it is the key identifier used by these entities, and there is currently no widely accepted alternative. Personally identifiable information including an individual’s name, date of birth, and SSN are important pieces of information used to perpetrate identify theft and fraud, and it is critical that steps be taken to protect such information. Without proper safeguards in place, such information will remain vulnerable to misuse, thus adding to the growing number of identity theft victims. As Congress moves forward in pursuing legislation to address the problem of identity theft, focusing the debate on vulnerabilities that have already been documented may help target efforts and policy directly toward new solutions. We look forward to supporting congressional consideration of these important policy issues. Mr. Chairman, this concludes my prepared testimony. I would be pleased to respond to any questions you or other Members of the Subcommittee may have. For further information regarding this testimony, please contact me at bertonid@gao.gov or (202) 512-7215. In addition, contact points for our Offices of Congressional Relations and Public Affairs can be found on the last page of this statement. Individuals making key contributions to this testimony include Jeremy Cox, John De Ferrari, Doreen Feldman, Christopher Lyons, Joel Marus, and Rachael Valliere. Information Security: Agencies Make Progress in Implementation of Requirements, but Significant Weaknesses Persist. GAO-09-701T. Washington, D.C.: May 19, 2009. Social Security Numbers Are Widely Available in Bulk and Online Records, but Changes to Enhance Security Are Occurring. GAO-08-1009R. Washington, D.C.: September 19, 2008. Information Security: Federal Agency Efforts to Encrypt Sensitive Information Are Under Way, but Work Remains. GAO-08-525. Washington, D.C.: June 27, 2008. Information Security: Progress Reported, but Weaknesses at Federal Agencies Persist. GAO-08-571T. Washington, D.C.: March 12, 2008. Information Security: Protecting Personally Identifiable Information. GAO-08-343. Washington, D.C.: January 25, 2008. Information Security: Despite Reported Progress, Federal Agencies Need to Address Persistent Weaknesses. GAO-07-837. Washington, D.C.: July 27, 2007. Cybercrime: Public and Private Entities Face Challenges in Addressing Cyber Threats. GAO-07-705. Washington, D.C.: June 22, 2007. Social Security Numbers: Use is Widespread and Protection Could Be Improved. GAO-07-1023T. Washington, D.C.: June 21, 2007. Social Security Numbers: Federal Actions Could Further Decrease Availability in Public Records, though Other Vulnerabilities Remain. GAO-07-752. Washington, D.C.: June 15, 2007. Personal Information: Data Breaches Are Frequent, but Evidence of Resulting Identity Theft Is Limited; However, the Full Extent Is Unknown. GAO-07-737. Washington, D.C.: June 4, 2007. Privacy: Lessons Learned about Data Breach Notification. GAO-07-657. Washington, D.C.: April 30, 2007. Privacy: Domestic and Offshore Outsourcing of Personal Information in Medicare, Medicaid, and TRICARE. GAO-06-676. Washington, D.C.: September 5, 2006 Personal Information: Key Federal Privacy Laws Do Not Require Information Resellers to Safeguard All Sensitive Data. GAO-06-674. Washington, D.C.: June 26, 2006. Privacy: Preventing and Responding to Improper Disclosures of Personal Information. GAO-06-833T. Washington, D.C.: June 8, 2006. Social Security Numbers: Internet Resellers Provide Few Full SSNs, but Congress Should Consider Enacting Standards for Truncating SSNs. GAO-06-495. Washington, D.C.: May 17, 2006. Social Security Numbers: More Could Be Done to Protect SSNs. GAO-06-586T. Washington, D.C.: March 30, 2006. Social Security Numbers: Stronger Protections Needed When Contractors Have Access to SSNs. GAO-06-238. Washington, D.C.: January 23, 2006. Social Security Numbers: Federal and State Laws Restrict Use of SSNs, yet Gaps Remain. GAO-05-1016T. Washington, D.C.: September 15, 2005. Identity Theft: Some Outreach Efforts to Promote Awareness of New Consumer Rights Are Underway. GAO-05-710. Washington, D.C.: June 30, 2005. Information Security: Emerging Cybersecurity Issues Threaten Federal Information Systems. GAO-05-231. Washington, D.C.: May 13, 2005. Social Security Numbers: Governments Could Do More to Reduce Display in Public Records and on Identity Cards. GAO-05-59. Washington, D.C.: November 9, 2004. Social Security Numbers: Private Sector Entities Routinely Obtain and Use SSNs, and Laws Limit the Disclosure of This Information. GAO-04-11. Washington, D.C.: January 22, 2004. Social Security Numbers: Government Benefits from SSN Use but Could Provide Better Safeguards. GAO-02-352. Washington, D.C.: May 31, 2002. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The loss of personally identifiable information, such as an individual's Social Security number, name, and date of birth can result in serious harm, including identity theft. Identity theft is a serious crime that impacts millions of individuals each year. Identity theft occurs when such information is used without authorization to commit fraud or other crimes. While progress has been made protecting personally identifiable information in the public and private sectors, challenges remain. GAO was asked to testify on how the loss of personally identifiable information contributes to identity theft. This testimony summarizes (1) the problem of identity theft; (2) steps taken at the federal, state, and local level to prevent potential identity theft; and (3) vulnerabilities that remain to protecting personally identifiable information, including in federal information systems. For this testimony, GAO relied primarily on information from prior reports and testimonies that address public and private sector use of personally identifiable information, as well as federal, state, and local efforts to protect the security of such information. GAO and agency inspectors general have made numerous recommendations to agencies to resolve prior significant information control deficiencies and information security program shortfalls. The effective implementation of these recommendations will continue to strengthen the security posture at these agencies. Identity theft is a serious problem because, among other things, it can take a long period of time before a victim becomes aware that the crime has taken place and thus can cause substantial harm to the victim's credit rating. Moreover, while some identity theft victims can resolve their problems quickly, others face substantial costs and inconvenience repairing damage to their credit records. Some individuals have lost job opportunities, been refused loans, or even been arrested for crimes they did not commit as a result of identity theft. Millions of people become victims of identity theft each year. The Federal Trade Commission (FTC) estimates that in 1 year, as many as 10 million people--or 4.6 percent of the U.S. adult population--discover that they are victims of some form of identity theft, translating into reported losses exceeding $50 billion. Several steps have been taken, both in terms of legislation and administrative actions to combat identity theft at the federal, state and local levels, although efforts to assist victims of the crime once it has occurred remain somewhat piecemeal. While there is no one law that regulates the overall use of personally identifiable information by all levels and branches of government, numerous federal laws place restrictions on public and private sector entities' use and disclosure of individuals' personal information in specific instances, including the use and disclosure of Social Security Numbers (SSN)--a key piece of information that is highly valuable to identity thieves. One intention of some of these laws is to prevent the misuse of personal information for purposes such as identity theft. Despite efforts to prevent identity theft, vulnerabilities remain and can be grouped into several areas, including display and use of Social Security numbers, availability of personal information through information resellers, security weaknesses in federal agency information systems, and data security breaches. GAO's work indicates that persistent weaknesses appear in five major categories of information system controls, including access controls which ensure that only authorized agency personnel can read, alter, or delete data. As a result, federal systems and sensitive information are at increased risk of unauthorized access and disclosure, modification, or destruction, as well as inadvertent or deliberate disruption of system operations and services. GAO has reported that federal agencies continue to experience numerous security incidents that could leave sensitive personally identifiable information in federal records vulnerable to identity theft.