In 1995, the latest year for which complete data were available, about 65 percent (or about 647,000) of the inmates in custody in federal and state places of confinement participated in 1 or more types of work programs.These work programs included prison industries (e.g., involving the manufacture of license plates, wood products, and textiles); facility support services (e.g., doing office and administrative work, food service, laundry, and building maintenance); farming/agriculture; and public works assignments (i.e., inmates working outside the facility on road, park, or other public maintenance work). Data entry was the type of work that most often allowed inmates access to personal information. One mission of the Federal Prison Industries (FPI), a BOP component, is to employ and provide skills training to the greatest practicable number of inmates and to produce market priced quality goods in a self-sustaining manner that minimizes potential impact on private business and labor. FPI markets about 150 types of products and services to federal agencies. Some states had similar programs and provisions. For example, Alabama generally requires state departments, institutions, and political subdivisions to purchase their products and services from Alabama Correctional Industries, to the extent to which they can be supplied. In addition, only those entities can purchase Correctional Industries products. According to the Alabama Correctional Industries purpose statement, it exists primarily for the purpose of providing a work-training program for inmates of the Department of Corrections. Another important purpose is to assist all state departments, institutions, and political sub- divisions of the State to secure their requirements to the greatest possible extent. To obtain information on the assignment objectives, we surveyed BOP and state correctional industry officials by mail. We asked the officials to answer questions on correctional industry work programs in federal, state, and privately run facilities for which the federal or state government or state-appointed organizations had oversight. We limited the questionnaire to work programs associated with secure, confined facilities, including youth authorities but excluding programs associated with prerelease facilities and city and county jails. We asked if on September 30, 1998, they had inmates who, through performing (1) work on correctional industry work program contracts that were either in progress or were agreed to but the work had not been started or (2) support work for the industry work program operations, had access to personal information or only names and addresses or telephone numbers; what prison procedures, statutes, regulations, pending legislation, or other guidelines provided guidance on (1) limiting which inmates perform work involving access to personal information and (2) preventing personal information from being retained by inmates or being transferred to unauthorized inmates or other persons; what the total gross income was for the correctional industry work program and the income generated by those contracts that resulted in inmates having access to personal information in the most recently completed fiscal year; and what incidents of misuse occurred as a result of inmates having access to the information through correctional industry work programs. We received responses from BOP, 47 states, and the District of Columbia. We did not independently verify the information provided by questionnaire respondents. We did, however, compare the questionnaire responses to the results of our current literature and legal database searches. After we consolidated the data received from the questionnaire respondents in the tables included in this report, we faxed the compiled information to all of the questionnaire respondents for confirmation of the accuracy of the data displayed and made corrections as necessary. We interviewed BOP and state officials. We also contacted states’ attorneys general to obtain information on (1) incidents of misuse of which they were aware and (2) state statutes or regulations, pending legislation, or other guidelines that provided guidance on work programs involving personal information. We requested comments on a draft of this report from BOP and the Correctional Industries Association, Inc. They provided written comments that are summarized at the end of this report and are reprinted in appendixes X and XI. We performed our work from June 1998 to June 1999 in accordance with generally accepted government auditing standards. Appendix I provides more details on our objectives, scope, and methodology. On September 30, 1998, about 1,400 inmates in BOP and 19 state prison systems had access to personal information through correctional industry work programs, according to the questionnaire respondents. This number accounts for (1) about one-tenth of 1 percent of all inmates in custody as of June 30, 1998, (or approximately 1.2 million) and (2) about 2 percent of all inmates participating in correctional industry work programs (approximately 61,500). Almost all of the inmates who had access to personal information were being held in federal or state-run facilities (1,332 inmates) as opposed to privately run facilities (25 inmates). The number of inmates with access to personal information in each of the 19 states ranged from 6 in New Jersey to 426 in California. The types of information to which the largest number of inmates had access were (1) names and dates of birth or (2) Social Security numbers. About 30 percent of the inmates had access to names and (1) drivers’ license numbers or (2) vehicle makes and models. Appendix II shows the number of inmates in BOP and individual state prison systems that had access to personal information on September 30, 1998, and the types of information to which they had access. Most of the inmates who had access to personal information were performing work for federal, state, or local governments (93 percent) as opposed to private sector companies (7 percent). Over half of the inmates with access to personal information were involved in data entry work. Another about 25 percent of the inmates were duplicating or scanning documents. Types of information processed in these work programs included medical records; state, county, or local licenses; automobile registrations; unemployment records; student enrollment data; and accident reports. The length of time the contracts that resulted in inmates having access to personal information had been in effect ranged from less than 1 year to 19 years. About 1 quarter of the contracts had been in place from 10 to 19 years; the remainder were more recent. The reasons BOP and states most commonly identified for selecting the contracts that resulted in inmates having access to personal information were the contracts provided valuable job skills training, satisfied a need or demand for a service, were needed to provide work for more inmates, were profitable, and provided work that was relatively easy for training inmates. Questionnaire respondents from 11 states said they planned to add and/or expand existing correctional industry work programs that allow inmates access to personal information. Respondents from 29 states said they did not plan to add or expand existing work programs that would allow inmates access to personal information, and respondents from 8 states said they did not know whether their states had plans to add and/or expand existing correctional industry work programs that would allow inmates access to personal information. In response to our survey, 29 states indicated that inmates did not have access to personal information on September 30, 1998. The more commonly stated reasons were that the opportunity had not presented itself, the prisons prohibited such work programs, and public opinion limited the feasibility of implementing such work programs. BOP and each state that had work programs in which inmates had access to personal information reported that they had in place a variety of safeguards to prevent inmates from misusing personal information. In addition, BOP and most of the states in which inmates had access to personal information reported that they had prison procedures that limited which inmates could perform work that would give them access to personal information. The federal government and seven states in which inmates had access to personal information were identified as having either enacted statutes or had bills pending that related to limiting which inmates could perform work involving personal information. The safeguards most frequently reported as being used when inmates had access to personal information were close supervision; selective hiring (e.g., excluding inmates convicted of sex offenses or fraud); confidentiality agreements; and security checks at the work area exits. Other commonly used safeguards included security checks at the work area entrances, no photocopy machines in the work area, and monitored telephone calls. Appendix III provides additional information on the safeguards cited by questionnaire respondents. BOP and most of the 19 states in which inmates had access to personal information reported that they had prison procedures that placed limitations on which inmates could perform work that would give them access to personal information. Questionnaire respondents from BOP and 18 states said that they screened inmates before hiring them for work programs involving personal information. For example, one state respondent said that inmates who were convicted of rape or who have life sentences were ineligible to work on contracts where they would have access to personal information. In addition, in the course of our work, statutes or proposed legislation related to this issue were identified in seven of the states as well as the federal government in which inmates had access to personal information. A brief summary of these provisions is provided in appendix IV, table IV.1. Further, six states were identified in which inmates did not have access to personal information that had enacted statutes or introduced legislation that related to this issue. For more information on these statutes and pending bills, see appendix IV, table IV.2. Less than one-hundredth of 1 percent of the BOP’s annual gross correctional industry income of $568 million was generated from its contract that allowed inmates access to personal information. For those states in which inmates had access to personal information, no more than 22 percent of any state’s gross fiscal year 1998 correctional industry income was generated from these contracts; six states reported that less than 1 percent of their gross correctional industry income was earned from these contracts. In total, these states grossed about $18 million in 1998 from correctional industry work program contracts that allowed inmates access to personal information, compared to an annual gross correctional industry income of about $515 million. Appendix V provides information on the income generated from these contracts. About 5,500 inmates, in BOP and 31 state prison systems, had access to only names and addresses or telephone numbers through correctional industry work programs.