The growth in information technology, networking, and electronic storage has made it ever easier to collect and maintain information about individuals. An accompanying growth in incidents of loss and unauthorized use of such information has led to increased concerns about protecting this information on federal systems as well as from private- sector sources, such as data resellers that specialize in amassing personal information from multiple sources. As a result, additional laws protecting personally identifiable information collected and maintained by both government and private-sector entities have been enacted since the Privacy Act of 1974, including measures that are particularly concerned with the protection of personal data maintained in automated information systems. Protecting personally identifiable information in federal systems, such as names, date of birth and SSNs, is critical because its loss or unauthorized disclosure can lead to serious consequences for individuals. These consequences include identity theft or other fraudulent activity, which can result in substantial harm, embarrassment, and inconvenience. Identity theft is a serious problem because, among other things, it may take a long period of time before a victim becomes aware that the crime has taken place, and thus can cause substantial harm to the victim’s credit rating. Moreover, while some identity theft victims can resolve their problems quickly, others face substantial costs and inconvenience repairing damage to their credit records. Some individuals have lost job opportunities, been refused loans, or even been arrested for crimes they did not commit as a result of identity theft. Millions of people become victims of identity theft each year. The Federal Trade Commission (FTC) estimates that in 1 year, as many as 10 million people—or 4.6 percent of the U.S. adult population—discover that they are victims of some form of identity theft, translating into reported losses exceeding $50 billion. In 2007, the FTC estimated that the median value of goods and services obtained by identity thieves was $500, with 10 percent of victims reporting the thief obtained $6,000 or more. Similarly, a more recent 2008 industry survey estimated that, 9.9 million adults in the United States were victims of identity fraud. While available data suggest that identity theft remains a persistent and serious problem, the FTC found that most victims of identity theft do not report the crime. Therefore, the total of number of identity thefts is unknown. Several examples we previously identified illustrate the magnitude of the losses that could occur from a single incident and how aggregated personal information can be vulnerable to misuse: A help desk employee at a New York-based software company, which provided software to its clients to access consumer credit reports, stole the identities of up to 30,000 individuals by using confidential passwords and subscriber codes of the company’s customers. The former employee reportedly sold these identities for $60 each. Furthermore, given the explosion of Internet use and the ease with which personally identifiable information is accessible, individuals looking to steal someone’s identity are increasingly able to do so. In our work, we identified a case where an individual obtained the names and SSNs of high-ranking U.S. military officers from a public Web site and used those identities to apply online for credit cards and bank credit. In 2006, an Ohio woman pled guilty to conspiracy, bank fraud, and aggravated identity theft as the leader of a group that stole citizens’ personal identifying information from a local public record keeper’s Web site and other sources, resulting in over $450,000 in losses to individuals, financial institutions, and other businesses. In February 2007, an individual was convicted of aggravated identity theft, access device fraud, and conspiracy to commit bank fraud in the Eastern District of Virginia. The individual, who went by the Internet nickname “John Dillinger,” was involved in extensive illegal online “carding” activities, in which he received e-mails or instant messages containing hundreds of stolen credit card numbers, usually obtained through phishing schemes or network intrusions, from “vendors” who were located in Russia and Romania. In his role as a “cashier” of these stolen credit card numbers, this individual would then electronically encode these numbers to plastic bank cards, make ATM withdrawals, and return a portion to the vendors. Computers seized by authorities revealed over 4,300 compromised account numbers and full identity information (i.e., name, address, date of birth, Social Security number, and mother’s maiden name) for over 1,600 individual victims. Several steps have been taken, both in terms of legislation and administrative actions to combat identity theft at the federal, state and local levels, although efforts to assist victims of the crime once it has occurred remain somewhat piecemeal. While there is no one law that regulates the overall use of personally identifiable information by all levels and branches of government, numerous federal laws place restrictions on public and private sector entities’ use and disclosure of individuals’ personal information in specific instances, including the use and disclosure of SSNs—a key piece of information that is highly valuable to identity thieves. One intention of some of these laws is to prevent the misuse of personal information for purposes such as identity theft. Two primary laws (the Privacy Act of 1974 and the E-Government Act of 2002) give federal agencies responsibilities for protecting personal information, including ensuring its security. Additionally, the Federal Information Security Management Act of 2002 (FISMA) requires agencies to develop, document, and implement agency wide programs to provide security for their information and information systems (which include personally identifiable information and the systems on which it resides). FISMA is the primary law governing information security in the federal government. The act also requires the National Institute of Standards and Technology (NIST) to develop technical guidance in specific areas, including minimum information security requirements for information and information systems. Other laws which help protect personally identifiable information include the Identity Theft and Assumption Deterrence Act, the Identity Theft Penalty Enhancement Act of 1998, the Gramm-Leach-Bliley Act (GLBA), and the Fair and Accurate Credit Transactions Act (FACTA). (See app. I, table 1, for a more detailed description of these and other related laws.) For example, the Identity Theft and Assumption Deterrence Act, enacted in 1998, makes it a criminal offense for a person to “knowingly transfer, possess, or use without lawful authority,” another person’s means of identification, such as their SSN, with the intent to commit, or in connection with, any unlawful activity that constitutes a felony under state or local law. This act also mandated a specific role for the FTC in combating identity theft. To fulfill the mandate, FTC is collecting identity theft complaints and assisting victims through a telephone hotline and a dedicated Web site; maintaining and promoting the Identity Theft Data Clearinghouse, a centralized database of victim complaints that serves as an investigative tool for law enforcement; and providing outreach and education to consumers, law enforcement, and industry. According to FTC, it receives roughly 15,000 to 20,000 contacts per week on the hotline, via its Web site, or through the mail from victims and consumers who want to avoid becoming victims. In addition, the Identity Theft Enforcement and Restitution Act of 2008 requires persons convicted of identity theft to compensate their victims for the value of the time spent by the victim in an attempt to remediate the intended or actual harm incurred. Another law with some provisions to assist victims of identity theft is FACTA. This law has several provisions to help address the difficulties victims often encounter in trying to recover from identity theft, including (1) a requirement that the FTC develop a model summary of rights to be distributed to consumers who believe that they are victims of identity theft, (2) the right for consumers to place fraud alerts on their credit reports, (3) the right to obtain copies of business records involved in transactions alleged to be the result of identity theft, and (4) the right to obtain all information about fraudulently incurred debts that have been turned over to a collection agency. The Office of Management and Budget has also issued numerous memoranda to federal agencies on safeguarding personally identifiable information. These cover such matters as designating a senior privacy official with responsibility for safeguarding information, and developing and implementing a data breach notification plan. (See app. I, table 2, for a more comprehensive list of pertinent OMB memoranda). Numerous federal agencies can have a role in identifying and investigating identity theft. This is, in part, because identity theft is not a “stand alone” crime, but rather a component of one or more complex crimes, such as computer fraud, credit card fraud, or mail fraud. For example, with the theft of identity information, a perpetrator may commit computer fraud when using a stolen identity to fraudulently obtain credit on the Internet. Computer fraud may also be the primary vehicle used to obtain identity information when the offender obtains unauthorized access to another computer or Web site to obtain such information. As a result, if caught, the offender may be charged with both identity theft and computer fraud. Moreover, perpetrators usually prey on multiple victims in multiple jurisdictions. Consequently, a number of federal law enforcement agencies can have a role in investigating identity theft crimes. How the thief obtains and/or uses an individual’s identity usually dictates which federal agency has jurisdiction in the case. For example, if an individual finds that an identity thief has stolen the individual’s mail to obtain credit cards, bank statements, or tax information, the victim should report the crime to the U.S. Postal Inspection Service, the law enforcement arm of the U.S. Postal Service. In addition, violations are investigated by other federal agencies, such as the Social Security Administration Office of the Inspector General, the U.S. Secret Service, the Federal Bureau of Investigation (FBI), the U.S. Department of State, the U.S. Department of Education Office of Inspector General, and the Internal Revenue Service. The Department of Justice may also prosecute federal identity theft cases. (See app.