The Social Security Act of 1935 authorized the Social Security Administration (SSA) to establish a record-keeping system to help manage the Social Security program, and this resulted in the creation of the SSN. Through a process known as enumeration, unique numbers are created for every person as a work and retirement benefit record for the Social Security program. SSA generally issues SSNs to most U.S. citizens, and SSNs are also available to noncitizens lawfully admitted to the United States with permission to work. SSA estimates that approximately 277 million individuals currently have SSNs. Because of the number’s uniqueness and broad applicability, the SSN has become the identifier of choice for government agencies and private businesses, and thus it is used for a myriad of non–Social Security purposes. With the enhancement of computer technologies in recent years, private sector businesses are increasingly computerizing their records; as a result, these enhancements have spawned new business activities involving the aggregation of personal information. Such entities aggregate large numbers of both public and private data, including SSNs, from record- keeping systems throughout the country into centralized databases and use those databases, in many cases, for the purpose of providing consumer services. Businesses and others rely on entities such as information resellers and CRAs to use SSNs to build credit reports, extract or retrieve data from consumers’ credit histories, verify individuals’ identities, market their products, and prevent financial fraud. Information resellers, sometimes referred to as information brokers, are businesses that specialize in amassing consumer information that includes SSNs for informational services. They may provide their services to a variety of customers, either to specific business clients or through the Internet to anyone willing to pay a fee. Large information resellers limit their services to businesses that establish accounts with them. Law firms, private businesses, law enforcement agencies, and others are usually their clients. For example, lawyers, debt collectors, and private investigators may request information on an individual’s bank accounts and real estate holdings for use in civil proceedings such as divorce; automobile insurers may want information on whether insurance applicants have been involved in accidents or have been issued traffic citations; employers may want background checks on new hires; pension plan administrators may want information to locate pension beneficiaries; and individuals may ask for information to help locate birth parents. When requesting information, customers may ask for nationwide database searches or searches of only specific geographical areas. Other information resellers, particularly those that are Internet-based, generally offer their services to the public at large for a fee. CRAs, also known as credit bureaus, are agencies that collect and sell information about the creditworthiness of individuals. CRAs collect information that is considered relevant to a person’s credit history. These agencies then use this information to assign a credit score to an individual, indicating the person’s creditworthiness. Prospective creditors purchase credit reports about specific individuals from CRAs, and then use this information to decide how much credit, if any, to extend to the individual. Organizations that provide health care services also commonly use consumers’ SSNs. These organizations generally deliver their services through a coordinated system that includes health care providers and health plans (insurers). While both providers and insurers are within this coordinated system, they are distinct from each other. For instance, in conducting business, health care providers offer medical or health services to patients and bill either the patient or the health plan for those services. In contrast, health plans offer insurance to individuals or groups of employees, who then make premium payments in exchange for services. Some health care organizations play dual roles of both health care provider and health insurer, which makes the distinction in how they obtain and use SSNs more complex. Because of the myriad of uses of the SSN, Congress has previously asked GAO to review various aspects of SSN use in both the public and the private sectors. In our previous work, our reports have looked at how private businesses and government agencies obtain and use SSNs. In addition, we have reported that the perceived widespread sharing of personal information and instances of identity theft have heightened public concern about the use of Social Security Numbers. We have also noted that the SSN is used, in part, as a verification tool for services such as child support collection, law enforcement enhancement, and issuing credit to individuals. Although these uses of SSNs are beneficial to the public, SSNs are also key elements in creating false identities. We testified before the Subcommittee on Social Security, House Committee on Ways and Means, about SSA’s enumeration and verification processes, and reported that the aggregation of personal information, such as SSNs, in large corporate databases, as well as the public display of SSNs in various public records, may provide criminals the opportunity to commit identity crimes. Information resellers, CRAs, and health care organizations routinely obtain SSNs from their business clients and use SSNs for various purposes, such as to build tools that verify an individual’s identity or match existing records. In addition to acquiring SSNs from various public sources, officials from these firms said they often obtain SSNs from their business clients wishing to use their services. For example, health care organizations obtain SSNs from the subscriber or policyholder of the employer group during the enrollment process. Given the various types of services these companies offer, we found that all of them have come to rely on the SSN as an identifier, which helps them determine a person’s identity for the purpose of providing the services they offer. These officials said that because the SSN is a unique number, it is the most reliable factor in determining an individual’s identity. However, most of the large information resellers said that the SSN is not needed to develop many of their products, such as products that launch e-mail marketing or telemarketing programs, but when the SSN is used, it provides increased accuracy and completeness in terms of trying to determine an individual’s identity. Information resellers generally obtain SSNs from their business clients, who often provide SSNs to obtain a reseller’s services or products. However, most of the large information reseller officials we spoke to said that many of the products they offer do not incorporate SSN data. They said they generally amass demographic information about households in order to provide marketing products such as detailed data lists of e-mails and postal addresses, and telephone numbers, or information for retailers and others to use to obtain new customers. As a result, their business concentrates more on marketing such products. However, these officials said that they obtain SSNs from their business clients because they also offer specific services, such as background checks, employee screening, determining criminal histories, or searching for individuals. For example, business customers of some of the information resellers who specialize in employee screening provide them with SSNs in order to have background checks done on potential employees. Large information resellers also said they can obtain SSNs from various public and private sources. For example, they obtain SSN data from public records such as bankruptcies, tax liens, civil judgments, criminal histories, deaths, real estate ownership, driving histories, voter registration, and professional licenses. These officials said, however, that the availability of SSN information in public records varied depending on the state and county. For example, some states and counties included SSNs in their filings of tax liens and court records, but not in other records. Bankruptcy information, which is governed at the federal level, always includes SSNs. All of the resellers that we spoke to said that they obtain SSNs from public records where possible, and to the extent the information is provided on the Internet, they are likely to obtain it from such sources. However, given the varied nature of SSN data found in public records, some reseller officials said they are more likely to rely on receiving SSNs from their business clients than they are from obtaining them from public records. Our investigators also used the Web sites of the Internet-based resellers to try to determine the sources they used to obtain information on SSNs. We reviewed the sources of information the resellers listed on their Web sites. They found that they relied mostly on public information and public record data. For example, they listed various kinds of public record information at the state, county, and national levels, as well as other publicly available information, such as newspapers. As with large information resellers, once they obtained an SSN they relied on information in public records to help verify an individual’s identity and obtain additional information. Some large information resellers may also obtain SSN information from private sources. In many cases such information was obtained through review of data where a customer has voluntarily supplied information resellers with information about himself or herself. In addition, large reseller officials said they also use their clients’ records in instances where the client has provided them with information. For example, officials from one large reseller said they obtained lists of their retail customers’ credit card holders. The list includes the names, addresses, SSNs, and other data of the credit card holders. The reseller then uses the list to match the names of the retail company’s delinquent payment holders with the most recent bankruptcy records. In addition, Federal Trade Commission (FTC) staff said that information resellers also obtain information from CRAs. We found the Internet-based resellers to be more dependent on SSNs than the large information resellers, primarily because their focus is more related to providing investigative or background-type services to anyone willing to pay a fee. We found these entities to be primarily focused on amassing information around an individual’s SSN, which in most cases they obtain from customers trying to use their Web sites. To discover what type of information could be obtained from such sources, our investigators accessed the Web sites of six Internet-based information resellers and paid a fee to gain access to the personal data.