The SSN was created in 1936 as a means of tracking workers’ earnings and eligibility for Social Security benefits. SSNs are issued to most U.S. citizens, and to some noncitizens lawfully admitted to the United States. Through a process known as enumeration, a unique nine-digit number is created. The number is divided into three parts— first three digits represent the geographic area where the SSN was assigned; the middle two are the group number, which is assigned in a specified order for each area number; and the last four are serial numbers ranging from 0001 to 9999. Because of the number’s uniqueness and broad applicability, SSNs have become the identifier of choice for government agencies and private businesses, and are used for a myriad of non–Social Security purposes. Information resellers, sometimes referred to as information brokers, are businesses that specialize in amassing personal information from multiple sources and offering informational services. These entities may provide their services to a variety of prospective buyers, either to specific business clients or to the general public through the Internet. More prominent or large information resellers such as consumer reporting agencies and entities like LexisNexis provide information to their customers for various purposes, such as building consumer credit reports, verifying an individual’s identity, differentiating records, marketing their products, and preventing financial fraud. These large information resellers limit their services to businesses and government entities that establish accounts with them and have a legitimate purpose for obtaining an individual’s personal information. For example, law firms and collection agencies may request information on an individual’s bank accounts and real estate holdings for use in civil proceedings, such as a divorce. Information resellers that offer their services through the Internet (Internet resellers) will generally advertise their services to the general public for a fee. Resellers, whether well-known or Internet-based, collect information from three sources: public records, publicly available information, and nonpublic information. Public records are available to anyone and obtainable from governmental entities. Exactly what constitutes public records depends on state and federal laws, but generally includes birth and death records, property records, tax lien records, voter registrations, and court records (including criminal records, bankruptcy filings, civil case files, and legal judgments). Publicly available information is information not found in public records but nevertheless available to the public through other sources. These sources include telephone directories, business directories, print publications such as classified ads or magazines, and other sources accessible by the general public. Nonpublic information is derived from proprietary or private sources, such as credit header data and application information provided by individuals—for example, information on a credit card application—directly to private businesses. Information resellers provide information to their customers for various purposes, such as building consumer credit reports, verifying an individual’s identity, differentiating records, marketing their products, and preventing financial fraud. The aggregation of the general public’s personal information, such as SSNs, in large corporate databases and the increased availability of information via the Internet may provide unscrupulous individuals a means to acquire SSNs and use them for illegal purposes. Because of the myriad uses of the SSN, Congress has previously asked GAO to review various aspects of SSN-use in both the public and private sectors. In our previous work, our reports have looked at how private businesses and government agencies obtain and use SSNs. In addition, we have reported that the perceived widespread sharing of personal information and instances of identity theft have heightened public concern about the use of Social Security numbers. We have also noted that the SSN is used, in part, as a verification tool for services such as child support collection, law enforcement enhancement, and issuing credit to individuals. Although these uses of SSNs are beneficial to the public, SSNs are also key elements in creating false identities. We testified before the Subcommittee on Social Security, House Committee on Ways and Means, about SSA’s enumeration and verification processes and also reported that the aggregation of personal information, such as SSNs, in large corporate databases, as well as the public display of SSNs in various public records, may provide criminals the opportunity to commit identity crimes. We have also previously reported that certain federal and state laws help information resellers limit the disclosure of personal information including SSNs to their prescreened clients. Specifically, we described how certain federal laws place restrictions on how some Internet resellers’ obtain, use, and disclose consumer information. The limitations these laws afford are shown in table 1. The Web sites of the 154 Internet resellers we reviewed had similar characteristics. Most resellers offered a variety of information that could be purchased, from telephone records to credit reports. In addition, Internet resellers also offered to sell information in various ways, from packaged information, such as various information that would be collected through a background check or a search of a person’s criminal records to single types of information, such as a credit score. These resellers usually listed the types of clients that they market their services to and broadly identified their sources of information. We found that Internet resellers offered to sell a variety of information to anyone willing to pay a fee. On average, resellers offered about 8 types of services and two offered 20 types of informational services. As shown in figure 1, the majority of resellers offered to sell anywhere from 1 to 10 informational services. The Internet resellers offering the fewest services tended to specialize in services provided to the public. For example, most of the resellers offering only one service were resellers that specialized in helping locate an individual. Others offered services related to employment or background checks. Internet resellers also offered different ways for buyers to purchase their information. For example, some offered memberships that allowed online access to the reseller’s information, with the member performing the search. Another reseller offered to sell a software package that would allow a buyer to purchase access to the Internet reseller’s information through the purchased software and allowed many different types of information searches. The majority of resellers would require selected information about the buyer and then would perform the data search and provide an information report to the buyer. We identified over 50 types of information offered for purchase by these resellers, which we categorized into six major categories including personal, legal, financial, employment, driver or vehicle, and telephone. Table 2 gives examples of the types of information found in these categories. All the resellers offered to sell information from at least one of the six categories. However, not all resellers offered to sell driver or vehicle information, or telephone information. For example, only 85 of the 154 resellers we reviewed offered to sell some type of driver’s information, while 56 resellers offered to sell telephone information. We found that Internet resellers either sold their information as a part of a package or sold single pieces of information. For example, resellers sold packaged information such as background checks, criminal checks, or employment checks/tenant screenings. Of the packaged information, we found that background checks provided the most extensive information. A background check may include personal, legal, and financial information, such as name, SSN, address, neighbors, relatives, and associates information. Such checks may include national, state, or county criminal records searches and bankruptcy and lien information. Other packages, such as criminal records packages, may include national, state, and county criminal records searches, sex offender searches, and civil litigation. Employment checks/tenant screenings may include current and past employment, SSN verifications, and national, state, and county criminal records searches. Over 80 percent of Internet resellers identified the clients to whom they marketed their information. Internet resellers identified their clients in several ways. About 60 percent of the time, resellers used the information sections of their Web sites to identify their clients. Web pages such as “Frequently Asked Questions,” “Help,” or “About Us” were frequently used to identify their clients. For example, the “About Us” Web page generally provided a brief description about the Internet reseller’s business and would often describe the clients it marketed to. Other ways in which resellers marketed to their clients were through testimonials or in a separate section on their Web page. Internet resellers marketed their services to a variety of clients. As shown in table 3, individuals, businesses, and attorneys were the most frequently identified clients. Some of the businesses resellers identified were Fortune 500 companies and retailers. For the financial institution clients, resellers mostly identified banks. In addition, most of the Internet resellers’ clients were from the private sector, although some had government and law enforcement agency clients. Finally, we found that most of the resellers had multiple types of clients. About 30 percent of the resellers identified only one type of client. About 75 percent, or 115, Internet resellers identified the source of their information on their Web sites. Most of these resellers obtained their information from public or nonpublic sources or a combination of both sources. For example, a few resellers offered to conduct a background investigation on an individual, which included compiling information on the individual from court records and using a credit bureau to obtain consumer credit data. Some used only public records as their only source of information. The most frequently identified public records were court records, department of motor vehicle records, real property records, legal judgments, and bankruptcy records. We found about one-third of the Internet resellers used only one source of information. More often, they used a combination of the three sources. Figure 2 below shows the various combinations of sources of information. Most of our attempts to purchase SSNs from a select group of resellers failed. Of the 154 Internet resellers’ Web sites we reviewed, 53, almost 35 percent, offered to sell SSNs. We attempted to purchase SSNs from 21 resellers that were chosen because they required minimal information about prospective buyers or about the person whose SSN we wanted to obtain.