The Social Security Act of 1935 authorized the Social Security Administration (SSA) to establish a record-keeping system to manage the Social Security program, which resulted in the creation of the SSN. Through a process known as enumeration, unique numbers are created for every person as a work and retirement benefit record. Today, SSA issues SSNs to most U.S. citizens, but they are also available to noncitizens lawfully admitted to the United States with permission to work. Lawfully admitted noncitizens may also qualify for a SSN for nonwork purposes when a federal, state, or local law requires that they have a SSN to obtain a particular welfare benefit or service. SSA staff collect and verify information from such applicants regarding their age, identity, citizenship, and immigration status. Since its creation, the SSN has evolved beyond its original intended purpose. This is significant, because these numbers, along with a name and birth date, are the three pieces of information most often sought by identity thieves. Once a SSN is obtained fraudulently, it can then be used as “breeder” information to create additional false identification documents, such as driver’s licenses. As shown in figure 1, reported cases of identity theft are on the rise. In addition, the reported incidents of identity theft in New York have also risen, in an increase similar to the overall rise reported in the United States. In 1998, Congress made identity theft a federal crime when it enacted the Identity Theft and Assumption Deterrence Act (Identity Theft Act). The act made it a criminal offense for a person to “knowingly transfer, possess, or use without lawful authority,” another person’s means of identification “with the intent to commit, or to aid or abet, or in connection with, any unlawful activity that constitutes a violation of federal law, or that constitutes a felony under any applicable state or local law.” Under the act, a name or SSN is considered a “means of identification,” and a number of cases have been prosecuted under this law. The Identity Theft Act mandated a specific role for FTC in combating identity theft. To fulfill the mandate, FTC is collecting identity theft complaints and assisting victims through a telephone hotline and a dedicated Web site; maintaining and promoting the Identity Theft Data Clearinghouse, a centralized database of victim complaints that serves as an investigative tool for law enforcement; and providing outreach and education to consumers, law enforcement, and industry. According to FTC, it receives roughly 15,000 to 20,000 contacts per week on the hotline, via its Web site, or through the mail from victims and consumers who want to avoid becoming victims. FTC has said that the callers to its hotline receive counseling from trained personnel who provide information on prevention of identity theft and also inform victims of the steps to take to resolve the problems resulting from the misuse of their identities. The increased availability and aggregation of personal information, including SSNs, has exposed SSNs to potential misuse, and in some cases, identity theft. Over the last year, several large companies’ databases containing personal information were compromised, but the extent to which identity theft resulted from these reported security breaches is unknown. However, the identity theft crimes that have occurred illustrate how aggregated personal information can be vulnerable. For example, a help desk employee at a New York-based software company, which provided software to its clients to access consumer credit reports, stole the identities of up to 30,000 individuals by using confidential passwords and subscriber codes of the company’s customers. The former employee reportedly sold these identities for $60 each. Furthermore, given the explosion of Internet use and the ease with which personally identifiable information is accessible, individuals looking to steal someone’s identity are increasingly able to do so. In our work, we identified a case where an individual obtained the names and SSNs of high-ranking U.S. military officers from a public Web site, and used those identities to apply online for credit cards and bank credit. As required by a number of federal laws and regulations, agencies at all levels of government frequently collect and use SSNs to administer their programs, to link data for verifying applicants’ eligibility for services and benefits, and to conduct program evaluations. We have also found that SSNs are widely available in a variety of public records held by states, local jurisdictions, and courts. However, some government agencies are taking steps to limit the use and display of SSNs in hopes of preventing the proliferation of false identities. As required by a number of federal laws and regulations, SSNs are widely used by federal, state, and county government agencies when they provide services and benefits to the public. For example, the Personal Responsibility and Work Opportunity Reconciliation Act of 1996 mandates that, among other things, states have laws in place to require the collection of SSNs on driver’s license applications. Such laws and regulations have contributed to the widespread use of SSNs by government agencies, because these numbers serve as a unique identifier for such government- related activities like paying taxes. Government agencies use SSNs for a variety of reasons. We have found that agencies typically used the SSN to manage their records and to facilitate data sharing to verify an applicant’s eligibility for services and benefits. For example, agency officials at all levels of government we surveyed reported using SSNs for internal administrative purposes, which included activities such as identifying, retrieving, and updating records. In addition, agencies reported sharing SSNs and other personal information to collect debts owed the government and conduct or support research and evaluations as well as using employees’ SSNs for activities such as payroll, wage reporting, and providing employee benefits. Government agencies also use SSNs to ensure program integrity. For example, agencies may use SSNs to match records with state and local correctional facilities to identify individuals for whom the agency should terminate benefit payments. In addition, SSNs are sometimes used for statistics, research, and evaluation. For example, the Bureau of the Census prepares annual population estimates for states and counties using individual income tax return data linked over time by SSNs to determine immigration rates between localities. SSNs also provide government agencies and others with an effective mechanism for linking data on program participation with data from other sources to help evaluate the outcomes or effectiveness of government programs. SSNs are publicly available throughout the United States, primarily at the state and local levels of government. On the basis of a survey of federal, state, and local governments, we reported in 2004 that state agencies in 41 states and the District of Columbia were displaying SSNs in public records; this was also true in 75 percent of U.S. counties. We also found that while the number and type of records in which SSNs were displayed varied greatly across states and counties, SSNs were most often found in court and property records. According to our survey, only four New York state agencies reported collecting SSNs for their operations, and none made them available to the general public. Public records displaying SSNs are stored in multiple formats that vary by different levels of government. State government offices tended to store such records electronically, while most local government records were stored on microfiche or microfilm. However, our survey found that public access to such records was often limited to inspection of the individual paper copy or request by mail. According to our survey, few state agencies make public records available on the Internet, but as many as several hundred counties do so. However, few state or local offices reported any plans to significantly expand Internet access to public records that display SSNs. Judging from our survey results, only four state agencies indicated plans to make such records available on the Internet, and one agency planned to remove records displaying SSNs from Internet access. Our survey results also showed that state offices were taking measures to change the way in which they displayed or shared SSNs in public records. For example, we found that many state agencies had restricted access to or redacted—covered or otherwise hidden from view—SSNs from public versions of records. Specific restrictions and other actions state agencies reported taking included blocking or removing SSNs from electronic versions of records, allowing individuals identified in the record to request removing their SSN from the publicly available version, replacing SSNs with alternative identifiers, and restricting access only to individuals identified in the records. Private sector entities such as information resellers, credit reporting agencies, and health care organizations routinely obtain and use SSNs. Such entities obtain the SSNs from various public sources and their clients wishing to use their services. However, given the varied nature of SSN data found in public records, some reseller officials told us that they are more likely to rely on receiving SSNs from their business clients than they are on obtaining SSNs from public records. Because the SSN is a unique identifier, we found that these entities use SSNs for various purposes, such as building tools to aid in verifying an individual’s identity or matching existing data. Private sector entities such as information resellers, CRAs, and health care organizations generally obtain SSNs from various public and private sources. Large information resellers have told us they obtain SSNs from various public records, such as records of bankruptcies, tax liens, civil judgments, criminal histories, deaths, real estate transactions, voter registrations, and professional licenses. To gather SSNs from these records, resellers told us that they send employees to courthouses or other repositories to obtain hard copies of public records, if not easily obtainable on the Internet or public record publications. They also said that they sometimes obtain batch files of electronic copies of jurisdictional public records where available. However, given the varied nature of SSN data found in public records, some reseller officials said they are more likely to rely on SSNs obtained directly from their clients, who would voluntarily provide such information for a specific service or product, than those found in public records. Like information resellers, CRAs also obtain SSNs from public and private sources.