In 1936, following the enactment of the Social Security Act of 1935, the newly-formed Social Security Board (which later became SSA) created the 9-digit SSN to uniquely identify and determine Social Security benefit entitlement levels for U.S. workers. Originally, the SSN was not intended to serve as a personal identifier but, due to its universality and uniqueness, government agencies and private sector entities now use it as a convenient means of identifying people. The number uniquely links identities across a very broad array of public and private sector information systems. As of September 2016, SSA had issued approximately 496 million unique SSNs to eligible individuals. In 2006, the President issued an Executive Order establishing the Identity Theft Task Force to strengthen efforts to protect against identity theft. Because the unauthorized use of SSNs was recognized as a key element of identity theft, the task force assessed the actions the government could take to reduce the exposure of SSNs to potential compromise. In April 2007, the task force issued a strategic plan, which advocated a unified federal approach, or standard, for using and displaying SSNs. The plan proposed that OPM, OMB, and SSA play key roles in restricting the unnecessary use of the numbers, offering guidance on substitutes that are less valuable to identity thieves, and promoting consistency when the use of SSNs was found to be necessary or unavoidable. In response to the recommendations of the Identity Theft Task Force, OPM, OMB, and SSA undertook several actions aimed at reducing or eliminating the unnecessary collection, use, and display of SSNs. However, in our draft report, we determined that these actions have had limited success. OPM took several actions in response to the task force recommendations. Using an inventory of its forms, procedures, and systems displaying SSNs that it had developed in 2006, the agency took action to change, eliminate, or mask the use of SSNs on OPM approved/authorized forms, which are used by agencies across the government for personnel records. In addition, in 2007, OPM issued guidance to other federal agencies on actions they should take to protect federal employee SSNs and combat identity theft. The guidance reminded agencies of existing federal regulations that restricted the collection and use of SSNs and also specified additional measures. In addition to issuing this guidance, in January 2008, OPM proposed a new regulation regarding the collection, use, and display of SSNs that would have codified the practices outlined in its 2007 guidance and that also required the use of an alternate identifier. However, in January 2010, after reviewing comments it had received, OPM withdrew the notice of proposed rulemaking because the agency determined that it would be impractical to issue the rule without an alternate governmentwide employee identifier in place. In 2015, OPM briefly began exploring the concept of developing and using multiple alternate identifiers for different programs and agencies. As envisioned, an SSN would be collected only once, at the start of an employee’s service, after which unique identifiers specific to relevant programs, such as healthcare benefits or training, would be assigned as needed. However, officials from OPM’s Office of the Chief Information Officer stated that work on the initiative was suspended in 2016 due to a lack of funding. In May 2007, OMB issued a memorandum officially requiring agencies to review their use of SSNs in agency systems and programs to identify instances in which the collection or use of the number was superfluous. Agencies were also required to establish a plan, within 120 days from the date of the memorandum, to eliminate the unnecessary collection and use of SSNs within 18 months. Lastly, the memorandum required agencies to participate in governmentwide efforts, such as surveys and data calls, to explore alternatives to SSN use as a personal identifier for both federal employees and in federal programs. Since issuing its May 2007 memorandum requiring the development of SSN reduction plans, OMB has instructed agencies to submit updates to their plans and documentation of their progress in eliminating unnecessary uses of SSNs as part of their annual reports originally required by the Federal Information Security Management Act of 2002 and now required by the Federal Information Security Modernization Act of 2014 (FISMA). The Identity Theft Task Force recommended that, based on the results of OMB’s review of agency practices on the use of SSNs, SSA should establish a clearinghouse of agency practices and initiatives that had minimized the use and display of SSNs. The purpose of the clearinghouse was to facilitate the sharing of “best” practices—including the development of any alternative strategies for identity management— to avoid duplication of effort, and to promote interagency collaboration in the development of more effective measures for minimizing the use and display of SSNs. In 2007, SSA established a clearinghouse on an electronic bulletin board website to showcase best practices and provided agency contacts for specific programs and initiatives. However, according to officials in SSA’s Office of the Deputy Commissioner, the clearinghouse is no longer active. The officials added that SSA did not maintain any record of the extent to which the clearinghouse was accessed or used by other agencies when it was available online. Further, the officials said SSA has no records of when or why the site was discontinued. Based on their responses to our questionnaire on SSN reduction efforts in our draft report, all of the 24 CFO Act agencies reported taking a variety of steps to reduce such collection, display, and use. However, officials involved in the reduction efforts at these agencies stated that SSNs cannot be completely eliminated from federal IT systems and records. In some cases, no other identifier offers the same degree of universal awareness or applicability. Even when reductions are possible, challenges in implementing them can be significant. In our draft report, three key challenges were frequently cited by these officials: Statutes and regulations require collection and use of SSNs. In their questionnaire responses and follow-up correspondence with us, officials from 15 agencies who were involved in their agencies’ SSN reduction efforts noted that they are limited in their ability to reduce the collection of SSNs because many laws authorize or require such collection. These laws often explicitly require agencies to use SSNs to identify individuals who are engaged in transactions with the government or who are receiving benefits disbursed by federal agencies. Interactions with other federal and external entities require use of the SSN. In their questionnaire responses and follow-up correspondence with us, officials from 16 agencies noted that the necessity to communicate with other agencies and external entities limited their reduction efforts. Federal agencies must be able to cite a unique, common identifier to ensure that they are matching their information to the correct records in the other entities’ systems in order to exchange information about individuals with other entities, both within and outside the federal government. The SSN is typically the only identifier that government agencies and external partners have in common that they can use to match their records. Technological hurdles can slow replacement of SSNs in information systems. In their questionnaire responses and follow-up correspondence with us, officials from 14 agencies who were involved in their agency SSN reduction efforts cited the complexity of making required technological changes to their information systems as a challenge to reducing the use, collection and display of SSNs. Our preliminary results indicate that SSN reduction efforts in the federal government also have been limited by more readily addressable shortcomings. Lacking direction from OMB, many agencies’ reduction plans did not include key elements, such as time frames and performance indicators, calling into question the plans’ utility. In addition, OMB has not required agencies to maintain up-to-date inventories of SSN collections and has not established criteria for determining when SSN use or display is “unnecessary,” leading to inconsistent definitions across the agencies. Finally, OMB has not ensured that all agencies have submitted up-to-date status reports on their SSN reduction efforts and has not established performance measures to monitor progress on those efforts. Agency SSN Reduction Plans Lacked Key Elements, Limiting Their Usefulness As previously mentioned, in May 2007, OMB issued a memorandum requiring agencies to develop plans to eliminate the unnecessary collection and use of SSNs, an objective that was to be accomplished within 18 months. OMB did not set requirements for agencies on creating effective plans to eliminate the unnecessary collection and use of SSNs. However, other federal laws and guidance have established key elements that performance plans generally should contain, including: Performance goals and indicators: Plans should include tangible and measurable goals against which actual achievement can be compared. Performance indicators should be defined to measure outcomes achieved versus goals. Measurable activities: Plans should define discrete events, major deliverables, or phases of work that are to be completed toward the plan’s goals. Timelines for completion: Plans should include a timeline for each goal to be completed that can be used to gauge program performance. Roles and responsibilities: Plans should include a description of the roles and responsibilities of agency officials responsible for the achievement of each performance goal. Our preliminary results show that the majority of plans that the 24 CFO Act agencies originally submitted to OMB in response to its guidance lacked key elements of effective performance plans. For example, only two agencies (the Departments of Commerce and Education) developed plans that addressed all four key elements. Four agencies’ plans did not fully address any of the key elements, 9 plans addressed one or two of the elements, and the remaining 9 plans addressed three of the elements. Agency officials stated that, because OMB did not set a specific requirement that SSN reduction plans contain clearly defined performance goals and indicators, measurable activities, timelines for completion, or roles and responsibilities, the officials were not aware that they should address these elements. Yet, without complete performance plans containing clearly defined performance goals and indicators, measurable activities, timelines for completion, and roles and responsibilities, it is difficult to determine what overall progress agencies have achieved in reducing the unnecessary collection and use of SSNs and the concomitant risk of exposure to identity theft. Continued progress toward reducing that risk is likely to remain difficult to measure until agencies develop and implement effective plans.