The use of SSNs by government and the private sector has grown over time, in part because of federal requirements. In addition, the growth in computerized records has further increased reliance on SSNs. This growth in use and availability of the SSN is important because SSNs are often one of the “identifiers” of choice among identity thieves. Although no single federal law regulates the use and disclosure of SSNs by governments, when federal government agencies use them, several federal laws limit the use and disclosure of the number. Also, state laws may impose restrictions on SSN use and disclosure, and they vary from state to state. Moreover, some records that contain SSNs are considered part of the public record and, as such, are routinely made available to the public for review. Since the creation of the SSN, the number of federal agencies and others that rely on it has grown beyond the original intended purpose. In 1936, the Social Security Administration (SSA) created a numbering system designed to provide a unique identifier, the SSN, to each individual. The agency uses SSNs to track workers’ earnings and eligibility for Social Security benefits, and as of December 1998, SSA had issued 391 million SSNs. Since the creation of the SSN, other entities in both the public and private sectors have begun using SSNs, in part because of federal requirements. The number of federal agencies and others relying on the SSN as a primary identifier escalated dramatically, in part, because a number of federal laws were passed that authorized or required its use for specific activities. (See appendix I for examples of federal laws that authorize or mandate the collection and use of SSNs.) In addition, private businesses, such as financial institutions and health care service providers, also rely on individuals SSNs. In some cases, they require the SSN to comply with federal laws but, at other times, they routinely choose to use the SSNs to conduct business. In addition, the advent of computerized records further increased reliance on SSNs. Government entities are beginning to make their records electronically available over the Internet. Moreover, the Government Paperwork Elimination Act of 1998 requires that, where practicable, federal agencies provide by 2003 for the option of the electronic maintenance, submission, or disclosure of information. State government agencies have also initiated Web sites to address electronic government initiatives. Moreover, continuing advances in computer technology and the ready availability of computerized data have spurred the growth of new business activities that involve the compilation of vast amounts of personal information about members of the public, including SSNs, that businesses sell. The overall growth in the use of SSNs is important to individual SSN holders because these numbers, along with names and birth certificates, are among the three personal identifiers most often sought by identity thieves. Identity theft is a crime that can affect all Americans. It occurs when an individual steals another individual’s personal identifying information and uses it fraudulently. For example, SSNs and other personal information are used to fraudulently obtain credit cards, open utility accounts, access existing financial accounts, commit bank fraud, file false tax returns, and falsely obtain employment and government benefits. SSNs play an important role in identity theft because they are used as breeder information to create additional false identification documents, such as drivers licenses. Recent statistics collected by federal and consumer reporting agencies indicate that the incidence of identity theft appears to be growing. The Federal Trade Commission (FTC), the agency responsible for tracking identity theft, reports that complaint calls from possible victims of identity theft grew from about 445 calls per week in November 1999, when it began collecting this information, to about 3,000 calls per week by December 2001. However, FTC noted that this increase in calls might also, in part, reflect enhanced consumer awareness. In addition, SSA’s Office of the Inspector General, which operates a fraud hotline, reports that allegations of SSN misuse increased from about 11,000 in fiscal year 1998 to more than 65,200 in fiscal year 2001. However, some of the reported increase may be a result of a growth in the number of staff SSA assigned to field calls to the Fraud Hotline during this period. SSA staff increased from 11 to over 50 during this period, which allowed personnel to answer more calls. Also, officials from two of the three national consumer reporting agencies report an increase in the number of 7 year fraud alerts placed on consumer credit files, which they consider to be reliable indicators of the incidence of identity theft. Finally, it is difficult to determine how many individuals are prosecuted for identity theft because law enforcement entities report that identity theft is almost always a component of other crimes, such as bank fraud or credit card fraud, and may be prosecuted under the statutes covering those crimes. Most often, identity thieves use SSNs belonging to real people rather than making one up; however, on the basis of a review of identify theft reports, victims usually (75 percent of the time) did not know where or how the thieves got their personal information. In the 25 percent of the time when the source was known, the personal information, including SSNs, usually was obtained illegally. In these cases, identity thieves most often gained access to this personal information by taking advantage of an existing relationship with the victim. The next most common means of gaining access were by stealing information from purses, wallets, or the mail. In addition, individuals can also obtain SSNs from their workplace and use them themselves or sell them to others. Finally, SSNs and other identifying information can be obtained legally through Internet sites maintained by both the public and private sectors and from records routinely made available to the public by government entities and courts. Because the sources of identity theft cannot be more accurately pinpointed, it is not possible at this time to determine the extent to which the government’s use of SSNs contributes to this problem as compared to use of SSNs by the private sector. No single federal law regulates the overall use or restricts the disclosure of SSNs by governments; however, a number of laws limit SSN use in specific circumstances. Generally, the federal government’s overall use and disclosure of SSNs are restricted under the Freedom of Information Act and the Privacy Act. The Freedom of Information Act presumes federal government records are available upon formal request, but exempts certain personal information, such as SSNs. The purpose of the Privacy Act, broadly speaking, is to balance the government’s need to maintain information about individuals with the rights of individuals to be protected against unwarranted invasions of their privacy by federal agencies. Also, the Social Security Act Amendments of 1990 provide some limits on disclosure, and these limits apply to state and local governments as well. In addition, a number of federal statutes impose certain restrictions on SSN use and disclosure for specific programs or activities. At the state and county level, each state may have its own statutes addressing the public’s access to government records and privacy matters; therefore, states may vary in terms of the restrictions they impose on SSN use and disclosure. In addition, a number of laws provide protection for sensitive information, such as SSNs, when maintained in computer systems and other government records. Most recently, the Government Information Security Reform provisions of the Fiscal Year 2001 Defense Authorization Act require that federal agencies take specific measures to safeguard computer systems that may contain SSNs. For example, federal agencies must develop an agency-wide information security management program. These laws do not apply to state and local governments; however, in some cases state and local governments have developed their own statutes or put requirements in place to similarly safeguard sensitive information, including SSNs, kept in their computer systems. In addition to the SSNs used by program agencies to provide benefits or services, some records that contain SSNs are considered part of the public record and, as such, are routinely made available to the public for review. This is particularly true at the state and county level. Generally, state law governs whether and under what circumstances these records are made available to the public, and they vary from state to state. They may be made available for a number of reasons. These include the presumption that citizens need government information to assist in oversight and ensure that government is accountable to the people. Certain records maintained by federal, state, and county courts are also routinely made available to the public. In principle, these records are open to aid in preserving the integrity of the judicial process and to enhance the public trust and confidence in the judicial process. At the federal level, access to court documents generally has its grounding in common law and constitutional principles. In some cases, public access is also required by statute, as is the case for papers filed in a bankruptcy proceeding. As with federal courts, requirements regarding access to state and local court records may have a state common law or constitutional basis or may be based on state laws. When federal, state, and county government agencies administer programs that deliver services and benefits to the public, they rely extensively on the SSNs of those receiving the benefits and services. SSNs provide a quick and efficient means of managing records and are used to conduct research and program evaluation. In addition, they are particularly useful when agencies share information with others to verify the eligibility of benefit applicants or to collect outstanding debts. Using SSNs for these purposes can save the government and taxpayers hundreds of millions of dollars each year. As they make this wide use of SSNs, government agencies are taking some steps to safeguard the numbers; however, certain key measures that could help protect SSNs are not uniformly in place at any level of government. First, when requesting SSNs, government agencies are not consistently providing individuals with key information mandated by federal law, such as whether individuals are required to provide their SSNs. Second, although agencies that use SSNs to provide benefits and services are taking steps to safeguard them from improper disclosure, our survey identified potential weaknesses in the security of information systems at all levels of government.