Personal data security breaches are being reported with increasing regularity. During the past few years, there have been numerous examples of hackers breaking into corporate, government, academic, and personal computers and compromising computer systems or stealing personal data such as Social Security, bank account, credit card, and driver's license numbers, as well as medical and student records. These breaches occur not only because of illegal or fraudulent attacks by computer hackers, but often because of careless business practices, such as lost or stolen laptop computers, or the inadvertent posting of personal data on public websites. A recent infamous example occurred in May 2006, when 26.5 million veterans and their spouses were in danger of identity theft because a Veterans Affairs data analyst took home a laptop computer containing personal data (including names, Social Security numbers, and dates of birth), which was later stolen in a burglary. Depending on the definition, the most common type of identity theft is credit card fraud, and there is evidence that the extent of credit card fraud has increased due to opportunities provided by the Internet. Although some aspects of identity theft have been known for many years, it is viewed now primarily as a product of the information age. A particular crime of identity theft may include one or all of these stages: Stage 1: Acquisition of the identity through theft, computer hacking, fraud, trickery, force, re-directing or intercepting mail, or even by legal means (e.g., purchase information on the Internet). Stage 2: Use of the identity for financial gain (the most common motivation) or to avoid arrest or otherwise hide one's identity from law enforcement or other authorities (such as bill collectors). Crimes in this stage may include account takeover, opening of new accounts, extensive use of debit or credit cards, sale of the identity information on the street or black market, acquisition ("breeding") of additional identity related documents such as driver's licenses, passports, visas, health cards, etc. ), filing tax returns for large refunds, insurance fraud, stealing rental cars, and many more. Stage 3: Discovery of the theft. While many misuses of credit cards are discovered quickly, the "classic" identity theft involves a long period of time to discovery, typically from six months to as long as several years. Evidence suggests that the time it takes to discovery is related to the amount of loss incurred by the victim. Identity theft is rarely one crime, but is composed of the commission of a wide variety of other crimes, such as check and card fraud, financial crimes of various sorts, various telemarketing and Internet scams, auto theft, counterfeiting and forgery, etc. The difficulty in studying identity theft is investigating what portion of the long list of identity theft related crimes is related to the "classic" type of identity theft that results in repeat victimization. For example, a common type of credit card fraud is to steal an individual's credit card. The offender makes a quick purchase of an expensive item then discards the card. Has the victim's identity truly been stolen? The event clearly fits within the definition above, but it is not the wholesale theft of the victim's identity. However, should the offender be working with an accomplice, the card could be turned over several times and even sold on the street. Finally, should the victim's driver's license and other identifying documents such as a health card with a Social Security number on it also be stolen, the basic elements for stealing an individual's identity are present. A January 2007 white paper by the computer security research company McAfee Avert Labs reports a dramatic increase in global identity theft trends. One key finding was that "[p]ersonal data for tens of millions of people disappears each year. It's either been stolen or misplaced. Despite this disturbing trend, the number of complaints is surprisingly low, which leads us to believe the losses are not fully acknowledged." A California law that requires notice of security breaches to the affected individuals is the major reason for the increased awareness of these breaches. This law, which was implemented in July 2003, was the first of its kind in the nation. State security breach notification requires companies and other entities that have lost personal data to notify affected consumers. Thirty-five states have enacted legislation requiring companies or state agencies to disclose security breaches involving personal information. State security freeze laws allow a customer to block unauthorized third parties from obtaining one's credit report. Identity theft victims spend almost 300 million hours a year trying to clear their names and re-establish good credit ratings. For additional information on this topic, see CRS Report RL31919, Federal Laws Related to Identity Theft , by [author name scrubbed]. In December 2006, a senior editor for Wired New s noted a milestone: "... the total number of lost or exposed personal records since February, 2005, [has passed] the 100 million mark." The New York Times wrote an article discussing this landmark and questioned the usefulness of computing such data breaches. [T]he bigger picture here may be that we are now slicing and dicing the niceties of data breaches against a running tally so large, that it has lost nearly any meaning at all... 'The threat of identity theft from data losses is being greatly exaggerated,' Fred H. Cate, the director of the Center for Applied Cybersecurity Research at Indiana University in Bloomington, told this newspaper not long ago. 'And that's because a lot of people have fallen into the trap of equating data loss with identity theft.' Whether or not that is true is open to debate, but what all this data loss does represent, however, is the potential for identity theft—one that will never go away. Sure, it's a game of odds. There is only so much a crook can do with a few hundred thousand names and Social Security numbers. But once they are out there, they are out there for good. Names don't change. Neither do Social Security numbers or dates of birth. And as long as it remains easy enough to fashion that trifecta into a car loan, a home, a credit card, work papers, that would seem to be a bit of a long-term problem. The Identity Theft and Assumption Deterrence Act of 1998 established the Federal Trade Commission (FTC) as the government entity charged with developing "procedures to ... log and acknowledge the receipt of complaints by individuals," as well as educate and assist potential victims. The FTC compiles annual reports and charts of aggregated statistics on these events, but does not identify which corporations, organizations, or other entities have been victims of security breaches. In February 2007, FTC issued its annual report on fraud complaints consumers have filed with the agency. For the seventh year in a row, identity theft topped the list, accounting for 36% of the 674,354 complaints received between January 1 and December 31, 2006. Credit card fraud was the most common form of reported identity theft, followed by phone or utilities fraud, bank fraud, and employment fraud. A number of federal agencies (e.g., the FTC, Department of Justice, Secret Service, U.S. Postal Service, and Social Security Administration), state attorneys general, and nonprofit organizations (such as the Electronic Privacy Information Center) are involved with data privacy investigations or related consumer assistance. None of them maintain a comprehensive itemized list of data security breaches. However, the Privacy Rights Clearinghouse maintains a frequently updated chronology of data breaches from February 2005 to the present. The United States Computer Emergency Readiness Team (US-CERT) interacts with federal agencies, industry, the research community, state and local governments, and others to collect reasoned and actionable cybersecurity information and to identify emerging cybersecurity threats. US-CERT has recently begun monitoring trends involving the acquisition of personally identifiable information (PII) by unauthorized, malicious users. Based on the information reported in the first quarter of FY2007, US-CERT identified the following cybersecurity trends: phishing made up the bulk of security threats reported to US-CERT, accounting for almost 75% of all incidents handled. The number of reports grew by more than 500%, with just over 16,000 reports in FY2006 Q1, compared with over 103,000 in FY2007 Q1. The second highest category was "others," the bulk of which generally fell into two main areas: investigations, which were incidents found by US-CERT analysts combing through data, and incidents involving PII, both cyber and non-cyber in nature. The remaining 8% of incidents were spread across malware, equipment theft/loss, policy violations, and suspicious network activity. In reports to Congress since 1997, GAO has identified information security as a government-wide high-risk issue. In their FY2006 financial statement audit reports, 21 out of 24 agencies indicated that they had significant weaknesses in information security controls. As shown in reports by GAO and agency inspectors general (IG), the weaknesses persist in major categories of controls—including, for example, access controls, which ensure that only authorized individuals can read, alter, or delete data; and configuration management controls, which provide assurance that only authorized software programs are implemented. "Organizations can reduce the risks associated with intrusions and misuse if they take steps to detect and respond to incidents before significant damage occurs, analyze the causes and effects of incidents, and apply the lessons learned." In February 2007, the Federal Bureau of Investigation (FBI) reported that 160 laptop computers were lost or stolen in less than four years (February 2002 to September 2005), including at least 10 that contained sensitive or classified information—one of which held "personal identifying information on FBI personnel." According to the report, the FBI failed to report 76% of the missing laptops to the Justice Department as required. A number of data security breaches by federal agencies revealed many agencies do not have adequate security controls in place (see Table 3 , below).