PROTECTING PRIVACY AND PREVENTING THE
SUBCOMMITTEE ON SOCIAL SECURITY
COMMITTEE ON WAYS AND MEANS
HOUSE OF REPRESENTATIVES
ONE HUNDRED SEVENTH CONGRESS
MAY 22, 2001
Printed for the use of the Committee on Ways and
COMMITTEE ON WAYS AND MEANS
|PHILIP M. CRANE, Illinois
E. CLAY SHAW, Jr., Florida
NANCY L. JOHNSON, Connecticut
AMO HOUGHTON, New York
WALLY HERGER, California
JIM MCCRERY, Louisiana
DAVE CAMP, Michigan
JIM RAMSTAD, Minnesota
JIM NUSSLE, Iowa
SAM JOHNSON, Texas
JENNIFER DUNN, Washington
MAC COLLINS, Georgia
ROB PORTMAN, Ohio
PHIL ENGLISH, Pennsylvania
WES WATKINS, Oklahoma
J. D. HAYWORTH, Arizona
JERRY WELLER, Illinois
KENNY C. HULSHOF, Missouri
SCOTT MCINNIS, Colorado
RON LEWIS, Kentucky
MARK FOLEY, Florida
KEVIN BRADY, Texas
PAUL RYAN, Wisconsin
|CHARLES B. RANGEL, New York
FORTNEY PETE STARK, California
ROBERT T. MATSUI, California
WILLIAM J. COYNE, Pennsylvania
SANDER M. LEVIN, Michigan
BENJAMIN L. CARDIN, Maryland
JIM MCDERMOTT, Washington
GERALD D. KLECZKA, Wisconsin
JOHN LEWIS, Georgia
RICHARD E. NEAL, Massachusetts
MICHAEL R. MCNULTY, New York
WILLIAM J. JEFFERSON, Louisiana
JOHN S. TANNER, Tennessee
XAVIER BECERRA, California
KAREN L. THURMAN, Florida
LLOYD DOGGETT, Texas
EARL POMEROY, North Dakota
SUBCOMMITTEE ON SOCIAL SECURITY
|SAM JOHNSON, Texas
MAC COLLINS, Georgia
J.D. HAYWORTH, Arizona
KENNY C. HULSHOF, Missouri
RON LEWIS, Kentucky
KEVIN BRADY, Texas
PAUL RYAN, Wisconsin
|ROBERT T. MATSUI, California
LLOYD DOGGETT, Texas
BENJAMIN L. CARDIN, Maryland
EARL POMEROY, North Dakota
XAVIER BECERRA., California
Pursuant to clause 2(e)(4) of Rule XI of the Rules of the House, public hearing records of the Committee on Ways and Means are also published in electronic form. The printed hearing record remains the official version. Because electronic submissions are used to prepare both printed and electronic versions of the hearing record, the process of converting between various electronic formats may introduce unintentional errors or omissions. Such occurrences are inherent in the current publication process and should diminish as the process is further refined.
Advisory of May 15, 2001, announcing the hearing
Social Security Administration:
Hon. James G. Huse, Jr., Inspector General, Office of the Inspector General
Michael Robinson, Special Agent, Office of the Inspector General
Electronic Privacy Information Center, and Georgetown University Law Center, Marc Rotenberg
Financial Services Coordinating Council, and Covington & Burling, John C. Dugan
Individual Reference Services Group, and Piper Marbury Rudnick & Wolfe LLP, Ronald L. Plesser
Kravit, Cory B., University of Florida
Moneme, Emeka, Washington, DC
New York City Police Department, Michael Fabozzi, accompanied by James Doyle
Pension Benefit Information, Paula LeRoy
Privacy Times, Evan Hendricks
Robinson, Nicole, Oxon Hill, MD
Texas, Harris County, Charles Bacarisse
U.S. Public Interest Research Group, Edmund Mierzwinski
Conference of State Court Administrators, Arlington, VA, David K. Byers, statement
National Conference of State Legislatures, Hon. Brian Flaherty, letter
National Council of Investigation and Security Services, Inc., Bruce Hulme, statement
National Council on Teacher Retirement, Arlington, VA, Cynthia L. Moore, statement
Paul, Hon. Ron, a Representative in Congress from the State of Texas, statement
PROTECTING PRIVACY AND PREVENTING THE
MISUSE OF SOCIAL SECURITY NUMBERS
House of Representatives,
Committee on Ways and Means,
Subcommittee on Social Security,
The Subcommittee met, pursuant to notice, at 10:05 a.m., in room 1100 Longworth House Office Building, Hon. E. Clay Shaw, Jr., (Chairman of the Subcommittee) presiding.
[The advisory announcing the hearing follows:]
Chairman SHAW. Good morning. Today we continue our quest to protect the privacy of every American by cracking down on the fraud, abuse and theft of Social Security numbers or perhaps I should say the availability of the Social Security numbers (SSN) to commit fraud, abuse and theft.
Last year, as learned from Colonel and Mrs. Stevens of Maryland, identity theft is truly a devastating crime. Their Social Security numbers used on 33 fraudulent accounts and $113,000 of bad debt--that is the problem that Colonel and Mrs. Stevens had. And Mr. Bob Horowitz, who is a single father in my congressional district, saw his number used to open five fraudulent credit accounts. Months and years later they were still spending time, money and energy to clear their names. No wonder in a Wall Street Journal poll just last year respondents ranked privacy as their number one concern in the 21st century, ahead of wars, terrorism and environmental disasters.
When Social Security numbers were created 65 years ago their only purpose was to track a worker's earnings so that Social Security benefits could be calculated. But today use of the Social Security number is rampant. We have literally developed a culture of dependence on Social Security numbers. Businesses and governments use of the number as a primary way of identifying individuals. All of us know difficult it is to conduct even the most frivolous transaction without having to cough up our Social Security number first.
Although Social Security numbers are used for many legitimate purposes, the wide availability and easy access to this very personal information has greatly facilitated Social Security number-related crimes and has generated a growing concern for our own privacy.
Clearly, there is a need for a comprehensive law that will better protect the privacy of Social Security numbers and protect the American public from being victimized. Last year I, along with Mr. Matsui, Mr. Kleczka and Mr. Foley and other Subcommittee members, introduced H.R. 4857, the Social Security Number Privacy and Identity Theft Protection Act of 2000. This legislation took a comprehensive approach to achieve this goal by targeting the treatment of Social Security numbers in both the public and the private sectors.
In the public sector, the bill restricted the sale and public display of Social Security numbers, provided for enforcement of the provisions and established penalties for the violation. In the private sector, the bill restricted the sale, purchase and display of Social Security numbers, limited the dissemination of the Social Security numbers by credit-reporting agencies, and made it more difficult for businesses to deny services if a customer refused to provide his or her Social Security number.
While H.R. 4857 was approved by the Committee on Ways and Means at the end of last year, it was not considered by the full House before the end of the session due to its referral to other committees of jurisdiction, which did not take action on the bill--the Judiciary Committee, which waived jurisdiction, and the Commerce Committee, which did not have time to hold hearings and to act on the bill.
In our hearing today, we will hear from two more of the countless numbers of victims who have had their identities stolen--Miss Nicole Robinson and Emeka Moneme. We will then hear from law enforcement officials who will discuss the challenges they face as they try to catch these identity thieves. Finally, we will hear from representatives from the business groups, elected officials and privacy advocates who will share with us their impressions on the widespread use and misuse of Social Security numbers in the public and private sectors, as well as their views on the impact of legislative proposals.
One of these witnesses, I might add, was an intern in my office when we were working on this issue and went down and worked to eliminate the use of these numbers at the University of Florida.
This week I, along with several of my Ways and Means Committee, plan to reintroduce our bipartisan legislation. I will then work with my colleagues on the Ways and Means Committee and from the other committees of jurisdiction to quickly bring to the House floor comprehensive legislation to keep Social Security numbers private and protect citizens from identity theft. The time for action is long overdue and I am hopeful that the other committees will follow suit and have hearings on this legislation.
[The opening statement of Chairman Shaw follows:]
Mr. BECERRA. Thank you, Mr. Chairman. Let me just say that on behalf of ranking member Matsui and the members of the Committee, we are pleased to have this hearing hosted today, as well, given that this is a bipartisan piece of legislation that has worked its way through the House in the past and we are looking forward to working with you, Mr. Chairman, to try to see if we cannot get something done.
I do not think there is anyone here who would not recognize that we do have a problem with regard to the Social Security number. We know that it was a number that was initially created for the purposes only of the Social Security Administration to track those who were to receive benefits through the Social Security Administration. Now, or course, we use it day to day in all of our lives and we find now that the statistics associated with identity theft are staggering. There is no doubt that if we do not do something, we are going to continue to see the numbers just increase.
I understand that from the Federal Trade Commission (FTC) with its theft hotline that they are receiving somewhere on the average of 1,000 calls per week, some 60 percent of which relate to actually identity theft from people who are calling as victims of that identity theft. We know that the numbers in terms of dollars are staggering. Anywhere from $250 in losses to up to $200,000 in losses have been reported by individuals.
But, we also know that the number can be used for good purposes, as well. The contributions that the use of the Social Security number makes to program administration and to business efficiency are certainly there and we have to be cognizant of that. Certainly, though, we have to be mindful and very careful that we do not allow some of our most fundamental rights--the right to privacy and the right to control our personal information--be abridged in the name of expediency, however.
So, Mr. Chairman, I believe we are very much looking forward to hearing from the witnesses, to trying to move this bipartisan piece of legislation forward and, at the end, hopefully providing people in this country with a greater sense of security that their Social Security number will go for a good purpose, in helping them obtain their Social Security benefits in the future but, most importantly, to make sure that day to day, that Social Security number will be protected.
Thank you, Mr. Chairman.
Chairman SHAW. Thank you.
Mr. Kleczka, did you want to make a couple of comments? I know this is unusual at a hearing, to have two members make opening comments, particularly from the minority side, but I would be delighted to yield to you if you have any comments.
Mr. KLECZKA. Thank you, Mr. Chairman. The only thing I would like to say is thank you to all the witnesses who are here to tell their stories. There are countless others who are not here today who have also been victims of identity theft.
I think it is high time that Congress recognize that the Social Security number is not a national identifier and for businesses who, by habit or for other reasons, request our numbers--I recall a few years ago when I was checking out at Toys R Us. The items were for my nieces and nephews, not for me. The clerk demanded my Social Security number on my check. Well, that seemed kind of odd but I think the person was told to ask for that so I wrote down any 10 numbers that came to mind, gave her the check and she processed the payment. But if I were her or any clerk I would like to see a person's driver's license number versus a Social Security number because that does not tell anything.
So, I just received a copy of the Congress Daily today where the retailers are indicating this is a knee-jerk reaction on the part of Congress. To the 750,000 Americans who are going to be victims of identity fraud this year, I do not think that is knee-jerk. And we are going to hear from witnesses where they are going to say that it takes years to clear your own record because the knee-jerk reaction from the credit bureaus is "Yeah, we hear that all the time; that is not your charge." So you have to go back and, through various means, prove that you did not make those changes and then finally, clear your own records so that you can get additional credit or whatever.
So, Mr. Chairman, I am honored not only to be at the Committee hearing this morning but also to cosponsor the bill and hopefully we have enough time this session that we will see enactment of this much-needed legislation. Thank you very much.
[The opening statement of Mr. Kleczka follows:]
Chairman SHAW. Thank you.
Our first panel of witnesses is made up of--we will start out with a two victims. Nicole Robinson from Oxon Hill, Maryland. Emeka Moneme, who is from Washington, DC, an employee of the Washington, DC government. The Honorable James G. Huse, who is the Inspector General, the Office of the Inspector General, Social Security Administration. Mike Robinson, who is a special agent, the Office of the Inspector General, the Social Security Administration. Michael Fabozzi, who is a detective, Computer Investigations and Technology Unit of the New York City Police Department and he is accompanied by James Doyle, who is a sergeant, Computer Investigations and Technology Unit of the New York City Police Department.
All the witnesses, we welcome you. Your complete statements will be put into the record and we invite you to summarize as you may be comfortable, and we will start with you, Miss Robinson.
STATEMENT OF NICOLE ROBINSON, OXON HILL, MARYLAND
Ms. ROBINSON. Good morning, Mr. Chairman, distinguished members of the Committee. My name is Nicole Robinson and I am a victim of ID theft.
One Friday evening in early April 2000 I was contacted by a fraud investigator of a national jewelry chain. He informed me that an individual had opened an instant credit account for $3,200 and bought two watches and a ring in a mall in San Antonio a day before. He asked me if I was Nicole Robinson, he confirmed my date of birth, my Maryland address, and told me what Social Security number was provided on the credit application. My stomach turned when he recited mine.
The criminal had returned that day and attempted to purchase more merchandise, which the salesperson thought was suspicious. The salespeople told her that their computers were down and then alerted their fraud department and the San Antonio police.
A thousand thoughts raced through my mind that weekend. How could this have happened to me? Was it a friend of mine, an acquaintance, an enemy? How many accounts had been opened?
On Monday I contacted the three credit-reporting agencies to see if there were any accounts that were opened recently and there were no new accounts, yet. There were a lot of inquiries. One of the inquiries was from my mortgage lender. I contacted them and alerted them to the fact that there was a woman in Texas using my identity to obtain credit. They confirmed that a woman had provided my information in connection with an application for a personal loan in the amount of $1,800. At my suggestion, a few days later they contacted her to tell her she was approved for the loan. She was arrested by the San Antonio police when she left the office with the check.
After she was arrested they asked her where she obtained my Social Security number and date of birth. She told them that she worked for a business that maintained Health Maintenance Organization (HMO) databases. She searched that information to get my Social Security number and date of birth.
She was charged with making a false statement to obtain goods. She was released a few days later after she, her pastor and parents, assured a Bexar County judge that she would not do this again. Two days later she applied for a mortgage in my name.
When I finally received my credit reports in the mail there were several changes. I saw that she had made up middle names for my middle name, since she did not know what my middle name was. She had provided a fictitious maiden name, several different addresses in Texas and several different dates of birth, but she always provided my Social Security number. On one application she provided my Social Security number with the last two numbers transposed and a bogus Texas address and she was still approved for the items she sought. When the bills for the item were returned from the fake address, the creditor reviewed my credit report again and sent several of her delinquent bills to my home in Maryland. When I contacted them by phone they were rude and did not want to believe that the account was fraudulent and then refused to send me an affidavit of fraud. Shortly after I contacted them they located the woman in San Antonio and repossessed the item from a warehouse. Now, a year later, they still have not acknowledged the account as fraudulent but I no longer receive her bills.
In the ensuing months I would discover that she also applied and was approved for two computers, large appliances, clothing, household goods, a cellular phone and a $1,600 vacuum cleaner. Some items were obtained even after fraud alerts were placed on my credit reports.
In June of 2000, two months after her arrest, she shopped for a car with my identity. She eventually purchased a 2000 Mitsubishi automobile from a San Antonio dealership. Although it took me until January 2001 to verify that the car was not purchased using my identity, GEICO insured the car for her in June of 2000 using my identity. When I contacted GEICO last June to obtain the VIN number of the vehicle, they refused to give it to me, citing their policy on protecting the privacy of their policyholders. I thought that was ironic since technically the policy that they issued was to me. She was able to obtain $36,000 worth of goods in a three-month period.
This has impacted my life greatly. I received delinquent bills for purchases she had made. I spent countless hours on calls to creditors in Texas who were reluctant to believe that the accounts that had been opened were fraudulent. I spent days talking to police in Texas in an effort to convince them that I was allowed by Texas law to file a report and to have her charged with theft of my identity. She was never charged with identity theft and I had to pay for the collect call just to file the police report in Texas.
I tried to contact the district attorney's office in Bexar County to see what I could do to have her charged and no one ever responded to my messages. I had to send more than 50 letters to creditors trying to have them remove the more than 60 inquires that were made by this woman between March and June of 2000.
Just when I was starting to believe that this was over, I received a collection notice in her name at my home in Maryland on April 4 of this year. When I contacted the collection agency to tell them that they had the wrong person, I was told that the Social Security number that was provided for the loan was not mine. The gentleman at the collection agency told me that they had a bad address in San Antonio so information was given to their research department and they came up with my address in Maryland. I asked him what service was connecting my address with this woman, who was committing felonies in Texas and he would not provide that information. I have since contacted him three times and he still has not returned my calls. I still do not know how they connected me with this woman and it concerns me since she has assumed several identities of persons named Nicole Robinson in order to commit fraud.
This crime has impacted my ability to refinance my home, obtain a line of credit at my bank, get cellular phone service. It has even affected accounts that I had prior to the crime. I subsequently had two lines of credit, both with zero balances and in good standing, closed because the businesses suspected that they, too, were fraudulent. I was told that I would have to reapply if I wanted the accounts reopened. Most importantly, this crime continues to give me constant anxiety.
I had always been a person who kept my Social Security card under lock and key. I never gave personal information over the phone and I always shredded and systematically discarded pre-approved credit applications. And I check my credit reports every year. I was not a likely victim. But since HMOs require my Social Security number and use it as an identification number, I was forced to be a victim.
Our government-issued Social Security numbers are being used daily. We provide our Social Security numbers to businesses on a regular basis for no reason other than their own internal use. I had no control over how mine was used or who had access to it. And until this happened to me I honestly did not give it much thought.
Since I have become a victim, I think about it every day. This will impact my life forever. Detective Victor Flores of the San Antonio Police Department told me, "There is nothing you can do and when she gets out of jail on the theft charges she will do it again. The recidivism rate is very high." When I tried to contact the detective to find out what happened to this woman he did not return my calls.
Chairman SHAW. Thank you, Miss Robinson. If you will supply me with the name and address of the people who would not return your calls I will see that they get a copy of your testimony and a letter from me telling them of this particular hearing.
Ms. ROBINSON. Thank you.
[The prepared statement of Ms. Robinson follows:]
Chairman SHAW. Mr. Moneme?
STATEMENT OF EMEKA MONEME, WASHINGTON, DC
Mr. MONEME. Mr. Chairman and distinguished members of the Subcommittee, good morning. My name is Emeka Moneme and I would first like to thank the Subcommittee for the invitation to share my personal experience dealing with identity fraud and specifically the misuse of my Social Security number. I hope to convey to you, as Miss Robinson just did, the frustration, anger and violation that comes as a part of this crime. But as I am sure other victims can attest, it is very difficult to actually express or even to comprehend it unless you have been a victim.
When I try to pull together the circumstances that surround the misuse of my information, it appears that the only piece of information that the perpetrator of this crime had to use was my Social Security number. My personal property was stolen at the university gym in Cincinnati in late May of 2000. My Ohio driver's license and Visa credit card were removed from my wallet and one day later several purchases had been made with the card. I then immediately cancelled the card and then applied for a new driver's license and at this point I assumed that the situation had been resolved and I basically moved on.
I first became aware the next month in June that I had been victimized. I received a letter from Chase Manhattan Bank saying that they had received a suspicious request for credit using my information. I immediately contacted them and got some general information and then contacted the reporting bureaus. I was instructed to place a fraud alert on my file and then I received a credit report.
When I received the report there were approximately eight fraudulent accounts listed on the report. I was very upset and I wanted to immediately correct the situation but I really did not have any idea how to go about correcting this information. My first instinct was to begin contacting the creditors and speaking to them directly and as I contacted the individual banks, it was not until the fifth bank that I was informed there was actually a process in place to deal with this, so I had to then go back and repeat my conversations with the other banks and prepare the proper documentation for an investigation to be initiated.
It was at this time in the process that I learned that the three reporting agencies operated separately and that I had to go through this process not only once but with all three of them in conjunction. And I found that the information was not always uniform across all three bureaus; there was different information with each one. At the end of my contacting all the reporting agencies I found 13 accounts with a total of $30,000 in credit that had been used, including the purchase of a motorcycle and other sports utility-type goods, as well as purchases at clothing stores, et cetera.
The only thing that linked the perpetrator to my credit was my Social Security number, which was taken from my driver's license. I also later learned that the majority of these applications were done over the phone so the only identification required was the Social Security number. I also received copies of many of the applications with my alleged signature, which did not match up with the signature on my driver's license, and therefore it seems that there was no other verification necessary except for the Social Security number.
I am now extremely careful about sharing this information and I have cautioned my family and friends, as well. However, the damage has already been done. This negative information is very difficult to be removed, as Nicole has testified to. It has been almost a year now and I am still going through the process of contacting people and finding new information on credit reports when I receive them. The process of having this information removed is very heavily weighted against the consumer.
The Fair Credit Reporting Act states that credit-reporting agencies are required to investigate claims of credit fraud and if the claims are supported, remove the false information within 30 days. In October of 2000 I submitted copies of 13 letters and statements from credit-granters stating that the accounts were opened fraudulently and to this day I have not heard back from any of them and my most recent credit report that I pulled, the information was still there and current.
I am left with damaged credit and feel very embarrassed having to explain to my mortgage lender, as I did last week, that I cannot get credit on my house because this information is there that I did not put there. I have paid a very, very high price for the crimes of this one person.
Another problem that has only recently begun to surface is the reappearance of accounts that I had believed to be deleted. I went through the process of having one account removed and then found in my last credit report that the account was still being listed by a collections agency that the account was transferred to. This will initiate another round of doing the investigate reporting that I have had to do in collecting information.
In summary, this experience has been extremely frustrating, tedious and for the most part overwhelming. I have spent countless hours on the phone at home, at work, thinking about it, trying to explain to my wife how we are going to get a house. It has just been a very trying period.
I really hope that this story and our testimony today provides a little bit of insight into some of the realities of identity fraud. Thank you.
Chairman SHAW. Thank you, Mr. Moneme. I also will send a transcript of your testimony to the people you are trying to get a mortgage from. Perhaps that might help.
Mr. MONEME. Thank you.
[The prepared statement of Mr. Moneme follows:]
Chairman SHAW. And any other place that either you or Miss Robinson might want me to direct your testimony with a cover letter from me.
Mr. Huse, glad to have you with us again.
STATEMENT OF THE HON. JAMES G. HUSE, JR., INSPECTOR GENERAL, OFFICE OF THE INSPECTOR GENERAL, SOCIAL SECURITY ADMINISTRATION
Mr. HUSE. Good morning, Mr. Chairman and members of the Subcommittee.
As you know, my office is charged with protecting Social Security programs from fraud, waste and abuse. No aspect of our mission though is more important than our oversight of the use and unfortunately misuse of the Social Security number or SSN.
In 1935 the SSN was created as part of a new system to track the earnings of employed Americans. Just as no one dreamt that the innocuous nine-digit number would become our de facto national identifier, no one could foresee the breadth and complexity of commerce in the electronic age. Unfortunately, while the SSN and computer technology have matured together, the laws we use to police and protect them have struggled to keep pace.
Misuse of the SSN, catalyzed by the Internet, has quickly become an national crisis. The SSN's universality has become its own worst enemy. The power it wields--the power to engage in financial transactions, power to obtain personal information, the power to create or commandeer identities--makes it a valuable asset and one that is subject to limitless abuse.
It falls on government, which created the SSN and permitted it to assume such power, to take action to control its own creation. Organizations such as the Social Security Administration (SSA) Office of the Inspector General, the Federal Trade Commission and the Department of Justice, have the responsibility to enforce laws designed to protect against SSN misuse and its consequences.
To do so, there must be adequate laws in place. In recent years we have seen the enactment of the Identity Theft and Assumption Deterrence Act of 1998 and the Internet False Identification Prevention Act of 2000. Both are helpful but both treat the disease in its later stages rather than at its onset. Identity theft begins in most cases with the misuse of an SSN and while the ability to punish identity theft is important, the ability to prevent it is even more critical.
How do we do this? First and foremost, the time has come to put the SSN back in its box. We must make the difficult determinations as to those uses that are appropriate and necessary and those that are merely convenient. The SSN is a unique identifier and its quotidian use as an ID number by schools, hospitals, and other institutions is understandable but dangerous. Its use by Federal, State and local governments not only for taxes and for other legitimate purposes but for everything from drivers licenses to water and sewer bills is a convenience that we can no longer afford.
Its use in private industry, not just for financial transactions but for joining a health club or buying a refrigerator, has become reckless and its ready availability over the Internet must come to a stop.
We need legislation that limits the use of the SSN to those purposes that benefit the holder of the SSN, not the company that sells that person an appliance or the State that issues that person a driver's license. We need legislation that regulates the use of the SSN and provides enforcement tools to punish its misuse. And, we need legislation that stops the ready availability of SSNs over the Internet and through other means.
The prevalence of SSN misuse cannot be denied. In fiscal year 2000 our office received over 92,000 allegations. Over half of them, almost 47,000, were allegations of SSN misuse and another 43,000 were allegations of program fraud which, experience has shown us, often includes the potential for SSN misuse.
My office and others, such as the Federal Trade Commission, are doing all we can within the limitations imposed by existing law and resources. We are diligent in referring allegations of identity fraud to the FTC and we conduct investigations of SSN misuse, both program-related and nonprogram-related, on a daily basis. We have conducted undercover operations in which we have purchased counterfeit Social Security cards and reverse sting operations in which we have offered such cards for sale. Several of these cases are now pending in the U.S. Attorney's Offices. We are involved now in a joint investigation with another Federal law enforcement agency in which lists of names and SSNs were being sold to the highest bidder on an Internet auction site. Although the investigation is on-going and I cannot provide details, I can tell you that we have discovered that the source of the list was a university. This highlights the need to stop the indiscriminate use of SSNs as ID numbers. Unfortunately, while the subject in this case may eventually face criminal charges of some kind, nothing in the Social Security Act prohibits the sale of SSN information.
Our efforts have made a difference but with better laws we can do far more. I welcome this Subcommittee's dedication to this endeavor and attention to this critical issue and I would be happy to answer any questions.
[The prepared statement of Mr. Huse follows:]
Chairman SHAW. Thank you, Mr. Huse. Mr. Robinson?
STATEMENT OF MICHAEL ROBINSON, SPECIAL AGENT, OFFICE OF THE INSPECTOR GENERAL, SOCIAL SECURITY ADMINISTRATION
Mr. ROBINSON. Thank you, Mr. Chairman and members of the Subcommittee. I will proceed with doing a presentation that will show you the various websites that are available that will assist in facilitating identity theft.
Chairman SHAW. Each of the members has this book, which I believe you have supplied.
Mr. ROBINSON. Yes, sir, Mr. Chairman. Those books will actually be a representation of this presentation here.
As you can see, Mr. Chairman, the first page is a home page on the Internet and this is a first page that is easily accessible and usually the first page that someone will view when they are entering the World Wide Web.
From there they will go to a search engine and there are various search engines out there on the Internet and they could simply type in the type of information they would wish to search for. And as you can see here, we indicated "instant Social Security number searches."
This is one of the sites that actually offers the service to assist an individual in finding Social Security numbers and they also offer a response time anywhere from 15 to 30 minutes. These could actually be purchased over the Internet, this type of service, by anyone with a major credit card and they could instantly receive a response right there over the Internet.
Here, as you can see, a price is listed to actually search for someone's Social Security number, which is $39.95 at this particular site.
Pretty simple information that needs to be put in by anyone. Just input that information there and it just walks an individual through the various steps that they would need to take within this site to complete their search.
Information here that confirms the individual's request, gives them the amount that they will be charged for this particular service. They could have an extensive search and it also lists that the person could actually purchase a one-hour rush to get the Social Security number of an individual.
Here it actually confirms that the purchase has been made, gives you several other selections that the individual can place at this time for other searches, additional information that could be purchased and with this information, the person could assume anyone's identity.
Here is an additional website that is easily accessible, readily available to anyone who has access to the Internet. This site actually offers the same type of service as the previous website that we mentioned.
From here, not only on the Internet could you obtain someone's Social Security card but you could also purchase several identity documents--anything from driver's license to graduation certificates, birth certificates, really the major items that you would need to assume an individual's identity.
As you can see, there are even websites that are available on the Web that actually ranks the top 10 fake ID websites so that if an individual is surfing the Internet looking for places to go and actually obtain a fraudulent identification document or a fraudulent ID, this will give them an idea of what sites are out there and whether or not the sites are worth visiting.
Here we have a fake ID review site. With the fake ID review site, what this does is give an individual an idea of what type of product they would purchase if they would go to the particular sites that are recommended here. It tells you whether or not the products are good, whether or not the products are neutral, where the products are actually made and the time frame in which a person can expect, prior to receiving their fraudulent document in the mail, to include Social Security card, driver's license, birth certificates, things of that nature.
From this website here, as you can see, all 50 States are represented here and with this website you can actually purchase a driver's license from each of the 50 States and with these driver's licenses they could be used as what we call breeder documents. With these driver's licenses here if someone had your name and your address and they knew your Social Security number, depending upon how well the product looks, they could use that to obtain an actual Social Security card with your name and number on it.
Here, as you can see, this site not only offers you a driver's license but once you purchase that driver's license you can also obtain a Social Security card.
This is just the order form for that site, pretty self-explanatory to an individual who is on the Internet, so it is easy to complete. And once the person completes this application, they can put in their request and obtain the Social Security card and/or driver's license in any name or number they may choose.
On this website here it actually lists the names and Social Security numbers, which have proven to be valid but are not shown in the presentation here, of individuals, a range of individuals from Bill Gates to General Colin Powell to Ted Turner and the heirs to the Wal-Mart chain, as well. Their names and Social Security numbers here are readily available and they are on the Internet as we speak. We have checked that site very recently.
On these various websites that offer you the opportunity to obtain someone's name, Social Security number, they also offer a person, once they obtain that information, the opportunity to apply for, within 15 to 30 seconds, a credit card over the Internet. And once they obtain that credit card it also links you to various sites in which you could instantly start shopping with that information while you are there on the Internet.
Mr. Chairman and members of the Subcommittee, this would conclude the presentation. Other than the driver's license and the Social Security number that, Mr. Chairman, I think you have before you, those are driver's licenses and Social Security numbers that can actually be purchased over the Internet. And, as you can see, there is an adhesive sticker on both of those identification documents that could easily be removed and once it is removed there is no indication that the sticker was ever there.
[The prepared statement of Mr. Robinson follows:]
Chairman SHAW. Thank you, Mr. Robinson. Mr. Fabozzi?
STATEMENT OF MICHAEL FABOZZI, DETECTIVE, COMPUTER INVESTIGATIONS AND TECHNOLOGY UNIT, SPECIAL INVESTIGATIONS DIVISION, NEW YORK CITY POLICE DEPARTMENT, ACCOMPANIED BY JAMES DOYLE, SERGEANT
Mr. FABOZZI. Good morning, Mr. Chairman and members of the Subcommittee. On behalf of Mayor Rudolph Giuliani and Police Commissioner Bernard Kerik, we would like to thank you for the opportunity to appear before you today to discuss this very important subject.
My name is Detective Michael Fabozzi. Seated next to me is Sergeant James Doyle. We share a combined 36 years experience in the New York City Police Department (NYPD). During that time we have patrolled the New York City subways, housing developments and ultimately went on to serve in the NYPD's Detective Bureau. Presently, we are assigned to the Computer Investigation and Technology Unit, which is part of the Special Investigations Division. Investigators in the Special Investigations Division are responsible for the investigation of white collar crimes, specifically bank and brokerage fraud, credit card fraud and identity theft.
For the past several years we have been assigned to the Computer Investigations and Technology Unit, a squad that has been at the forefront in the area of investigating financial crimes perpetrated through the Internet.
Over the past five years there has been a significant increase in crimes where criminals compromise personal identifying data of victims in order to commit identity theft. The information that falls into criminal hands includes such information as name, date of birth, Social Security number, banking account number and other personal and financial information.
Victims of identity theft, like other crime victims, may feel personally violated. This is especially true in light of the vicious cycle of events that typically follows the occurrence of this crime. Imagine for a moment a recently married couple just starting out their life together. They work hard and save enough money to make a down payment on their first new home only to be denied a mortgage because of a negative payment history, information they knew nothing about. The trouble of rebuilding personal credit may be a more horrifying experience than the illegal charges on a credit card statement. The trauma that this type of fraud causes innocent victims is unimaginable. Moreover, once the crime is discovered and reported, victims are left to fend for themselves in attempting to clear their credit history and good name.
Our unit has successfully conducted numerous investigations where criminals have used the personal information not only to obtain credit cards and personal loans but also to purchase cars and homes. We have seen defendants who stole the identity of others create phony identification on common computer peripherals, such as scanners and printers, and walk into banks and walk out with the accountholder's money. One was even arrested using the name, date of birth and Social Security number of her victim. Although we in law enforcement garner some sense of satisfaction when we make arrests for these crimes, it is not enough when compared to the amount of time and energy a victim spends trying to undo the work of these criminals.
Recently, I was the arresting officer and lead investigator of a team of NYPD detectives, postal inspectors and Secret Service agents in the Abraham Abdallah case, a case that received national and international exposure. Since it is still an on-going investigation, my comments are limited only to the information that has been reported publicly.
Abraham Abdallah, a busboy in a local restaurant in Brooklyn, New York, was able to successfully obtain the personal information, such as date of birth, name, Social Security number, phone and address and sometimes the bank and brokerage information by using the Internet and other sources. Working as a busboy, Abdallah allegedly stole credit card numbers of various customers and then used those credit card numbers to order and purchase merchandise over the Internet.
In addition to order merchandise with stolen credit cards, he used the personal information of his victims to open up new credit card accounts. He requested that new cards be mailed to a new address, usually a mail drop. A mail drop is a P.O. box or mail receiving agency that receives mail for an individual, such as Mailboxes, Etc. New credit card accounts were then opened at these mailbox drops in the name of celebrities and many prominent, well known business leaders. Using these new credit card accounts, Abdallah allegedly went into the local library where he was able to purchase credit history reports on line.
Through the use of on-line information providers and other Internet-based databases, Abdallah was able to penetrate the banking and brokerage accounts of his victims using a common trick called social engineering. Social engineering is the process whereby an individual misleads another, such as a customer service rep, into providing personal information about an individual or an account. Once Abdallah obtained the personal account information and perhaps a password, he was then able to steal a vast amount of money from the accounts of our nation's wealthiest individuals.
This tale of the busboy cyber-thief is a frightening testament to the vulnerability of the entire e-commerce system, a system that has successfully lulled America into believing that encryption and on-line privacy policies have made internet transactions secure. The holes in our system are everywhere--at restaurants, department stores, merchant counters, doctors' offices, insiders at banks and brokerages and HMOs to the nation's three credit-reporting bureaus. By finding just a few holes, Abdallah allegedly was on his way to stealing millions of dollars.
We urge this Committee to take the necessary steps to develop new ways to prevent this type of fraud without sacrificing the privacy rights of the consumers. Specifically our legislative recommendations are as follows.
Entities which have access to consumers' personal identifying information should be strictly accountable as to who they provide such information to and the purpose that the information is being provided for.
Credit reporting agencies should have to notify consumers when inquiries regarding credit histories are made. The consumer should have the ultimate ability to deny such information from being disseminated by the credit reporting agency.
Internet service providers and web sites should be mandated to maintain detailed records of their transactions. Unlike telephone companies that keep detailed records of calls which are of great value to law enforcement in its investigation of identity theft, Internet companies have no set standards as to what records of transactions are kept, thereby providing an impediment to investigating identity theft.
The posting of Social Security numbers on the Internet should be strictly prohibited.
We believe that some of these legislative safeguards, if enacted, can have a significant impact on the crime of identity theft. Thank you for the opportunity to address the Subcommittee.
[The prepared statement of Mr. Fabozzi follows:]
Chairman SHAW. Thank you. Mr. Collins? Mr. Becerra?
Mr. BECERRA. Thank you, Mr. Chairman. And thank you to all the witnesses for their testimony.
Let me begin by asking Mr. Huse his thoughts on a couple of things. One, we know that the use of the number, the Social Security number, is widespread and we know that in many cases private, including public sector agencies and firms, rely on the card to conduct business. We will hear in the next panel many witnesses who will tell us that we are going too far or that there are things that we could do to curtail the misuse of the number but still allow it to be used for other purposes. Some people say that we have been able to track down missing children, we have been able to track down deadbeat fathers by using the Social Security number.
Is there a way, in your opinion, of addressing the concern of identity theft and, at the same time, trying to address the concerns raised by the private sector most particularly in the use of the card to undertake activities which are legitimate and could be beneficial to the public?
Mr. HUSE. I believe there is. We have to accept that the Social Security number is the de facto national identifier and its uses, both by the governmental entities at all levels and the private sector is too imbedded for us to change. It is probably impossible to change it.
But, I think if we regulate an attempt to control the movement of these identifiers in terms of the sale and use of credit histories and credit information and make the entities that do this accountable for the sale and use of these by obtaining the permission of the cardholder himself or herself or notification at the very least, we have gone a long way in slowing down the reckless movement of these numbers, which is at the base of a lot of the criminal problems you have heard about this morning.
I think the bill that the Committee put together last year, H.R. 4857, struck the right compromise there between balancing out all of the interests, leaving something for commerce, leaving something for government but, at the same time, giving people the right to have their good name intact.
Mr. BECERRA. Thank you.
Let me ask any of the folks in law enforcement if they can give us some thoughts on how we can also try to curtail the activity that we see through this presentation that you made, Agent Robinson, where, in effect, you are promoting the use of fraudulent cards, identity cards, and you are, in essence, giving people license to go out there and commit fraud.
Is there any way for us to try to strike at the type of businesses that would market this type of product yet still allow what Mr. Huse identified as legitimate interests to continue within the private and public sectors in the use of, say, the Social Security number?
Mr. ROBINSON. Most of the sites that we actually visited and the companies that are selling these Social Security cards are usually not selling them for legitimate purposes and that, to me, gives us that feeling that as soon as you can see the card and see the fact that the novelty sticker or the sample sticker can be actually pulled off the card and usually they try to protect themselves with a disclaimer but most of the individuals or the individuals who will purchase those cards, I do not think there is a legitimate reason for selling a Social Security card over the Internet or anywhere else.
Mr. BECERRA. So, is there a way to go after that type of enterprise that really does not have a legitimate purpose, other than to help someone commit identity fraud?
Mr. HUSE. I think the accountability that we seek for these entities, to make them responsible for what they traffic in with both criminal sanctions and civil money penalty sanctions, these are the ways to push them back from these enterprises.
Mr. BECERRA. So you would make them criminally liable if someone, for example, is apprehended after using a fake ID obtained by one of these Internet sites, that that Internet company would be equally responsible, criminally liable in that case of any offense that may have been committed by the individual who obtained the fake ID?
Mr. HUSE. That is correct.
Mr. BECERRA. Thank you. Thank you, Mr. Chairman.
Chairman SHAW. Mr. Johnson? Mr. Pomeroy?
Mr. POMEROY. I want to thank the entire panel. This has been extremely interest. I regret the inconvenience and disruption to especially our witnesses that have been defrauded.
Inspector General, on this point of how do we deal with this in a reasonable way, I would like to follow my colleague's questions.
Presently in the implementation of Gramm-Leach-Bliley legislation there have been millions and millions of consumer privacy notices mailed out. I know a number of individuals, your basic average--a couple of retirement accounts, bank accounts, what have you--will have gotten a half dozen notices and I am not sure we have exactly clarified in the public's mind precisely the kind of informed status we wanted to achieve relative to privacy generally.
Are suggestions, in terms of how to deal with this problem, would they require additional notices I am afraid potentially confusing the public in terms of the status of all this?
Mr. HUSE. I think the public is fairly well informed about the fact that this is a problem. The identity fraud problem, I think just even in recent months, you cannot turn on the television at night and not get an identity fraud story on one of the local television stations. In fact, I think one of them in the Baltimore area broadcasted a story very similar to Agent Robinson's demonstration here today last night.
If we stick to trying to regulate what we can or to control what we can, I think the public will accept this, that they have a right, we all have a right to know to what uses our Social Security account number is being put to and when that information migrates from one database to another we should be notified as to the intent or purpose. I think that is a reasonable expectation for all of us.
It will add costs to some of the financial uses of the SSN but I think that is a far better route to take than to try to expunge the use of them entirely because I do not think we could do that.
Mr. POMEROY. I was in the State legislature when we allowed the Social Security number to be substituted for driver's license and the public liked it. They did not have to remember their driver's license number anymore; it was simple. They had the opportunity under our law to choose either one but overwhelmingly there was a preference, just for simplicity's sake, to do that and that was pre having all these PIN numbers that you now have to remember in order to access your various accounts.
There are two sides to the coin. I am very concerned about the public security issue you present so well on abuse of the Social Security number but, on the other hand, there is a convenience of business issue that I am trying to not totally interfere with, either.
Mr. HUSE. We all recognize with this rush of technology and the change that it has made in our lives just in the last 20 years that ultimately the solution to all of this will be some other kind of national identifier. I mean that will come in time. What form that takes, whether it is a biometric thumbprint or eye scan or whatever, that will happen inevitably. Then the pressure on the Social Security number will go away. But to go from where we are today to there, no one can estimate when that will happen. Those biometrics exist now but they are too costly.
So, I think we have to be careful here that we keep this balance. I think the way 4857 is put together, it has some measures that give us an opportunity to make some demonstrable effort in terms of trying to protect the privacy of people's identification data and yet, at the same time, still allowing enough commercial and governmental use of the number to keep commerce going.
Mr. POMEROY. Do you have any ideas about how we might easily assist victims in terms of getting everything straightened around, some central registry they could go to where in a one-call way they have their issues dealt with, as opposed to the incredible burden we place on victims today?
Mr. HUSE. Well, the Congress has made a lot of effort that way in the last five years and de facto, that kind of exists now between the Federal Trade Commission's hotline and the Social Security Administration's Office of Inspector General (OIG) hotline, who completely cooperate with each other. They have become really, in many instances, the court of last resort for a lot of victims of financial crime.
What we need to do a better job in is putting together all of the pieces of law enforcement at the local, county, state and Federal levels to work on these things. Again the bill addresses some of this with the ability for my office, for example, to be able to task force with all of these law enforcement entities to create the kind of synergy we need to do a better job with this because we hear the victims speak about the inability of a lot of law enforcement to really make an impact.
You see, this is a crime that you need real-time information for at the time of an apprehension and when that does not exist, that is how these people survive and move on and metamorphose into something else the next day with more stolen IDs.
Mr. POMEROY. Thank you.
Chairman SHAW. Mr. Collins?
Mr. COLLINS. Thank you, Mr. Chairman.
I have a question for Agent Robinson. On the website Dog pile you have instant Social Security number searches. Can you just type in a number there and hit fetch and it will go and gather that information?
Mr. ROBINSON. Yes, sir. What I actually used was the search engine and wrote in the quote to go out and search for websites that would actually assist me in obtaining instant Social Security number searches. No actual number was placed in there.
Mr. COLLINS. Okay, that just searches for websites, then.
Mr. ROBINSON. Correct.
Mr. COLLINS. On any of the websites could you just put in a number and it would search that number?
Mr. ROBINSON. With the Social Security number, if I had the Social Security number?
Mr. COLLINS. Just make up a number.
Mr. ROBINSON. No, you could put in someone's actual Social Security number and at those various websites they could go out and verify it for you or you could actually request a Social Security number that matches the information that you are providing to the service, such as the name, date of birth and the current address of an individual, is usually the minimum that most of those sites would need.
Mr. COLLINS. But if I had none of that information, I just made up a Social Security number and asked it to search that, would it search it?
Mr. ROBINSON. Some of those sites will do that and will provide that service. If you provide them with a Social Security number I think it is the second site that we used, the Et cetera site would provide that service. You actually place in the Social Security number and it will give you a response and in some of those responses--it varies--some responses will be just the name and some responses will be the name and the address. The response varies based on the price that you pay.
Mr. COLLINS. It has been mentioned holding these people accountable that provide this type of information. If they are not a U.S. entity or using the net from another country, how do we approach that, that accountability question?
Mr. ROBINSON. Well, the law enforcement agencies here will have to work closely with those countries that have those various websites that offer that service and we would have to see what their laws are in that particular country. Usually, regardless of what the laws are in that particular country, the person is going to misuse the information here in the States.
Mr. COLLINS. Okay. This thing becomes a real mountain as you start moving it, does it not?
Mr. ROBINSON. It does.
Mr. JOHNSON OF TEXAS. Would the gentleman yield?
Mr. COLLINS. I would be glad to, Mr. Johnson.
Mr. JOHNSON OF TEXAS. Following up on that question, if some country like Russia, for example, had somebody in there manipulating our system and providing fraudulent information and we do not have any arrangement with them, I bet, between law enforcement to take care of that problem, how do we address that?
Mr. HUSE. Actually, the Department of Justice and the Department of Treasury both have foreign operations in most of these countries now. In fact, my own son is one of the agents from the Secret Service that oversees doing this, teaching financial crimes investigations to these new former Soviet republics and countries where they do not know much about financial crime.
Mr. JOHNSON OF TEXAS. But they know how to mess with the Internet.
Mr. HUSE. And they are, but we actually have on-going efforts to bring up law enforcement in these countries to a level of cooperation that we have on other types of crime now through Interpol and other--
Mr. JOHNSON OF TEXAS. Have you run into any of that with other countries trying to manipulate our system?
Mr. HUSE. The NYPD, I am sure, can answer that better than we can.
Mr. FABOZZI. We have done investigations and what we do in the Computer Crime Squad is that we find where the host is, the computer where it is located that is actually hosting the site of the ID fraud or the novelty ID card, Social Security cards, and the host computer may be in the Soviet Union and that ends our investigation. We forward that to Interpol or another Federal agency.
Mr. JOHNSON OF TEXAS. Have you ever had any indication that the Chinese might be doing that?
Mr. FABOZZI. Not at this time.
Mr. JOHNSON OF TEXAS. Okay, thank you.
Chairman SHAW. Mr. Ryan?
Mr. RYAN. Thank you, Mr. Chairman.
Mr. Huse, I would like to ask you a couple of questions. You testified that legislation is needed to stop the ready availability of Social Security numbers over the Internet. I know we have been talking about last year's bill, 4857. Is there something else that you think is needed in this bill or are you pleased with the product from your perspective that came out of last year's Committee?
Mr. HUSE. I am very pleased with the product that came out last year. I think if we can get that, we are a long way to where we have to go.
Mr. RYAN. You also mentioned that you have a hotline up and running that you have had for several years. Have you noticed a marked increase in allegations involving identity theft and Social Security misuse?
Mr. HUSE. Well, each year since we have had the hotline up and running we have received more and more allegations. A little over half the allegations we receive have to do with Social Security number misuse and identity fraud and those have increased every single year.
Mr. RYAN. And that is in a steep incline?
Mr. HUSE. It is going up. It is going up.
Mr. RYAN. Also you stated that your office has conducted undercover operations where you have purchased actual counterfeit Social Security number cards. You state that you are currently involved in an investigation of an Internet auction company that is selling names and Social Security numbers. Can you tell me about how many individuals or different companies are in existence today that do this?
Mr. HUSE. We do not have exact figures. I do not think anybody does. They crop up like mushrooms overnight on your lawn.
Mr. RYAN. Pretty simple to get started?
Mr. HUSE. It is very simple to start a business on the Internet but we do not have exact figures.
Mr. RYAN. I wanted to ask the two officers, Detective Fabozzi and Detective Doyle, all of our Social Security numbers are out there. Nothing can be done immediately to protect against that. But what would you recommend to individuals and citizens that they can do to protect their identity at this time right now? Even if they take such steps, what are the chances we can stem identity theft aside from any type of legislation that would be passed?
Mr. DOYLE. The biggest thing would be awareness of how prevalent your number is out there and your Social Security number is the key that unlocks the ability to do a lot of this identity-type fraud.
The biggest problem we see with our victims is that helplessness when they discover they are a victim, how they have to try to repair their own credit. We try to make them aware of the FTC's website that has a lot of very good steps on how to repair their credit. All the phone numbers are on one website to make these fraud alerts, to get the credit-reporting agencies to put that alert on their accounts so that they are notified when a new account is opened up. But unfortunately, they are the last ones to know when these accounts are opened up because the bad guys are opening up good accounts using their good name so the accounts are going to be good until they run them into the ground.
So again people have to keep in mind their own credit reports, as Ms. Robinson pointed out. She looks at it every year. But from year to year, that is plenty of time for someone to run up credit report--
Mr. RYAN. So at this time it is really just reactive, is it not?
Mr. DOYLE. Yes, it is.
Mr. RYAN. Nothing one can really do proactively to prevent this from occurring.
Mr. FABOZZI. Proactively, one thing you can do is run your credit report annually, if not more. Second, be diligent as far as checking any bills that you receive in the mail and destroying them, shredding the bills and account numbers, name, address. I would not send mail out, like bills going out to different companies, in your mailbox. I would actually mail them myself at the post office because if you left them out with the flag up in front of your house, someone could come by and just take the mail out of your box and then they have your check number which has your banking information, maybe an account number, Social Security number.
Mr. RYAN. That is very interesting. Thank you. I yield, Mr. Chairman.
Chairman SHAW. Thank you.
In looking through the book that you all supplied to us there are some incredible things that can be bought--death certificates, marriage licenses. Now who wants more than one marriage license? I have no idea. But driver's license?
Do these documents appear to be accurate? If you are stopped by a policeman for a speeding violation in Florida and you have a fake Florida ID will you fool the Florida Highway Patrol?
Mr. DOYLE. Michael also had another case where this one group of individuals had very real-looking New York State driver's licenses including the magnetic code on the back and he will talk more about it.
Mr. FABOZZI. What they were able to do is first of all, create the magnetic stripe on the back of the driver's license. In New York State it has a high amount of security features in it, such as the color and the security features that are built into the United States currency. But what they were able to do is through using pickpockets and burglars and working in a group they actually stole the identity, meaning they stole the driver's license and then using computers they created a new driver's license using the exact number of the victim but substituting the photograph.
So let us say I would steal Sergeant Doyle's identification. I would put my picture on his driver's license but all the other information--account number, date of birth, address--is valid. So if they were stopped by police and I produced this license and even if the officer ran the driver's license through his computer, the number of the license would be valid and it would come back as James Doyle but it would just have my face on it.
Chairman SHAW. But his description. What if you are 6 foot and 3 inches and he is 5 foot and 4 inches? Would that come through like that?
Mr. FABOZZI. I am sorry, Mr. Chairman. I did not hear you.
Chairman SHAW. What if there was a great difference in your height and weight, description, color of hair, color of eyes, those types of things that are on a driver's license?
Mr. FABOZZI. That would be diligent upon the officer that pulled him over. Also, since it is a counterfeit document, you can alter that on the phony one but the records would come up legit on the print-out.
Chairman SHAW. I see that there are college diplomas. Are not some of these things now illegal? Is not issuing someone a driver's license illegal now?
Mr. FABOZZI. Yes. In New York State it is a forged document so if you are using it, let us say, to impersonate someone or even just to get a driver's license, it is possession of a forged instrument, which is a felony in New York State.
Chairman SHAW. Is it a felony to distribute these documents?
Mr. HUSE. They distribute them as novelty items.
Mr. FABOZZI. They skirt the issue by putting in a banner that this is for novelty purposes only.
Chairman SHAW. I see they have a marriage license as a novelty item, 180 some dollars. That is a hell of a joke. And college and high school diplomas, I see right here. I think probably other committees should really broaden our net here to see exactly what is going on and universities should be able to be protected and have their name protected under copyright or something so that there is a cause of action that can close these people down.
Mr. HUSE. Mr. Chairman, this has gone on for a long time. What makes it really critical that we act now is that the Internet takes us, because of the speed with the way these things are done, to an entirely different place.
When we just were dealing with paper and counterfeited documents, and trafficking in documents for false IDs has been as long as I have been in law enforcement--
Chairman SHAW. I know the green card has been--
Mr. HUSE. Exactly. The Congress has attempted to keep up with this through the years but what the Internet did or the electronic age is it takes us to an entirely different level of activity where it makes it so easy for people to change identities overnight and it is risk-free. Why would not criminals do this, where they can steal from you or me or anybody else without involving any personal risk?
And it is allowed because there is no way for us to know we have been victimized under the present system.
Chairman SHAW. Well, I think it is illegal to use this type of identification. Now we have to be sure that it is illegal to distribute it.
Mr. HUSE. Right. Our traditional approach has been to attack it after the fact.
Chairman SHAW. We need to go back to the wellhead.
Mr. HUSE. Right.
Chairman SHAW. Miss Robinson, you spoke of the purchase of a car in San Antonio. Did that occur after you alerted the credit-reporting agency of your identity theft or after her arrest? Where is the point in time that that happened? Do you know?
Ms. ROBINSON. Actually, from the beginning I had been in contact with the San Antonio police because when she went into the jewelry store in the San Antonio mall they did contact the police immediately and actually they contacted the police before they contacted me. So they were well aware that this was going on before I even knew about it.
Chairman SHAW. How did they know?
Ms. ROBINSON. Because when she came into the jewelry store on the second say to make purchases they ran my full credit report and noticed that I had a Maryland address, although she had provided a San Antonio address. They contacted their fraud department and they double-checked the information and when they double-checked it--because when she first came in they did an instant credit report and the only thing that came back was a credit score.
The second time she came in the next day, when they thought the activity was suspicious, they ran a full credit report and saw that my last reported address was in Maryland. So they decided that they would contact this Nicole Robinson in Maryland to make sure that it was a different person and because I was a different person, they contacted the San Antonio police. So they were well aware that this was going on.
Chairman SHAW. They went well beyond what most merchants would do. Most merchants would probably just shrug it off. So they are to be complimented. That is wonderful.
Ms. ROBINSON. Yes.
Chairman SHAW. And how about the insurance from GEICO?
Ms. ROBINSON. Well, when I contacted GEICO they agreed the day that I called them to remove my identifying information from this policy. Then they said they would contact her to have her provide a different Social Security number and no longer use mine on the policy.
Chairman SHAW. Mr. Moneme, you indicated there were only two pieces of identity that were stolen from you, credit card and your driver's license that had your Social Security number on it. What State is that?
Mr. MONEME. The State of Ohio.
Chairman SHAW. Are they still using Social Security numbers on driver's licenses?
Mr. MONEME. I believe so.
Chairman SHAW. I know Virginia did for a while but I think they have stopped that practice.
Mr. MONEME. I have a DC driver's license now and I had the option of selecting a unique number and I chose to do so.
Chairman SHAW. Kim just told me that it is optional in Ohio, also, so I assume you allowed them to use that number. Actually, you think it is a convenience until you start really thinking it through and then you say whoops.
Mr. MONEME. Right, that was my feeling.
Chairman SHAW. Do you feel that without your social security number that all of this would have been avoided, despite the fact that your wallet was stolen?
Mr. MONEME. I feel, sir, that was the only piece of information that had anything unique. On all the applications there were different addresses, there was a signature that did not match up to the one on my driver's license. That was the only piece of information that connected me to that incident.
Chairman SHAW. Mr. Huse--
Mr. HUSE. I just wanted to correct--
Chairman SHAW. You go ahead but then I have another question for you.
Mr. HUSE. Very good. The only thing I wanted to correct, Mr. Chairman, because it proves that we do try to make an effort here and Congress did pass a law last session, the Internet False ID Prevention Act of 2000, which makes it illegal for these novelty ID items to be sold but you can see from real-time today they are still out on the Internet and available. It is illegal to do that but that does not mean it is not done.
So, that piece has been dealt with in terms of the law. It is a criminal act to do that. But with the way the electronic world works, it is not a person. It is just a site and they move and they pop up all the time.
Chairman SHAW. Well, can you elaborate on that? We always hear we are concerned about people introducing viruses that get into computer programs. Is there any way we could backup a virus and blow it up?
Mr. HUSE. They do, but a lot of these are break-out operations that just go on for what they can--
Chairman SHAW. How do you get on the internet and whose service are these on? I mean they have to subscribe to a service somewhere.
Mr. DOYLE. What our unit does, we do a lot of these. If I have a website I want to put up I would just find a company that hosts websites, give them my web page, as you saw--
Chairman SHAW. Is it trackable to--
Mr. DOYLE. They are trackable if the right records are kept.
Chairman SHAW. Is it illegal? If I am one of these contractors that puts people websites up, could I be held criminally responsible for allowing this to go on?
Mr. DOYLE. It depends if you know what is on that website. Sometimes we have web-hosting companies that have no clue what is on their websites. They just have pages that are up-loaded from a remote location.
Chairman SHAW. Well, should we make sure that they have a clue?
Mr. DOYLE. That was one of our recommendations, Mr. Chairman, was to look at better record-keeping by these Internet service providers as to who has this website, where is it hosted? We looked at some websites up there about where these novelty items are being sold from and I can register a website and make it appear to be somewhere else. It is again the skills of detectives like Mike Fabozzi that you may be able to trace back where is that website hosted and maybe conduct an investigation into buying these items in an undercover capacity, say, and trying to find out the money trail.
But tracing these things back, again the skill of law enforcement has to get up to speed. Again there are very few detectives that could do what Mike does to find where is that website hosted, who is responsible for it. The records sometimes are not there.
Chairman SHAW. Mr. Huse?
Mr. HUSE. I think in my written testimony I mention an eBay case where someone was auctioning Social Security numbers. When we contacted eBay about that they asserted that they have no legal responsibility for what is put on their auction site. That is still the case.
Chairman SHAW. Well, maybe the Judiciary, Energy, and Commerce Committees should have a hearing on that. That is outside of our jurisdiction but I think it is something that really needs attention.
One last question and then we are going to have to go on. Where do they get all these numbers?
Mr. ROBINSON. Where do they get the Social Security numbers?
Chairman SHAW. Yes. I assume, Mr. Robinson, I assume from your testimony that you could obtain the Social Security number of anybody in this room that has one. And if that's the case, where did they get it?
Mr. ROBINSON. Most of the information that is provided by these sites is information not only from credit bureau headers but also from some publicly available documents, as well. What they do is there is a pool of information from these various sources and then they sell it to the public, anyone who would inquire for that information.
Chairman SHAW. But how can their information be so complete?
Mr. HUSE. All our lives we leave these markers as we negotiate loans, obtain loans, buy--
Chairman SHAW. Where is the clearinghouse for these markers? It seems like you have to go to so many sources in order to have a complete record that it would almost make it impractical to accumulate and put all this information into computers.
Mr. HUSE. The computers allow them to do it. Think of the credit applications you fill out for purchases of cars and so forth and homes. They are incredibly detailed. They give the story of your life and as this aggregates--a few years ago I had someone run my name in our office and the details were shocking. I mean they knew exactly in this database where I had lived throughout my life and who my neighbors were and what their income was. It is incredible. We have very little privacy left because of these databases. An amazing amount of information aggregates without our permission.
Chairman SHAW. Mr. Becerra has a follow-up.
Mr. BECERRA. Mr. Huse, we are not so much talking about the Social Security being misused. We are just talking about what you said before, a de facto national ID number that is being used, which happens to be the Social Security number.
Mr. HUSE. That is correct.
Mr. BECERRA. And what we are discussing here today under the rubric of the Social Security Administration's number is a national ID number and the fact that it is being abused and what happens when you have a universal system used to track your identity and information about you.
And if that is the case, this debate would take place whether or not we had a Social Security Administration and a Social Security number. It is the fact that that has become the de facto number that we are having this discussion but it would take place simply by the fact that we have now in a de facto world gone to the use of an identifier, a national identifier.
Mr. HUSE. Which is repugnant to most Americans.
Mr. BECERRA. Most people do not believe that or do not want to admit it but we have a national identifier.
Mr. HUSE. It has happened by accident and, to some extent, by intent but it has happened.
Mr. BECERRA. So, what we are discussing here is how we try to clean up the use of a national identifier?
Mr. HUSE. That is correct. And there are two approaches to this. The first is I think some of what we try to do or what you will try to do in your bill by allowing at least the number-holder to have some control over the migration of this information. I do not think that is unreasonable.
On the other hand, I think the Social Security Administration, because de facto, whether we like it or not, we control the issuance of these numbers. Although it was never intended to be a national identifier, we, and my office has recommended through its audit work that the Social Security number tighten up its process of enumerating people and they have made efforts to do that and those efforts continue, although more needs to be done.
I think the two pieces are about all we are really ever going to be able to do.
Mr. BECERRA. And how much of this that we are discussing today about the misuse of the number and the theft of identity has an impact on Social Security benefits themselves, what SSA is obligated to do? How much does this intrude on what you have to do in giving out benefits under Supplemental Security Income or Social Security retirement benefits? Are we into that area at all?
Mr. HUSE. Yes, we are. A lot of our fraud cases in Social Security are people who use bogus numbers or made up numbers or fake IDs. So there is a nexus there. It has a home with us at the OIG but also we have this unintended universal responsibility, too.
Mr. BECERRA. So one way or the other, whether this had become the national identifier or not, the Social Security Administration has to clean up the use of its own number for it own internal purposes because of the fraud committed within the Social Security Administration itself of people obtaining benefits fraudulently, et cetera.
Mr. HUSE. In our audit work--there are all kinds of issues here but in our audit work we have pointed out that Social Security's wage and earning information, which is critical to obtaining its benefits when those benefits come due, is flawed by the fact that it has a lot of this garbage number data in it. Our audit work has proved that and for lots of reasons, the underground economy and so forth, that exists. But, I suggest that if we ever go to individual accounts we will really need to have a better handle on enumeration. The two are inextricably linked.
Mr. BECERRA. Thank you. Thank you, Mr. Chairman.
Chairman SHAW. I want to thank this panel. You have certainly given us a lot of things to think about. The world is far more dangerous out there than I think any of us have imagined and I appreciate very much your coming and giving us your time.
[Questions submitted from Chairman Shaw to the panel, and their responses follow:]
Social Security Administration
Office of the Inspector General
Baltimore, Maryland 21235
July 20, 2001
The Honorable E. Clay Shaw, Jr.
Chairman, Subcommittee on
Committee on Ways and Means
House of Representatives
Washington, D.C. 20215
1. In your testimony, you indicated the need for further legislation to prohibit the sale of Social Security number information, limit the use of Social Security numbers, provide sanctions for violations, criminalize the sale and purchase of the Social Security number and expand the Civil Monetary Penalty authority under the Social Security Act to include misuse of the Social Security number. Do you believe the bipartisan legislation recently introduced by certain Members of this subcommittee, H.R. 2036, adequately addressed your concerns? Is there anything else you believe should be included?
H.R. 2036 goes a long way toward what I described in my testimony as "putting the SSN back in its box." Given my position as Inspector General of the Social Security Administration, my perspective on this issue is a conservative one. My mission is to protect the integrity of the SSN, so I naturally favor more legislation, tighter restrictions, and more limited uses. For example, the use of the SSN as an identification number by private institutions such as hospitals and colleges creates a risk that those numbers will be misappropriated and misused. The investigation I cited in my testimony involving the sale of SSNs through an Internet auction site resulted from the theft of names and numbers from a private college. While H.R. 2036 would provide a means of punishing the online vendor of these numbers, it would not address the compilation, use, and storage of this information by the college. Similar uses of the SSN abound, and while I am certainly aware that competing interests must be weighed in the preparation of legislation, my mission is such that I will always favor a more restrictive approach to SSN use. That said, I am very happy to see the restrictions that H.R. 2036 does provide. The limitations it imposes are long overdue and will provide my office and others in law enforcement with significant tools in combating SSN misuse and identity theft.
2. You mentioned in your testimony that you are currently involved with another Federal agency in an investigation involving an Internet auction site. You also stated that the sale of the Social Security numbers over the Internet should be made illegal. Do the provisions in H.R. 2036 adequately address this need in your view?
The gentlemen who attempted to sell hundreds of names and SSNs over the Internet did so without significant fear of criminal prosecution. H.R. 2036 provides the criminal, civil, and administrative sanctions we so badly need to deter people such as this, and to punish them when they remain undeterred.
3. You also indicated in your testimony that the sale of the Social Security number "through other means" should be outlawed. Could you elaborate as to what other means you are referring?
I was not referring to any other "means" in particular, but was merely seeking to avoid limiting my statement to Internet transactions. Not all theft of SSNs takes place in cyberspace. Legislation which prohibited only the sale of SSNs over the Internet would likely give rise to other "means" of making such transfers. For example, the sale of a CD-ROM containing thousands of names and SSNs and other personal information, if sold at a computer show or through an ad in a magazine, would not constitute an Internet transaction, but would be just as harmful.
4. You stated that the Federal government created the Social Security number and it is up to the Federal government to determine what are the appropriate and necessary uses of the Social Security number. How do you define appropriate and necessary uses?
As I stated above, my definition of "appropriate and necessary uses" would necessarily be skewed by my position as Inspector General of the Social Security Administration. For a Government official whose mission is to protect the integrity of the SSN to the greatest extent possible, the most logical answer for me to give would be that the only "appropriate and necessary" use would be for the administration of Social Security programs. Obviously, we are too far down the path to return to what was the SSN’s original intended use. The income tax system relies on the SSN, as does the military, the bankruptcy courts, and other Federal benefit programs. Even these uses create risks and contribute to identity theft. Other Congressionally-mandated uses, particularly in the realm of financial transactions, are what swung the door wide and placed the SSN in the hands of the private sector. De facto uses ranging from use of the SSN for identification numbers in schools and hospitals to customer numbers or employee identification numbers in countless corporations across the company opened the door to misuse even wider. I could go on and on. Which of these uses is appropriate and necessary is not for me to determine, any more than it is the decision of the credit bureaus who so heavily rely on the free flow of SSN information, or the county governments that use the SSN for everything from land records to water bills. In my testimony, I suggest that the time has come to make these difficult determinations. All who are affected should have their say, but if I were to step outside of my role as Inspector General and propose a standard, it would be this: an appropriate and necessary use of the SSN is one which primarily benefits the holder of the SSN, not the entity seeking to obtain, use, or transfer it, and which prohibits any further use or transfer of the SSN without the holder’s express consent.
5. From reading your’s and others’ testimony, it sounds like there are several powerful Federal agencies involved fighting identity theft. Is this too many or too few? How do they interact with the state and local agencies? Has that relationship helped to prevent crime or does it complicate enforcement?
I don’t think that there are either too many or too few agencies involved. Each has its own area of expertise that is critical to the task. For example, the Federal Trade Commission’s role is invaluable in that the FTC is in the business of imposing limitations on commerce and providing a remedy when those limitations are ignored. My office is intimately familiar with the issuance, use, and misuse of Social Security numbers in a wide variety of contexts, including identity theft. State and local agencies provide local knowledge and expertise, as well as much-needed resources and additional means of bringing violators to justice. To the extent that Identity Theft continues to grow, rather than being curtailed, I do not believe it is a problem with the agencies seeking to curtail it, or the relationships they enjoy. Rather, it is a matter of reducing the permissible uses of the SSN in the first instance, and then providing significant criminal, civil, and administrative sanctions for those who would exceed approved uses.
6. Preventing Social Security number identity theft in the Internet era is a monumental task. While the public has some appreciation of the problem, would you not agree that it is the lack of assistance and protection to bono fide victims that also erodes public confidence in their privacy?
Absolutely. The testimony of the two victims who appeared before the Subcommittee made that clear, as do the stories that we hear on a daily basis in the Office of the Inspector General.
7. You mentioned the number of potential allegations of Social Security number misuse violations as over 90,000 in 2000. With the Internet and other forms of telecommunications growing, can we realistically believe we can make a dent in identity fraud even with new laws on the books. Don’t we also need better protection of the consumer after the crime is committed, allowing victims to clear their records and making business a partner in stopping further fraud and getting records cleared?
I believe that better laws can make a significant difference. As I state above, the two keys to reducing identity theft are restricting the uses of the SSN as much as is reasonably possible, and then providing criminal, civil, and administrative sanctions to punish those who ignore those restrictions and deter others from doing so. We cannot eliminate identity theft, but we can make a significant dent. However, I agree with your statement that victims must be given a way to emerge from the identity theft nightmare and recover their good names, and this cannot be done without help from the private sector. The true impact of identity theft in the vast majority of cases is the devastation to an individual’s credit history. The businesses which write and control that history, and who enjoy a privileged position with respect to the use of the SSN, must be willing participants in a system that will reduce the impact of identity theft on the victims, even as we in government work to reduce the number of victims.
James G. Huse, Jr.
Inspector General of Social Security
New York City Police Department
New York, New York 10038
Reply to Congressional Subcommittee
1. We believe that the posting of Social Security numbers in "plain text" on the Internet is a potential danger to all of us. Criminals can use these search tools to find out other’s personal information. The posting that was referred to in the testimony can best be explained via example. Detective Fabozzi received a call from a complainant who stated that her identity had been stolen and personal information was posted on the Internet at a virtual school. A virtual school is one that provides classes and training via the Internet. The woman who called our office felt confident that the point of compromise was the virtual classroom. The perpetrator used an address and other identifiers that were only associated with information she did input into the system to register for the class. Upon investigating the NYPD Computer Crimes found that the school posted the student’s name, SS#, and credit card information in clear text on the school web page. We notified the school and explained the dangers of this type of posting and the school agreed to take down the web page posting this type of information. We believe that the searching for social security numbers should be limited to agencies that are searching for a "legitimate" purpose. The responsibility of deciding legitimacy is something left for elected officials. However, requests for credit information should be logged and notification should be made to the individual whose information was requested. By putting in these precautions, a victim of identity theft can see who is inquiring about their credit history and can quickly identify fraud. By logging these requests, it enables victims and law enforcement to identify a point of compromise. A point of compromise is a location that contains identifying information and the perpetrators use a vehicle to steal personal information. For example, a restaurant that has a corrupt employee that steals credit card information is considered a point of compromise; since the victim’s credit card numbers stolen all came from that one restaurant. We have investigated many cases where the point of compromise is a gas station, doctor’s office, banks and brokerage firms. The only way to limit these internal leaks is place passwords and logs on systems that contain such information and to conduct background checks on employees. In addition training corporations on the vulnerabilities of having this information readily available is a must.
2. We believe that steps should be taken to limit the printing of social security numbers on documents such as driver’s licenses. In NYS, SS#’s are not used as an identifier for licenses. By limiting the display of SS#’s you are limiting an avenue for fraud. SS#’s should never be posted on checks. If a fraudster has a check, which includes a SS#, he will have account information victim’s name and SS#. With that information an identity theft can occur.
3. When an identity theft victim comes to the NYPD for help, we give them the address, phone numbers of the three major credit bureaus. Additionally, we take a police report for criminal impersonation or grand larceny depending upon the circumstances and begin an investigation.
4. The credit bureaus control a vast amount of information on individuals and are te best agency suited to assist victims of identity theft. However, the credit bureaus must also be aware that people with credit problems may use the identity theft alibi to erase bad debt. Like all technology issues, it is a double sword.
5. According to the Federal Trade Commission and reports done by the Consumers Union and others, identity theft is the number one growing crime in America. Estimates have been made that in the US in 2000, there was estimates between 500,000 and 700,000 victims a year.
6. The problems associated with identity theft is the clearing up your good name. Vicims can be denied credit such as a loan or have to pay higher interest rate since their credit worthiness has been diminished. Other problems that we have seen is the looting of bank accounts by impersonating the victim with false identitfication. In 2000, Detective Fabozzi conduxcted a major invcestigation where individuals we stealing victim’s identitites and creating ficticious id cards and walked into local bank branches and withdrew money from the victim’s accounts. The loss to over 200 victims was over 1 Million dollars. One victim also was arrested using the victim’s mane date of birth and was given an arrest number belonging to the victim of identity theft. Others learn of the identity theft when a car is bought, or leased and used in a crime or an accident report.
7. Social engineering is just a trick or deceit of obtaining information from someone that has information that the impersonator wants. For example, a pickpocket in NYC will obtain the drivers license number, dob and address of a victims and call a bank, impersonate a customer and obtain account information. Obviously this is a security breach and should not be done. However, untrained customer service representatives may give out this information.
8. The encryption and secure socket layer is a secure transmission of information. However, the data is stored and is available once it reaches it’s destination. The data warehouses that contain the information may be vulnerable to hackers. A buffer overflow attack is a common means to obtain privleges that enable a hacker to steal information. A victim of identity theft usually assumes that his identity was stolen over the internet, but a majority of our investigations show that the point of compromise is usually an insider at a corporation that has be paid off.
[The attachment is being retained in Committee files.]
The next panel we have is Charles Bacarisse., who is the Harris County District Clerk in Houston, Texas. Cory Kravit, a student at the University of Florida in Gainesville, Florida and, I might say, a former intern in my office that has a very interesting story to tell about how he put to use some of the information that he learned while serving here in my congressional office. Evan Hendricks, who is the Editor and Publisher of Privacy Times. Charles Dugan, who is a partner with Covington and Burling on behalf of Financial Services Coordinating Council. Mark Rotenberg, who is the Executive Director, Electronic Privacy Information Center. Ronald Plesser, who is a partner in Piper, Marbury, Rudnick and Wolfe on behalf of the Individual Reference Service Group (IRSG). And Paula LeRoy, who is President of the Pension Benefit Information Services, Tiburon, California. Edward Mierzwinski, who is the Consumer Program Director of the United States Public Interest Research Group.
This is a very large panel. We appreciate your presence here. We have each of your full statements. They will be made a part of the record and I would invite each of you to summarize as you might be comfortable.
Mr. Bacarisse, I am starting with you, sir.
STATEMENT OF CHARLES BACARISSE, DISTRICT CLERK, HARRIS COUNTY COURT, HOUSTON, TEXAS
Mr. BACARISSE. Thank you, Mr. Chairman. It is a pleasure to be before you and your Committee this afternoon.
As the district clerk, the clerk of the courts, for the third largest county in the United States, we hold approximately 6 million Social Security numbers in our, our case files. They are there because, due to State statute, we are required to collect that information on divorce and family law cases primarily but also on some criminal cases, as well.
So you had asked a question earlier, where does this type of information reseller get this data? They get it, one source, from the courthouses all over the United States. We are in a sense an untapped mine resource for these information resellers. I get requests in our office practically on a monthly basis from some of these information resellers to package my data in a certain way and sell a copy to them on either computer tape. Some of the requests are to download it directly off the Internet to them.
We refuse those requests because they are too labor-intensive--that is our basis for refusing that request--and would require undue expense to local government to comply with that request. But that does not stop them or any other private citizen from walking into the courthouse door and requesting a copy of that final divorce decree or any other public document that is in our courthouse.
So I am sort of betwixt and between, if you will, in this very important issue. I am commanded by State law to acquire this information into our courthouse but then I am also commanded by State law to make this information publicly available. So clerks across the United States are in this same sort of position and it makes us quite uncomfortable, I might tell you.
Let me also just share another point with you, if I may, that I hope will resonate with the Committee as you consider your new legislation. We are generally local government. I speak here as a member of NACO, the National Association of Counties, and also as an elected official. I am sensitive to privacy and to the need to protect our customers' and our citizens' privacy. But there is also a huge cost that could be placed on local government to comply fully with some legislation that might be enacted or might be considered by the Congress.
Let me share with you some comments that my colleague, Mr. Michael Jeanes, who is the clerk of court in Maricopa County--that is Congressman Hayworth's home district--Michael sent some comments to me, as well, which I think are important to remember. He says, "We would only be able to protect the Social Security information contained within the existing court paper files by hiring a staff whose job would be to redact this information before allowing the public access to the file. In order to maintain our existing levels of public service we would require approximately 25 to 30 new staff and related clerk office accessories--space, equipment, and so forth--and the staff would be in place for the next 10 years. Salaries, benefits, space and equipment for at least 25 additional staffers for at least 10 years could run $1 million a year." My county is just a bit larger than Maricopa, but not much, and I would expect a similar financial impact.
To sum up, I would ask the Committee to consider carefully balancing the huge mandates that might be placed on local governments to comply with whatever the Congress believes needs to be done and I would hope that you would call on us and we would work closely with you and the Committee to construct legislation we can all live with and that could be enforced effectively at the local level. Thank you.
[The prepared statement of Mr. Bacarisse follows:]
Chairman SHAW. Thank you. Mr. Kravit?
STATEMENT OF CORY B. KRAVIT, CHAIRPERSON, STUDENT SENATE'S AD HOC COMMITTEE ON SOCIAL SECURITY PRIVACY, UNIVERSITY OF FLORIDA, GAINESVILLE, FLORIDA
Mr. KRAVIT. Good morning, Mr. Chairman and members of the Subcommittee. My name is Cory Kravit and I am currently a political science senior at the University of Florida. I am appearing before you today representing the University of Florida student body and specifically as the chairperson of the Student Senate's Ad Hoc Committee on Social Security Privacy. In addition, I have been appointed by the university provost to serve on the University of Florida Student ID Task Force.
I would like to thank you, Mr. Chairman, and the esteemed members of this Committee for conducting this hearing today on such a vitally important issue. As members of this Committee, you are intimately aware of how widespread the problem of identity theft through the misuse of individual Social Security numbers has become. The problems of identity theft are not only confined to the working members of our society. Identity theft has become an issue for the students of our nation's universities, as well.
Through the University of Florida Student Senate's Ad Hoc Committee on Social Security Privacy, we have worked very hard to protect the identities and privacy of the students of the University of Florida, as well as students enrolled at other universities throughout the State of Florida.
It has become painfully clear that due to the misuse of Social Security numbers, an increasingly large number of university students within the State of Florida and throughout this nation have had their identities stolen. In fact, in 1998 the local university police department arrested a desk clerk working for the Jennings Residence Hall located on the University of Florida campus after he stole the identities of 23 college students. The desk clerk was charged with mail theft and credit card fraud after illegally spending nearly $70,000 without the students' knowledge. According to the Gainesville Sun, Alachua County Sheriff's Detective Robert Gaff stated, "This kind of fraud happens all the time. It is just not always on this large scale."
In my testimony here today, I will endeavor to discuss the widespread use of Social Security numbers for identification purposes within the State University system and the State of Florida and more specifically at the University of Florida. In addition, it will be with a great sense of pride and accomplishment that I will provide the members of the Subcommittee with an update outlining our progress and efforts despite substantial economic and logistical barriers to change from a Social Security number-based identification system to a system that provides all students, staff and faculty with a more secure level of privacy and security.
In 1966 Social Security numbers were first used at the University of Florida as a primary form of student identification. Over the last 35 years hundreds of thousands of students have been required to use their Social Security number for nearly everything on campus. In the 1970s, the Florida Board of Regents mandated that all public universities within the State of Florida use the student's Social Security number as their student ID number. It is hard to imagine, but as a result of this mandate there are quite probably millions of students and alumni within the State of Florida and elsewhere that currently have their Social Security numbers unsecured and waiting to become a tool of unscrupulous identity theft practitioner.
It is the opinion of the University of Florida Ad Hoc Committee on Social Security Privacy that Social Security numbers should be used for only two purposes: financial aid application requirements and reports requested by States and Federal governmental agencies. Students at the University of Florida are required to provide their Social Security number for virtually everything ranging from registering for classes to ordering Little Caesar's pizza using one's student debit account.
For example, I have had to use my Social Security number to sign attendance sheets that are passed around the classroom, provide my Social Security number on exam grids and forms, purchase a parking decal to park on campus, qualify for student government elections and appointments, and one use that is most disturbing is that student Social Security numbers are routinely posted on grade sheets that are made public and become accessible via the Internet. The list goes on and on.
As a student preparing to enter my senior year I am currently in the process of applying to law schools and as part of this process my transcripts must be sent to the Law School Data Assembly Service who, by the way, require that my Social Security number be placed on every document sent to them.
Recently I took a summer class at Florida Atlantic University in my home town of Boca Raton. When paying for the transcripts to be sent back to the University of Florida the Florida Atlantic office staff specifically told me that I had to print my Social Security number on my check. Knowing what I do about identity theft, I cordially explained that I would prefer not to place my Social Security number on the check. I explained that a personal check with my account number and Social Security number printed on it was a con artist's dream and I would not allow myself to partake in such a risky practice. The university cashier grunted at me, rhetorically, I suppose, "Well, you do know this is your student ID number." She eventually accepted my check without my Social Security number printed on it. Hopefully, my transcripts will be sent without any flaws because I really do want to go to law school.
With everything that I have learned through my research into identity theft, I find that the scariest part of this equation is that students have become so accustomed to giving out their Social Security numbers, they instinctively offer it, even when it is not needed. Before I had had a chance to talk with the victims of identity theft I used to print my Social Security number on virtually all my term papers, reports and exams. Students just do not realize how unique and vulnerable their Social Security number is. I work part-time for the long distance telephone service on the University of Florida campus. My job brings me into contact with fellow students who come to pay their telephone bills. Not a day goes by that at least one student needs me to look up their account information and they ask me if I need their Social Security number. Of course, I explain to them the potential for disaster but unfortunately, many cannot understand the magnitude or the problem or perhaps they just do not care.
So you may ask, who has access to our Social Security numbers? The answer is alarming. Pretty much anybody who requests them. Just last week a friend of mine phoned me infuriated that his girlfriend's professor printed her entire class's full nine-digit Social Security number on the class's Internet website. This act, although done with no malice or ill intent, could possibly lead to identity theft of every student in that class. I am so highly concerned with this issue that I have printed a copy of the class website for the members of the Subcommittee to review. Yes, it is just that easy.
Con artists rarely need to put forth much effort. When you think about it, the Social Security number of each and every student is freely available to numerous individuals within the university. This list includes professors, teaching assistants, dormitory desk clerks, resident assistants, registrar staff, library staff, Little Caesar's Pizza employees, book store employees, mail carriers, and the general student body.
The bottom line is that students in this country are at an increased risk for identity theft due to the often unrestricted and free use of their Social Security numbers within our country's university system. The average student might not realize that he or she were a victim of identity theft because many students do not have credit cards and have never applied for a loan and have not checked their credit histories. Students could graduate and leave for their new jobs, only then realizing that their credit has been destroyed.
I have worked hard this past school year to recommend that the University of Florida administration abandon their current practice of using individual Social Security numbers as student identifiers. The university administration, despite the obvious economic and logistical barriers to such a change, has responded in a remarkable fashion. In January the university provost appointed representatives from all the major departments to the Student ID Task Force. I am currently a member of this task force and we are working to develop a state-of-the-art directory system that would only give those who absolutely need a student's Social Security number access to it. A random public ID number will be used for all other university transactions.
Although it may seem like a simple project, it is not. To revamp the database, at the University of Florida alone it has been compared to the Y2K project squared. New computer programs must be written, new forms will need to be printed and over 50,000 students, faculty and staff need to be advised of the new system once it is put in place.
Mr. Chairman and the esteemed members of the Committee, there are many schools and universities across the United States that are just like the universities within the Florida State University system. These schools continue to use their students' Social Security numbers as their primary student ID numbers. Unfortunately, Representative Doggett is not present here today. However, the University of Texas in his district happens to be one of these schools. A student reporter from the University of Texas recently wrote a week-long special report on identity theft and how students are severely affected. It is currently perfectly legal for universities in this nation to continue the practice of using a student's Social Security number as his or her student ID number. Many schools cannot afford to change their database systems even if they wanted to. I believe that the proactive efforts of your Subcommittee will have a great effect at exponentially reducing the risk of identity theft that is now associated with students attending the colleges and universities of this nation.
With my most sincere admiration and respect, thank you very much for your time.
[The prepared statement of Mr. Kravit follows:]
Chairman SHAW. Thank you. Mr. Hendricks?
STATEMENT OF EVAN HENDRICKS, EDITOR/PUBLISHER, PRIVACY TIMES
Mr. HENDRICKS. Thank you, Mr. Chairman and members of the Committee. Like most personal data, the Social Security numbers are not adequately protected by law and in order for the American people to have the legal protection they deserve there must be political leadership on the issue. Mr. Chairman, your continuous efforts to pass an SSN privacy bill are an example of the kind of leadership that will be necessary if Americans' right to privacy is to be effectively protected.
I am on the Social Security Administration's privacy advisory panel. I have also been qualified by the courts as an expert on identity theft. One thing we have seen in several cases is that the use of the Social Security number actually helps facilitate fraud because if the real person, the victim has the name of Myra Coleman and the imposter's name is Maria Gayton and she uses the same Social Security number, the algorithm actually allow the data to match and for the credit reports to be disclosed because there is enough similarities between Myra and Maria and Coleman and Gayton.
So, the Social Security number in some of these cases actually facilitates fraud, which is why I am here to urge you to enact a very strong bill with limited exceptions. There will be a concerted lobbying effort for exceptions to this bill; that can always be expected. But, if there are to be exceptions they should be narrowly drawn and if there is rulemaking, the bill should clearly state what the standards are to remove ambiguity for the agency rule-makers.
There is a myriad of reasons why this is a great place to start. One of the reasons is the Social Security number is an example of what went wrong with privacy. Slowly but surely the number was used for purposes other than what it was originally intended for. The promise that the Social Security card would not be used for identification turned out to be a lie to the American people. So this is an exercise in restoring trust and rebuilding trust with the American people, and should be part of a larger effort that needs to be made with the use of personal information and with privacy.
The problems with the Social Security number were recognized back in 1976 by a presidential study commission called the Privacy Protection Study Commission. My fellow panel member, Ron Plesser, was the general counsel of that commission. They did some excellent work. Though they did not at that time recommend restrictions on the SSN in the private sector, mainly because it was not being used that widely in the private sector, they saw a clear danger that a government record system such as that used by the SSA or the IRS could become a de facto central population register unless prevented by conscious policy decisions.
Unfortunately, there were not conscious policy decisions and what they feared is what has happened. They made several recommendations, including the establishment of a permanent privacy commissioner to monitor the issue. But, their recommendations probably seemed somewhat esoteric at the time when they talked about fears about privacy. Now we see that the fears are not esoteric because the failure to protect privacy is directly tied to the facilitation of fraud and identity theft is the fastest growing crime in the information age. This makes sense. As the detective said, it is a low risk, high pay-off crime.
Legislation is urgently needed to address this issue. We should ban the sale of Social Security numbers in the private sector to stop what we saw this morning. We should prohibit the sale and display of SSNs by Federal, State and local government agencies, the Department of Motor Vehicles (DMVs).
Another thing, we should take from the Privacy Act and place a duty on organizations. If they are going to collect Social Security numbers, particularly like life insurers and health insurers, then they have to take reasonable or appropriate steps to protect the security and privacy of that data. They cannot enjoy what they think are the benefits of collecting the SSN without assuming the responsibility for protecting it, and that standard could be lifted directly out of the Privacy Act.
Basically, in terms of solutions it is going to come down to purpose tests. Good purposes should be allowed; bad purposes should be prohibited. But the current situation where any purpose goes is clearly unacceptable, both for privacy and for fighting fraud.
The FTC's agreement with the Individual Reference Service Group (IRSG) companies in my view has turned out to be totally ineffective. I could answer more questions about that in the question period.
The other thing, and it is not in my prepared statement but I just found this out last night, that industry is already preparing for life after any law that would restrict the sale of credit headers by simply working harder to collect the information from the public records, making separate databases there. And so if you only prohibit credit header data they will create a new silo, housing the information from public records.
There are some important lessons from the last Congress. One is that there will be a concerted lobbying effort looking for exceptions. This is all the more important because we have had three excellent court decisions, one by the Federal appeals court here, one by the Federal district court and one by the State court in Washington State, saying that the Social Security number deserves protection and there is no First Amendment right to traffic in Social Security numbers without people's consent.
At the beginning of the statement I spoke of the importance of political leadership. Unfortunately, a second lesson from last Congress is that the House Republican leadership has emerged as one of the main obstacles to privacy legislation. Last year sources told me the leadership was unwilling to allow privacy bills such as the chairman's to advance to the House floor. The speaker, J. Dennis Hastert, has denied Americans need for stronger protections. They say we should not legislate new laws for the private sector until the Federal Government cleans up its own systems to safeguard our citizens' personal information.
Well, of course we should clean up the Federal Government but Americans want their privacy protected and they are not going to feel any better if it is being invaded by a private sector organization. Opinion poll after opinion poll show they want stronger protections. I can provide further information for the record.
The final comment I would like to say is that though you will hear loudly from the businesses that say privacy will negatively impact, there are a lot of forward-looking businesses that see privacy as integral to their business models. This includes the wireless communications industry and Microsoft's Hailstorm because they know that their business model depends on having consumer trust and being able to leverage personal information and using technology so it can serve individuals. So, privacy is actually a very pro-business issue now and increasingly recognized as one.
And the final point I would like to make is as high-level policymakers, members of Congress, should understand that there are tremendous savings from moving into the electronic realm. Paper is slow and expensive and it is driving up costs for our Federal agencies, for large businesses and for banks. And so by moving into the electronic realm we can have tremendous savings on the bottom line for our largest organizations. That simply will not happen unless we have privacy trust and that will require a privacy-first policy. Thank you very much.
[The prepared statement of Mr. Hendricks follows:]
Mr. COLLINS. [Presiding.] Thank you, Mr. Hendricks. I hated to use the gavel but I thought you might have a third final. Mr. Dugan?
STATEMENT OF JOHN C. DUGAN, PARTNER, COVINGTON & BURLING, ON BEHALF OF FINANCIAL SERVICES COORDINATING COUNCIL
Mr. DUGAN. Thank you, Mr. Chairman and members of the Subcommittee. My name is John Dugan. I am a partner with the law firm of Covington & Burling, and I am testifying today on behalf of the Financial Services Coordinating Council, or FSCC, whose members are the American Bankers Association, American Council of Life Insurers, American Insurance Association, Investment Company Institute and the Securities Industry Association.
The FSCC represents the largest and most diverse group of financial institutions in the country, consisting of thousands of large and small banks, insurance companies, investment companies and securities firms. Together, these financial institutions provide financial services to virtually every household in the United States.
The FSCC very much appreciates the opportunity to testify today. While we recognize that there have been misuses of Social Security numbers, we strongly urge that any legislation intended to address this problem be carefully targeted to specifically identify abuses, such as measures to stop identity theft. We believe it is imperative to avoid restrictions on legitimate and beneficial uses of Social Security numbers.
Let me summarize our written testimony by making three fundamental points. First, businesses' legitimate use of Social Security number as unique identifiers of individuals is now woven into the very fabric of commercial transactions throughout the country. Realizing the enormous value of a common, unique identifier, the Federal Government began the use of Social Security numbers for unrelated identification purposes nearly 60 years ago. It soon required businesses to do the same thing under certain Federal laws.
Businesses, including financial institutions, have followed the government's example and have used Social Security numbers as common identifiers in ways that have produced tremendous efficiencies and benefits for all Americans. For example, our nation's remarkably efficient credit-reporting system relies fundamentally on the Social Security number as a common identifier to compile disparate information from many different sources into a single, reliable credit report. And as set forth in detail in our written statement, the banking, insurance, and securities industries each uses Social Security numbers for a variety of important business transactions, primarily to ensure that the person with whom a financial institution is dealing really is that person.
Here is just a small sample of these uses. It is done to combat fraud and identity theft, to accurately assess underwriting risk, to identity money-laundering activities, to transfer assets to third parties, to comply with deadbeat dad laws, and to locate policyholders to pay insurance proceeds.
This, then, leads me to my second point. Because the use of Social Security numbers as unique identifiers is so integral to our economy, overly broad restrictions on their use could have serious unintended consequences. For example, Social Security numbers are critical for fraud detection. Financial institutions rely on information compiled through Social Security numbers to check for inconsistencies that may suggest the occurrence of fraud or identity theft. Any proposal that unduly restricted the use of Social Security numbers for these purposes would make it easier, not harder, for an individual's identity to be stolen. Similarly, an overly broad prohibition on the sale of Social Security numbers, however well intended, could be construed to restrict such activities as the sale of assets among financial institutions where the assets use Social Security numbers as the basis for account identification.
My third point is that there is no need to further restrict the use of Social Security numbers by financial institutions because of strong new protections imposed by the Gramm-Leach-Bliley Act that take effect on July 1. Each financial institution consumer will have the right to block a financial institution from selling or transferring his or her Social Security number to an unaffiliated third party or the general public. There are exceptions to this general rule for legitimate transfers of these numbers; for example, to protect against fraud. But, in that case the recipient of the number is prohibited from reusing or redisclosing that number for an unrelated purpose.
Thus, a financial institution consumer is protected with respect to a financial institution's transfer of Social Security numbers, yet legitimate and important uses of these numbers remain permissible. As a result, no additional restrictions on the use of Social Security numbers by financial institutions are warranted.
Thank you, Mr. Chairman. The FSCC welcomes the opportunity to participate in this debate, and we would be happy to work with you and others as discussions on this issue proceed.
[The prepared statement of Mr. Dugan follows:]
Mr. COLLINS. Thank you, Mr. Dugan. Mr. Rotenberg?
STATEMENT OF MARC ROTENBERG, EXECUTIVE DIRECTOR, ELECTRONIC PRIVACY INFORMATION CENTER, AND ADJUNCT PROFESSOR, GEORGETOWN UNIVERSITY LAW CENTER
Mr. ROTENBERG. Thank you very much, Mr. Chairman, and members of the Committee. I am both executive director of the Electronic Privacy Information Center and on the faculty at Georgetown Law Center where I have taught privacy law for the last 10 years. I have also participated in two of the leading Social Security number cases, and I would like to fill in a bit of the background on the legal history for this issue to give you some sense of Congress's authority to act to regulate the misuse of the Social Security number.
As Mr. Hendricks described earlier, an important report in 1973 on record keeping practices across both the Federal Government and the private sector recommended restrictions on the use of the SSN. One of the key recommendations of the report in 1973 was prohibiting the use of the Social Security number or any number represented as an SSN for promotional or commercial purposes.
Now in 1974 with the passage of the Privacy Act, Congress did not act on the recommendation to regulate the use of the SSN in the private sector. It did, however, regulate the use of the SSN by Federal agencies. And an important provision in the Privacy Act, Section 7, set out a series of safeguards in an effort to ensure that the SSN would not be too widely used by the Federal Government.
Now, as several of the witnesses have testified earlier, the use of the SSN has expanded significantly over the last 25 years but this has been particularly true in the financial services sector and that is what has given rise to growing concerns about identity theft.
I would like to say a few words about the cases that I participated in regarding the use of the SSN because I think they speak to the critical issue here and the privacy interest that underlies Congress's efforts to regulate in this area, as well as the court's recognition that it is appropriate to regulate in this area.
In 1992 I filed a brief in support of a registered voter in the State of Virginia, Mark Greidinger, who was asked to provide his Social Security number as a condition of his right to vote in that State. He objected to the fact that he was asked for his SSN because the State of Virginia at that time not only collected the SSN but they also published it in the voting roll, effectively a public record and making it freely available for others to use for whatever purposes they wished.
We argued that this was an unreasonable burden on the right to vote. The Fourth Circuit agreed and this is what they had to say: "Since the passage of the Privacy Act, an individual's concern over his SSN's confidentiality and misuse has become significantly more compelling. For example, armed with one's SSN an unscrupulous individual could obtain a person's welfare benefits or Social Security benefits, order new checks at a new address on that person's checking account, obtain credit cards or even obtain the person's paycheck. Succinctly stated, the harm that can be inflicted from the disclosure of an SSN to an unscrupulous individual is alarming and potentially financially ruinous." I think there was a great deal of prescience in this opinion from the court more than eight years ago.
In a second case testing whether a State could be required to disclose the Social Security number of a State employee under a State open record law where there was a strong presumption in favor of disclosure, the Ohio Supreme Court held that there were privacy limitations in the Constitution that weighed against disclosure of the SSN. The court said in that case, "We find today that the high potential for fraud and victimization caused by the unchecked release of city employee SSNs outweighs the minimal information about government processes gained through the release of the SSNs."
In both of these cases courts have made clear the importance of restricting the use of the Social Security number and drew particular attention to the potential financial consequences of the misuse of this information.
Now the question has been raised recently whether it is possible that the First Amendment limits the ability of Congress to legislate in this area. I think based on the two recent opinions in TransUnion versus FTC and in IRSG versus FTC, the courts have made clear that it is appropriate to legislate to protect privacy where there is a substantial interest in that outcome.
Finally, I would like to say just a few words about the form of the legislation that we think the Committee should adopt at this point in time. We think the best guiding principle is to try to limit the use of the Social Security number to those circumstances where use is explicitly authorized by law. So, for example, if an employer needs an SSN for tax reporting purposes or if a bank needs an SSN for the purpose of identifying an interest-bearing account, I do not think there could be any objection to the collection and use of SSNs in those circumstances.
But the types of open-ended uses, which I think were very well described by Mr. Kravit earlier, that students and consumers and many people today across America face for transactions totally unrelated to tax-reporting purposes, could quite appropriately be limited.
There are other recommendations in my statement for the Committee and I would be pleased to answer your questions.
[The prepared statement of Mr. Rotenberg follows:]
Mr. COLLINS. Thank you, sir. Mr. Plesser?
STATEMENT OF RONALD L. PLESSER, PARTNER, PIPER MARBURY RUDNICK & WOLFE LLP, AND COORDINATOR, INDIVIDUAL REFERENCE SERVICES GROUP
Mr. PLESSER. Thank you. My name is Ron Plesser and I will speak quickly. With me is Paula LeRoy, who is president of Pension Benefit Information Services from California and Mrs. LeRoy, I think, has some very interesting and important uses of Social Security numbers.
I would like to make several very quick points. I am the coordinator of the Individual Reference Services Group, which is a group of 14 companies that came together five years ago to try to create a self-regulatory environment with the approval of the Federal Trade Commission to limit some of the abuses of Social Security numbers and to put on industry some controls.
We think it has worked well but we have also supported legislation, particularly legislation that would prohibit the use of the Social Security number on the Net. Our rules prohibit the use of disclosure to the public and the kind of demonstrations we saw today were ones that would certainly have been outside and in violation of our rules and we would support legislation.
We think display should be limited to the public but it should allow for broad benefits to allow legitimate business uses. We can notice from the testimony this morning all of the awful cases of identity theft that we heard all had the word "theft" in it. All had theft of a gym bag, theft by a waiter, theft of somebody who worked in an HMO. I think we have to focus on what the real problems are, which are people actually stealing information, not legitimate business purposes.
I would like to go through very quickly, in addition to Mrs. LeRoy's example, it is used indeed for missing children. It is used for locating witnesses. The information is used by law enforcement when they want to identify people.
And I think I would like to make one final point, that the uses of lists of individuals with the names and addresses and Social Security numbers for business purposes allows identity theft to be decreased. If a bill prohibiting those uses are passed it would be my sense and I think I agree with my colleague here that identity theft would increase. I do not think there is very much question about that and I think that has to be looked at.
We look very much forward to working with the Committee on legitimate purposes and going forward and working with you on the legislative process.
[The prepared statement of Mr. Plesser follows:]
Mr. COLLINS. Ms. LeRoy?
STATEMENT OF PAULA LEROY, PRESIDENT, PENSION BENEFIT INFORMATION, TIBURON, CALIFORNIA
Ms. LEROY. Thank you. It is my pleasure to appear before the Subcommittee today as you examine privacy and Social Security numbers.
My name is Paula LeRoy. I am president of Pension Benefit Information, a company located in California. We provide a service that uses Social Security numbers to locate former employees and beneficiaries to ensure that they receive their retirement benefits. We represent approximately 2,500 to 3,000 of the largest pension plans and we locate former employees on behalf of these plan sponsors and benefit administrators.
Often our services are required by law, as in the case of the Pension Benefit Guaranty Corporation (PBGC) accepting assets for a terminating plan. You must use a locating service to try to find all the people first. More often, our services are used for companies and plans who need to do lump sum pay-outs to former employees. Every year we locate over 200,000 individuals who have benefits that they often leave behind and forget about. We locate them and the monetary value is several hundred million dollars returned to individuals.
To find these individuals we are given two pieces of information from the companies: the name and the Social Security number. The last known address does not work because generally the people are mobile. They leave a job and they move.
When we are given an SSN we search for a current address in one of the commercial databases. If we find several addresses for the individual we mail each address a letter explaining their benefits and what they have due to them and at that time they have the option to respond to our letter and ask for us to put them in touch once again with the employer.
One of the most serious difficulties we have is with women whose names change, so even a name given to us does not work because their names change through marriage.
Continued access to Social Security numbers is critical to this positive use. Searching with the Social Security number we have a success rate of 85 to 90 percent of the people found and put in touch with the employer. Without the Social Security number, the results are dramatically decreased and I fear as we go forward the results will be disastrous.
Any legislation that Congress passes on SSNs should take into account the positive uses, as I just explained, and allow for Social Security numbers to be purchased with addresses. Thank you. I appreciate your interest.
[The prepared statement of Ms. LeRoy follows:]
Mr. COLLINS. Thank you. Mr. Mierzwinski.
STATEMENT OF EDMUND MIERZWINSKI, CONSUMER PROGRAM DIRECTOR, U.S. PUBLIC INTEREST RESEARCH GROUP
Mr. MIERZWINSKI. Thank you, Congressman. My name is Ed Mierzwinski with the State Public Interest Research Groups (PIRGs) national office and we are pleased to join the Committee today to testify once again on the importance of enacting legislation to protect Social Security numbers from misuse.
U.S. PIRG and the State PIRGs believe that the widespread availability of the Social Security number contributes to identity theft, which is well documented as one of the nation's fastest growing white collar crimes. The 1999 and 2000 amendments to the Drivers Privacy Protection Act championed by Senator Shelby form an excellent basis for changing the previously misguided congressional strategy of carving out exceptions to Social Security number protection and instead working to close loopholes. We look forward to working with the Committee on developing additional protections.
We believe the two most important things that the Congress could do would be to extend a strong anti-coercion provision on private sector use of the Social Security number and to close the recently narrowed credit header loophole which allows secondary use of the Social Security number without consumer consent. The credit header loophole has helped lead to the proliferation of information broker websites that make it easy for identity thieves and stalkers to obtain Social Security numbers and the other bits and pieces of the consumer's identity used to build a fraudulent identity in the consumer's name.
Any legislation that you enact should be simple, should be based on fair information practices, and contain as few loopholes and exceptions as possible. It is also critical that any new legislation not preempt or roll back or weaken any of the existing privacy protections, including those recently upheld by the courts in the Gramm-Leach-Bliley law and of course including the new Shelby amendments.
U.S. PIRG concurs with the views of our colleagues today from the Electronic Privacy Information Center and Privacy Times. We believe that your legislation should be simple. Probably you should extend Section 7 of the Privacy Act to private uses of the SSN, extend it to the commercial sector. The anti-coercion provision in H.R. 4857 I think is a good step toward doing that.
The other important provision in last year's bill, H.R. 4857, was its provision taking the Social Security number out of credit headers and moving them into the body of credit reports. Those are two very important provisions.
I think the other thing that you need to do is to look at what the commercial sector has done over the years in using the Social Security number. They have used it as a crutch. It is really not as accurate as they say and, in fact, based on our statistics from reports published by the Public Interest Research Groups, reports by the Privacy Rights Clearinghouse and even reports by the Federal Trade Commission as mandated by the Identity Theft Act of 1998, and their data are all up on their website, identity theft is skyrocketing. It is a major problem.
I talk to consumers. I talk to victims. I got a phone call today from a victim. I talk to them all the time. I also know how easy it is to do exactly what the investigators did this morning with their computer demonstration. It is easy to use Social Security numbers and other information to commit identity theft and I submit to you that protecting the Social Security number with some technology-forcing provisions that forces the industry to switch to a more precise and accurate number and stop using the Social Security number will actually reduce identity theft.
Last year, as you may know, consumer and privacy groups ended up opposing the bill that came closest to passing, the Amy Boyer law. We believe that the Amy Boyer law, although named for the first known victim of an Internet stalker, contained too many loopholes that would have allowed information brokers, private detectives and others to slip through its nominal protections. And, of course, loopholes is not what we want in any final legislation. We did think that H.R. 4857 was a better basis for legislation and we hope the Committee will work to enact a bill somewhat similar to that.
In terms of fair information practices, my testimony goes into great detail on the report that was issued in 1973 that talks about the fair information practices and the need to protect the Social Security number, which may provide the Committee with guidance.
Throughout the lobbying on privacy and Social Security numbers and other privacy issues over the last several years in the Congress, and I want to commend the numerous Republican members at the rank and file level who have been leaders on privacy, by the way, although I share the concerns of Mr. Hendricks that the very top levels of the leadership have had a disappointing record on privacy--throughout this debate on not only Social Security numbers but on other issues, industry groups have sought to dumb down the fair information practices, which are actually quite detailed. They believe that notice is enough.
Notice is not enough. Nor is notice and choice when choice is limited to only an opt-out some of the time. Consumers need to control the use of their personal information on an expressed opt-in consent basis all the time, not an opt-out some of the time.
My testimony goes into detail on the credit header loophole and the two recent court cases upholding the right of the government to protect privacy. My testimony also discusses why the voluntary regulations of IRSG just plain and simple are not good enough. And my testimony also details the problem of identity theft. I would be happy to answer any of the Committee's questions. Thank you very much.
[The prepared statement of Mr. Mierzwinski follows:]
Mr. COLLINS. Thank you. Thank you all for your testimony. Mr. Becerra, any questions?
Mr. BECERRA. Mr. Chairman, thank you. Let me see if I can limit the number of questions I have here.
Let me ask Mr. Dugan and perhaps Mr. Plesser and Ms. LeRoy first if they can comment on based on the legislation from last year, what you would not want to see in the bill. What do you object to?
Mr. DUGAN. Mr. Becerra, we had several concerns that, for example, prohibitions on sales of information could sweep in things that are routinely done in business-to-business transactions that really do not raise of the kinds of concerns that we talked about this morning.
For example, it is critical for two financial institutions that are trying to transfer assets to each other to be able to use Social Security numbers. SSN's are often the only way that you can make sure that the right money is going from one financial institution to a totally unrelated financial institution, and I do not think there is anybody who thinks that is an illegitimate type of transaction. So when you talk about "sale," you have to be quite careful about what exactly it covers so that it does not unintentionally sweep in that kind of unintended use.
We are also concerned that the effort to restrict SSN use more generally would prohibit financial institutions from using it for the kinds of fraud detection purposes that they use it for now.
One point I think is worth making is to respond to the implicit suggestion that financial institutions somehow benefit from, or favor, identity theft. In fact, just the opposite is true. Financial Institutions absolutely oppose identity theft not only for the pain it causes customers, but also because it is extremely expensive. We, too, are very much in favor of measures that are very targeted to that identity theft and to prevent it. It is just that we also believe that there are real beneficial uses of Social Security numbers to detect identity theft and other benefits, as well.
Mr. BECERRA. Let me just make sure you are focusing on that because I do not want to run out of time and I do have several questions I want to ask.
Mr. Plesser and Ms. LeRoy, if you could add to that. And I know what some of the governmental concerns are and I think those are legitimate but in terms of the private sector, I am trying to figure out what it is that the private sector would object to with regard to last year's legislation.
Mr. PLESSER. Let me just echo those comments. I think the biggest concern we have now is the exemptions do not cover many of the positive purposes and uses that I think we have been discussing this morning. They would not allow what Mrs. LeRoy does. They do not allow finding a lawyer who identifies witnesses and takes their Social Security number because five years later they are going to need them to testify and people move. Twenty percent of America moves every year.
So, the question is we want to be able to find lost witnesses. We want to be able to provide information so that heirs can be located on wills. Perhaps a will was done 30 years before. I think there are a lot of positive uses in business, the business-to-business use.
We would support the restriction of the Social Security number from being displayed to the public. I think last year use was not restricted and we think that was positive but the purchase and sale--in order to use it, it has to be obtained.
So those are really the points we have talked to staff about. We have had very positive dialogue with staff and we continue to feel that that will be fruitful and we would like to work with the Committee on that.
Mr. BECERRA. Ms. LeRoy?
Ms. LEROY. May I say that every day we deal with people who we find and communicate to them that they have money coming to them from really a forgotten source. And while the flavor I hear is that the American public is outraged that people do have access to their Social Security numbers, this is not an issue we encounter. Out of 200,000 people per year perhaps five have an objection: Who gave you my Social Security number? How did you get it? And when we explain fully--
Mr. BECERRA. Let me have you focus because I am going to run out of time and I am just trying to find out what you object to in the legislation as it was proposed, if you are familiar with it, or the uses that were being prohibited through last year's legislation. I am trying to get a sense of what you do not want to see in it or maybe you want to tell me what you can see in it.
Ms. LEROY. What I would like to see is legitimate business practices.
Mr. BECERRA. Be exempted?
Ms. LEROY. Yes.
Mr. BECERRA. Which are those legitimate business practices that you would like to see exempted?
Ms. LEROY. I think when someone has an asset for a person, that the person having their Social Security number be utilized to find them, they are better off than they were before.
Mr. BECERRA. So assets. What else?
Ms. LEROY. Probably the greater good. I know the blood banks like to use that to find tissue donors and blood donors in emergencies.
Mr. BECERRA. Really what you are talking about is the need for some unique identifier for individuals to ensure that when you give this information or this financial asset or this greater good, this benefit to the individual, that you are giving it to the right person.
Ms. LEROY. Exactly.
Mr. BECERRA. And right now we use the Social Security number for that purpose of acting as the unique identifier but there is nothing that stops us from creating some other type of unique identifier, right? And the problem we have right now is the Social Security number was never created to be that unique identifier and it, of itself, is not the best or it can be a better and more integrated form of identification if the Social Security Administration had first and foremost meant it to be that. But it was never meant to be that, so it is an inefficient identification number to begin with. We have nothing else in place to use and it does cause problems and it puts it at the foot of the Federal Government to try to maintain that identifier.
Let me ask a question of you, Mr. Dugan, because you mentioned the transactions, verifying transactions and the sale of that information. One financial institution can provide the information to another financial institution so you can make sure the transfer of assets or the sale of assets or purchase can be done. Why does one business have to charge the other for that? Why can you not just provide it free?
Mr. DUGAN. I'm sorry?
Mr. BECERRA. Merrill Lynch sells information to somebody else.
Mr. DUGAN. Actually, what I was trying to get at is suppose you want to transfer your assets from Merrill Lynch to Solomon Smith Barney.
Mr. BECERRA. Okay, does Merrill Lynch charge Solomon Smith Barney?
Mr. DUGAN. No, but they have to have a way to make sure that the John Dugan who walks in in one place is the John Dugan in the other and there may be hundreds of John Dugans. And unfortunately or fortunately, depending on how you look at it, the one really common unique identifier we use with systems that are not closed systems is the Social Security number.
The other point I would just make is that financial institutions have a set of restrictions already in place under Gramm-Leach-Bliley that apply to Social Security numbers, and when SSN's are sold there are restrictions on their redisclosure and reuse. So, an exemption for financial institutions is something that we would want to see in any legislation that is enacted.
Mr. BECERRA. But other than something already written in Federal law, why should we allow the sale or purchase of a Social Security number?
Mr. DUGAN. It depends on--
Mr. BECERRA. Why should somebody make money off of the sale of a Social Security number, which is a number generated by the Federal Government for purposes of Social Security benefits?
Mr. DUGAN. If, for example, a consumer did not object to the sale to a service that was allowing people to track down pension benefits, there may be perfectly legitimate reasons for doing that. That is number one.
Number two, if you define "sale" too broadly you are going to sweep in things that you do not want to sweep in.
Mr. BECERRA. Well, why would a consumer want to allow his or her Social Security number to be told?
Mr. DUGAN. Well, what do you call it, for example, when your Social Security number is used in the process of creating a credit report where it is provided to a third party as part of a process to make sure that that person's credit is good? We have the most efficient credit system in the world and the reason why we do is because we have the most efficient sharing of information in the world.
Mr. BECERRA. So somebody is making money off of that identifier, being able to use that identifier.
Mr. DUGAN. And the consumer is benefiting because the cost of credit is much, much lower in this country than anyplace in the world.
Mr. BECERRA. So as we try to solve the issues of identity theft and the problems with correct identifiers and somebody fraudulently securing a Social Security number, the taxpayer pays for us to generate those numbers, correct the fraud, go after those who commit the fraud. A credit card company gets to charge anyone who wishes to get a credit report of an individual money for the use of that report or to disclose that report. Somehow we have to clean up the Social Security number and its use for that identification purpose but unless we charge the taxpayer, you all will not have an identifying number to use.
Mr. DUGAN. And that is our concern. We are worried about throwing the baby out with the bathwater. There are many things like what we talked about this morning where people are selling fake Social Security IDs. And, by the way, I think there are laws on the books that can be enforced to go after that sort of thing, which are real abuses that have to be addressed.
It seems to me it is a very different thing if in the way you address that kind of identity theft you end up-- not intending to--but you end up impairing things that produce real benefits to consumers. That is the problem.
Mr. BECERRA. And I would love Mr. Hendricks or Mr. Rotenberg or Mr. Mierzwinski to chime in but my difficulty is that we have to take care of this identity thing. We have to do something to address the fraud. We also want to make sure that whether it is public or private enterprise that there are opportunities to have some way to identify people as being who they claim to be.
There is nothing unique about the Social Security number other than it became a pretty universal number. So, I guess what we are trying to do is grapple with how we try to maintain the Social Security number for what it was intended to be used for and perhaps allow it to be used for things that were not at first contemplated.
And if Mr. Hendricks or Mr. Rotenberg have any comments or Mr. Mierzwinski, I would love to hear how you respond to those who are in the private sector or in government, as well, who say that we have no choice but to use these numbers in order to continue in business.
Mr. HENDRICKS. Social Security numbers are used in a wide variety of contexts and they are mandated by Congress to be used by banks.
Let me first say that I think legislation is necessary to stop the abuses that we have talked about, the kind of bill that came out of this Committee last year, because if you look at the websites selling the Social Security numbers, the IRSG companies very likely could be the sources of that information that these guys are selling. And the IRSG companies need to do an audit where they buy from these brokers and trace it back to find out the source of the information.
Mr. BECERRA. Stop right there.
So, Mr. Plesser, how do you respond to that?
Mr. PLESSER. First of all, I respond that they are not the source. The IRSG companies absolutely have not been the source of those records since 1977. When we make those searches on Dog pile and others we find it very difficult to find the information.
I had a reporter from the National Journal who told me that in making her search they had to go to 100 sites. They may be from old sites, from old information, but they are not coming from the credit-reporting agencies. We are pretty certain of that in terms of anything past 1997. It may be that prior to 1997 those databases are still around and people are using them. And I think a lot of those services probably are pretexting--there is a time delay in many of them. We do not know that they are really getting them from open-ended databases. Many of those sites at the bottom of them say we are a private investigator and then they will go ahead and do a pretext interview or a pretext call and get the Social Security number.
So, I think that the problem is a legitimate one but I do not think the causes or the source of the information was from the IRSG companies.
Mr. HENDRICKS. I think that Chairman Shaw asked the right question. Where are all these numbers coming from? They make them available in 15 to 30 seconds. They have to be available in automated systems.
It is ironic that these companies that specialize in audit investigation are not doing the most fundamental audit investigation to ensure that their databases are not being used for these purposes.
I think ultimately you are going to have to look at the Fair Credit Reporting Act as a model of what to do. You have to have a purpose test. The goal is the information collected for one purpose not be used for other purposes without people's consent.
One of the reasons is that when information is used outside of its context the way the Social Security number has been, then data integrity suffers, too. So when it was created for wage reporting and now it is used in the financial services, then the unintended consequence is that fraudsters realize this can be used to create fraud.
So, I think we have to start with the idea of basically a moratorium so there will be no more authorized uses, we look at specifying what purposes will be allowed through good public debate. And then pretty soon technology--Mr. Rotenberg can tell you that technology has some solutions for this. There are ways now of anonymizing information so it can only be seen behind fire walls, too, and in the future that could hold out some promise not to put the genie back in the bottle, but at least spank the genie.
Mr. ROTENBERG. I would just say that I think the problem with the misuse of the SSN are likely to accelerate. One of the very interesting things about the reporting of identity theft of which we were aware when we did the Greidinger case 10 years-ago was that the problem at that time was just emerging, there was not the easy on-line accessibility that you have today or the increasing use of the SSN across the private sector for a whole slew of unrelated purposes.
The SSN is literally the flypaper of the information age: You hold it out there and anything with the same number will start sticking to it. So we need to find a way, I think through legislation, to restrict its use as the de facto identifier.
It was never intended, as you said, for this purpose. The problem of having an exception that says legitimate business purpose, is that, any purpose presumably done in good faith could be a legitimate business purpose.
As to Mr. Dugan's concerns, I think one of the ways to resolve these is that where the transfer takes place with the SSN in the context of financial institutions that are required to link a tax identification number with an asset, no one would reasonably object that that tax identification number follows the asset as it moves between institutions. But that is really not the type of problem that has been described today. I think it is important that we focus on the real problem, which is the open-ended unrestricted use of the SSN, the real source of the identity theft problem.
Mr. MIERZWINSKI. Just very briefly, Congressman, I want to make the point that the financial industry's practices are just inadequate and unbelievably, the number of mistakes that they make in credit reporting leads not only to identity theft but many consumers, many of your constituents paying too much money for credit because of mistakes in their credit report causing their credit scores, their risk scores, to be lower than they should be and probably costing consumers billions of dollars.
As I think Mr. Hendricks pointed out earlier and the officers discussed earlier, you do not need to be the Russian mafia to commit identity theft. You can be an unemployed high school drop-out working as a--well, actually not unemployed--you can be a high school drop-out working as a busboy and you can type in the Social Security number of VIPs and have their credit transferred into your name. That is how easy it is.
If I know your Social Security number and I submit a credit application in your name at a new address, these systems are so poorly designed that I am going to get the credit in your name and that is unacceptable.
So we need to do more than just protect the Social Security number. I think we need to impose some higher standards on the credit reporting and the financial industry. Thank you.
Mr. BACARISSE. Congressman, may I take a moment just to remind the Committee--of course, you are well aware that there is in the government side on the child support area there is a key need for that data element to exist in order for the government to go after the $50 billion in unpaid child support that is out there in this country.
So, on the one hand, we have a certain segment of the population that is very interested in seeing the government perform better there at all levels. Thank you.
Mr. BECERRA. I get confused trying to just think about this or ask the question. Certainly we have to resolve this, Mr. Chairman. I think we do need to move forward with something. Obviously there are some legitimate uses of the number and there are some needs for the private and public sectors to continue to engage in their business but this is just going to get worse, as somebody just said.
I do not know what we do. Unless there can be some reconciliation between those who believe that the bill that we had last year was too restrictive and those who believe it does not go far enough, we will not go anywhere. I would just hope that we can come up with something because we do see too many cases like the two individuals who were here recently, earlier testifying about the abuses that occur.
I will yield back.
Mr. COLLINS. Thank you, Congressman.
It is a typical political problem. We have friends for it and friends who are against it and we are for our friends. The problem here is theft and the concern is punishing the good guys rather than those who commit the theft.
If not the Social Security number, what number? What would be used for an identifier? Anyone. What would be used? How would you identify people?
I see in part of the report here that prior to '76 there was a major credit card bureau that did not use this as an identifier. What did they use?
Mr. HENDRICKS. They just used names and addresses at that point and their databases were not as big. And what happened was that the Social Security number was just laying there. Mr. Rotenberg said it was like the flypaper. To me it was like a lamb chop and all these wolves are circling and it was just too convenient to use.
Right now even the credit reporting agencies can do searches based on name and address. They have different information fields that they can use. But now that they have incorporated the Social Security numbers into their system it is an integral part of their system. Congress has mandated its use by the banks. It is an integral part of the banking system and I do not see that changing any time soon.
But, I think we can stop newer uses from spreading. To answer your question, the technology allows information to be compiled, searched and merged without using a Social Security number. You have other fields, like name, address, zip code. So, the technology is getting better to be able to do it so that it does not need to rely on a Social Security number.
Mr. COLLINS. But I can find that in the local telephone directory, name and address.
Mr. HENDRICKS. Phone number?
Mr. COLLINS. Yes. Well, not the phone number. I can find a person's name. I mean I can go to the telephone directory and find the names. What is to keep me from using those names in a false way to commit a theft? What we are dealing with is a number.
Prior to '76 when they did not use the number, do we have any numbers, any data that indicates the number of fraud and abuse or theft that occurred in the financial world?
Mr. ROTENBERG. As I recall, Congressman, it was about 10 years ago that the Attorney General started reporting on the use of the SSN in credit card theft because it became increasingly a part of that type of commission of crime as it became more accessible, and this is in support of my point that I think the problem is likely to increase.
But, the other point I wanted to make is in response to your question about systems of identification. It is true, we have many systems of identification. You have an account number for your credit card, for your utility bill, for your telephone number. These account numbers are unique to the institutions, which create unique account numbers. They do not use the Social Security number because they are trying to establish some confidentiality in the relationship with you in the information that they have about you, the bills that they send to you. It is standard practice. And it is a good practice.
Mr. COLLINS. That is my point. How many cases of credit card abuse were there last year? Anyone know? How many credit cards were stolen and misused last year?
Mr. MIERZWINSKI. Two years ago I believe the General Accounting Office reported to this Committee that in its studies it found that one of the credit bureaus reported 500,000 calls a year pertaining to identity theft. I think about one third of those may have been people inquiring about finding out more information but I think most people think it is in the half-million range today.
The Federal Trade Commission's most recent statistics required by the new law say that their number of phone calls has increased from the end of 1999, 449 calls a week, to about 2,000 calls a week.
Mr. COLLINS. This is on credit card abuse?
Mr. MIERZWINSKI. This is on identity theft, Congressman.
Mr. COLLINS. I am talking about credit card--
Mr. MIERZWINSKI. You have to ask the industry for credit card data but our reports have found it very difficult to compile credit card data. The industry looks at a lot of it as proprietary and they calculate fraud differently, but I would ask the industry witnesses to provide you with that.
Mr. COLLINS. Does anyone have any idea how many credit card thefts there were last year?
Mr. HENDRICKS. On the one hand, the European Union said credit card fraud itself, not identity but credit card fraud itself was up 50 percent in the last year and they attribute some of that to growing on line and the fact that organized crime are getting into hacking and getting credit card numbers. Industry people have told me in the U.S.--
Mr. COLLINS. Fifty percent of what?
Mr. HENDRICKS. It was up 50 percent. I am sorry. I have to provide that for the record.
Mr. COLLINS. Mr. Dugan, do you have a number?
Mr. DUGAN. I was just going to say we will be happy to provide that for the record. I do not.
Mr. COLLINS. The point is that we had 95,000 reports of misuse of the Social Security number. How many reports of misuse of a credit card, stolen or whatever, occurred last year? It is a different number, different credit card numbers.
Mr. HENDRICKS. Yes. I am sorry; the credit card industry still says--the U.S. industry folks I spoke to said it is still a very small percentage, like 1 percent of their transactions or fewer is credit card fraud. But that is why one of the solutions that people are starting to look at is disposable credit card numbers so that the credit card numbers are only good for one transaction.
Mr. COLLINS. I had one of my credit cards stolen.
Well, we have 95,000 reports of misuse of the Social Security number and we have 200,000 reports of good use of the Social Security number. What do you think? Which outweighs what?
Mr. HENDRICKS. Well, the misuse of the Social Security number--you are citing the Social Security Administration's numbers. That is just calls to one hotline. The calls to the Federal Trade Commission, the misuse of Social Security numbers has to be running well toward a million right now if you include the police agencies in California, the Federal Trade Commission Clearinghouse, the Privacy Rights Clearinghouse, all the different places that are taking complaints. The numbers are much higher than 95,000.
Mr. COLLINS. Well, why would the inspector general report to this Committee in 95,000?
Mr. HENDRICKS. That is the ones going directly to him.
Mr. COLLINS. Directly to Social Security?
Mr. HENDRICKS. Yes.
Mr. COLLINS. And that is where it should be reported.
Mr. PLESSER. The 200,000 is just the one company.
Mr. COLLINS. Sir?
Mr. PLESSER. And the 200,000 is just the one company.
Mr. COLLINS. How many companies are there? You say you represent what, 14?
Mr. PLESSER. Fourteen companies.
Mr. COLLINS. How many other companies are there?
Mr. PLESSER. Excuse me?
Mr. COLLINS. How many other companies beyond the 14?
Mr. PLESSER. It would be hard to count. There are probably a lot of companies, smaller companies beyond. I do not think there is any fairly substantial companies in the reference services area that has not a member of the group. There are probably a lot of these fly-by-night guys who are up on the Web with illegal activities that certainly are not members of the IRSG.
Mr. COLLINS. These people on the websites, we all agree that is quite a problem. Where do they get that data? What is the easiest access for them to obtain their data?
Mr. PLESSER. My own view on that is that many of it, and I would be happy to have a dialogue with the investigator from the Social Security Administration, I think many of that, I think the time delay was not 15 to 30 seconds. I think the time delay they talked about was 15 minutes or 30 minutes and in most of the cases, many of the cases I am aware of, it takes 24 hours to get the response and I think a lot of that is individual--
Mr. COLLINS. That is not my question, though. My question is not how long it takes them to download, to transmit to you the information, but where do they get their information? This gentleman on the end down here.
Mr. BACARISSE. Congressman, if I may offer, I believe a lot of the courthouses, both Federal and State across this country, are the ultimate sort of origination point for this data. We sell, because these documents are public records, we sell--16,600 divorces were granted in Harris County. We sell 930,000 pages of data every year in our office and many of those pages contain sensitive information.
Now you would imagine that most of the people purchasing this data are parties to the suit and, in fact, they are. When you go to buy a house you have to prove that you were divorced, and so forth. The title company will ask you to present this final divorce decree. So, in many cases the people coming in to buy the document are the people themselves but not in every case. And we do not and cannot control who buys this information because it is technically public record.
So, you see, we are the origination point, I think, for some of this data.
Mr. HENDRICKS. And I think you have all asked the same question. One clearinghouse to start looking at is a company called Choice Point. They specialize in buying public records and putting them into electronic database form. And I think that if all of you got your Choice Point file, it would be a real eye-opener because they get public records from all across the country so they can put together rich files on people.
Mr. COLLINS. Mr. Chairman?
Chairman SHAW. Thank you, Mr. Collins.
I would like to ask Cory a question. I know you have been working with the State of Florida university system on getting these numbers eliminated and change the ID system. Will it require different numbers for in-coming admissions only or will it take changes to currently enrolled students? And what does Florida intend to do with all of the old records that have the numbers on them?
Mr. KRAVIT. Mr. Shaw, what we would like to do is obviously all the new in-coming students would get a new number and for the old records, they want to go back as far as they can and issue new numbers for them.
They are looking at instituting a state-of-the-art directory system that would have a hidden number that nobody would ever see, which would be linked to all the other numbers, like public numbers. There would be that one number that nobody ever sees, a public number, which as a student ID number or an alumni association number, and there would also be private numbers that only people who have designated access to, like your Social Security number, would be able to view.
Chairman SHAW. Thank you.
Mr. BACARISSE. You talked about the court files and the amount of information that you have to make. I imagine that in Florida, with the sunshine law, a reporter can come to a County Clerk's desk and go through his in file and look what is in there. I mean there is absolutely no privacy left at all in that situation.
But, when you have been requested to supply a document you talked about the large expense that would go into changing over to a new system. That is one of things we are going to have to worry about because we do have unfunded mandates. Now whether this would be considered a mandate or a prohibition, I guess we would leave to the lawyers to decide. But, it seems to me that in supplying a document, and I assume it is all on microfilm, that when you print the document out you could simply put a black marker through a Social Security number. So that would not be that overly burdensome. I assume that you could also change your procedures so that Social Security numbers would not appear on public documents henceforth and that would cost you zero. I cannot think of any expense connected with that.
What would be your recommendation going forward, assuming that one of the possibilities is not Federally funding every courthouse in the country to change over?
Mr. BACARISSE. Correct. At this point, Mr. Chairman, we have calculated the cost of redaction at about $8.07 per document. And when you consider that I have 6 million Social Security numbers in my database today, that is a cost I do not believe any local government could absorb.
Chairman SHAW. It is how much per document?
Mr. BACARISSE. Eight dollars per document. When you are talking about human staff time because you have to have--
Chairman SHAW. Is this because you have to go back and change the microfilm? I guess?
Mr. BACARISSE. You would either have to do that or we began in November of '98 digitally imaging all of our court minutes, which are the signed orders in civil courts. So, there is some technology available today that would enable you to redact sensitive information but here again it is labor. It is labor costs. You are paying someone to go in and do that work that they had not previously had to do. So, local governments will have to figure out a way in which to handle that additional burden.
We believe that if that is going to be the case that perhaps the best way to do it is just to say at the time that the document is publicly requested, that information is redacted. It would be a little easier for us to handle administratively than just to have us go back wholesale and do this.
Of course, we also, I believe the Congress should ask States to change their laws. We are mandated by State law. The bar is mandated in the family code at least 15 times, 15 different statutes within the family code, to get that information and place it in the document.
Chairman SHAW. Let me interrupt you right there. Are you required by Federal law to take the Social Security number and place it on the public document?
Mr. BACARISSE. I am required by State statute to do that.
Chairman SHAW. State statute?
Mr. BACARISSE. Yes, sir. The bar, actually.
Chairman SHAW. In a lot of instances the Federal law would not override State law but in this instance, in that the social security number is issued by the Federal Government, we can certainly legislate that the social security number is the property of the Federal Government and then from that point forward go back and dictate how it can or cannot be used.
Mr. BACARISSE. Yes, sir. As a matter of fact, in a case affecting a parent-child relationship, a divorce with children involved, the State family code says that the Social Security numbers of the two parties in the divorce, as well as all the children, be listed in the decree, in the document.
Chairman SHAW. Is that typical? It has been 20 years since I practiced law. Is that typical?
Mr. BACARISSE. I believe these statutes have been on the books in Texas for quite a while. These are not new statutes. So, it is unfortunate that the bar is being commanded to put this information in documents which they then file with our office, which are open records. In a sense, the bar is being placed in a ticklish position of potentially placing their clients' privacy at risk, possibly.
Chairman SHAW. I think we ought to probably poll the different States to find out exactly the ways under the various State laws the use of Social Security numbers are mandated.
Mr. BACARISSE. Sir, I think you would find that a fairly high number in different States and I think you would be quite surprised.
Chairman SHAW. Well, we ought to check that out. Thank you.
Mr. BACARISSE. Thank you, Mr. Chairman.
Chairman SHAW. Thank you, Mr. Collins.
Mr. COLLINS. One last question. Supposing--do you like that word? That is a good Southern word. Supposing we pass legislation to stop the use of it today, the Social Security number. What would you do with all of the existing data that is already out there for the purpose of misuse, all these websites? If I had one of those websites and I was intending to help somebody violate the law and commit a crime, I would just simply print them out, sell them on the black market.
Mr. BACARISSE. That is a good question, Congressman. I think that as somebody said earlier, the genie is already out of the bottle and I do not know how you are going to get that cleaned up but at least from this point forward we might have some measure of protection which is greater than we do today.
There is another website that was not shown today called Ancestry. com and they have over 65 million Social Security death records. I typed in the last name of Bacarisse and put State of Texas and there are all my dead relatives and their Social Security numbers and their last known address there.
So, it is not only the living; it is the dead that can have their identities stolen.
Mr. COLLINS. I think we have ourselves a real political problem, those of you for it and those of you against it. Thank you. It has been a very interesting hearing. I appreciate each one of you being here.
[Whereupon, at 1:00 p.m., the hearing was adjourned.]
[Questions submitted from Chairman Shaw to the panel, and their responses follow:]
Harris County District Clerk
Houston, Texas 77210-4651
July 18, 2001
The Hon. E. Clay Shaw, Jr., Chairman
Subcommittee on Social Security
B-316 Rayburn Office Building
Washington, D.C. 20515
Dear Chairman Shaw,
I was glad to testify before your Subcommittee on May 22 regarding the integrity of Social Security programs. Thank you for so carefully considering my recommendations and asking for more details.
You had five sets of questions. Here they are, with my answers:
1. You indicated that it would cost $8.07 to redact any Social Security numbers in a public document. You also indicated that you expect the overall financial impact to be similar to that of Maricopa County, AZ, whose Clerk of Court indicated he would have to hire an additional 25-30 staff and the cost could run $1 million per year. Is this additional cost based on redacting the number of pages your office certified last year, 930,000? Could you provide more detail as to why it would require that much additional staff?
The cost figure reflects our redacting the documents – usually 5-15 pages each – represented by those 930,000 pages and maintaining our current level of customer service. (Seldom does anyone wait more than an hour for a document from our office.)
Also, please note that the $8.07 cost of redaction per document estimate is based on the work’s being done by our lowest-paid clerk. Assuming those 930,000 pages are in documents averaging 10 pages, that would be 93,000 documents a year redacted at a cost of $8.07 each, or $750,510 a year in salaries alone. Benefits, equipment and space costs, etc. should be added to that.
Note how closely that figure matches the $1 million a year estimate, which was arrived at using a different method. (I took Maricopa County’s estimate of the number of personnel needed but used Harris County’s salary and benefits numbers.)
Also, Maricopa County has advised me that the staff it uses for redaction is paid $9-10 an hour (plus benefits), so its cost would be even higher than Harris County’s. Maricopa County stresses that its estimate of additional staff is very conservative and was based on only the work done at the main office, with the branch offices doing about 25 percent more.
2. The legislation introduced from this Subcommittee does not require the redaction of the Social Security numbers from documents if they are not provided to the general public. In addition, the redaction is prospective. Would this reduce the total cost you believe would be incurred?
No, it would not. We have "open courts" in this country, and that principle is vital. With few exceptions, ALL our documents may be provided to the general public. The estimate was based on the pages we already are providing the public.
Through 1998, according to the Social Security Administration, 391 million SSNs had been issued. Those SSNs are circulating now. Redacting only those Social Security numbers acquired after some future date would do little good, in my opinion.
3. You stated in your testimony that State and local governments want to work collaboratively and cooperatively with us to safeguard all our citizens' privacy. How do you suggest we "safeguard all our citizens' privacy"? What should we focus on?
Each person must be made aware that he/she has a primary responsibility for safeguarding his/her own privacy. Everyone must be educated about when and to whom confidential information should be provided and how to protect it. Shredders should be as common as televisions. Identity thieves should be pursued more enthusiastically. We must educate the public that a huge reason merchants want so much information is that they suffer so much from bad checks – and increase the penalties on people who write bad checks and make more effort to catch and prosecute them.
4. You mentioned that any laws must be effective and enforceable. What would be an enforceable law in your opinion? Is there any way, going into the future, that your operation could limit the use and access of SSNs in divorce and child support cases and still enforce the child support laws?
The current laws probably are enforceable but not very effective. Given the millions and millions of Social Security numbers floating around and available worldwide, no law will be very effective until almost all individuals decide they are going to take responsibility for protecting themselves. That won’t happen if the public is convinced that all it takes to protect privacy is for Congress to pass the right law. Again, the collection of Social Security numbers and many other personal identifiers is driven by the dishonesty of hot-check artists, people who default on loans, etc. A law could fund an educational campaign that points out how the actions of a relatively few dishonest and/or irresponsible people are threatening the privacy rights of all of us.
I do not believe it would be possible to enforce child support, divisions of pension benefits, community property divisions, etc. without something like a Social Security number that by law is connected to virtually all wages, interest and dividends paid to anyone and all taxes, license fees, etc. paid by anyone. If we did not have Social Security numbers, we would have to invent them!
5. You stated that each year Harris County sells about 930,000 certified pages from family law cases. Can you explain for what purpose? How are the purchasers using the information from these pages? Can they sell this information to others?
Former spouses must have certified copies of divorce decrees and other documents to obtain Social Security benefits, pension benefits, divisions in probate court, banks and home loans and some licenses (including a marriage license after you have been divorced). Also, two associations serving apartment owners and managers purchase lists of recent felony convictions. The lists show the Social Security numbers of some but not all the felons on those lists. Clearly, the purchasers can resell the information, but my staff does not know of anyone obtaining numbers simply to resell the numbers.
I hope these responses are helpful. If you need more information, do not hesitate to contact me.
Washington, DC 20009
July 19, 2001
The Honorable E. Clay Shaw
House Ways & Means Committee
Subcommittee On Social Security
U.S. House of Representatives
Dear Mr. Shaw:
Thank you for this opportunity to comment on the bill; unfortunately, other obligations and deadlines have significantly limited the amount of time I have available to work on this. But I hope I will be freer in the near future to help as your bill evolves.
Question 1 - In your testimony you listed 4 goals that Social Security number privacy legislation should achieve. As you know, members of this Subcommittee recently introduced H.R. 2036, bipartisan legislation restricting the sale and display of the Social Security number in the public and private sectors. I am interested in your thoughts as to the legislation.
First, does it accomplish these goals? For example, does it go far enough in restricting the sale and display of Social Security numbers by Federal, State and local governments? If not, what do you recommend?
Second, the legislation provides for a prohibition of an individual’s Social Security number from appearing on their driver’s license. Was this sufficient?
Third, it removes the Social Security number from the credit header and placed it in the credit report. Your comment?
Fourth, what standards should we set for all organizations that collect and maintain Social Security numbers?
1) HR 2036 substantially advances my stated goals of
However, it does not address my 4th goal, which is the standard your bill should include for any organizations that collect and/or maintain SSNs. The standard is straight from the U.S. Privacy Act. A private right of action should apply to violations of this standard, and to any section of the bill.
In addition to drivers licenses, all organizations, particularly universities, should be barred from displaying SSNs, like when they post students' grades, or on organizational ID cards, like student or employee ID.
As recommended by the Privacy Protection Study Commission (PPSC), the legislation should create an independent privacy oversight office, as oversight and enforcement will be needed. Moreover, the legislation must formally require that any future legislative proposals for expanding uses of SSNs be brought before the Subcommittee and its counterpart in the Senate.
Question 2 - You mentioned that the sale of Social Security numbers and the coercion of individuals to needlessly give their numbers should be banned, with few exceptions. What exceptions do you think would be appropriate and why? How are Social Security numbers protected in these exception cases?
2) I don't favor exceptions, though it is possible that some entities could come up with exceptions to which few people would disagree. I will consider exceptions as they are proposed.
Question 3 - In other testimony before the Subcommittee, the use of Social Security numbers for child support cases was highlighted. How do you deal with an issue like this where the welfare of the child may depend on the ability to find the father, and that rests with knowledge of his Social Security number? Is this a legitimate reason for government to use the Social Security number?
3) The Child Support system has been exempted from virtually every privacy rule, yet they continue to complain they still do not have enough tools. I assume they will be exempted from most SSN restrictions. They should still be responsible for protecting the security of the number, and guard against unauthorized use. Given the many exceptions they enjoy, I think the real problem is the nature and design of the child support system and some of the people who operate it.
Question 4 - In your testimony, you mentioned corporations that provide privacy protections for consumers such as the wireless communications industry. What are they doing to provide such protections?
4) The wireless industry sees privacy as integral to the success of M-Commerce, and therefore has petitioned the Federal Communications Commission for a strong, opt-in privacy standard for the use of consumer location data. Another important new development is the single-use or disposable credit card number which is only good for one transaction and therefore becomes worthless. American Express, MBNA and Discover offer disposable credit card numbers to online customers. A company called PrivaSys to which I consult is creating a plastic credit card with disposable number functionality.
Question 5 - Last session, Congress passed the Gramm-Leach-Bliley Act. What, if any, shortfalls, does it have in protecting Social Security numbers? Once begun, do you think consumers will feel confident these new protections in the financial sector are adequate?
5) For starters, Gramm-Leach-Bliley failed to put a strong enough duty on banks to safeguard SSNs, and to create a private right of action against banks that violated that duty. The negative public response to the GLB customer notice already has shown that GLB is wholly inadequate to protect consumer privacy. However, it a perverse sort of way it has advanced privacy by helping to educate consumers how poorly their financial privacy is protected.
Question 6 - Mr. Bacarisse stated in his testimony that Harris County and its taxpayers would bear a financial burden if they had to hire additional staff to redact the Social Security number from documents that they receive in their office. Are you concerned about the cost that will be borne by the taxpayers?
Do you have any suggestions for these governmental agencies in ways to handle the redaction of Social Security numbers?
6) It is not practical to require every court, State and/or local government to redact SSNs from every piece of paper that is publicly available. However, the legislation should basically override every rule that requires individuals' SSNs to provided as part of a record that will be publicly available. Second, create a process by which individuals can have their SSNs redacted from paper records, like people who have been through divorces, bankruptcies, etc. Third, if SSNs are stored electronically and are publicly available, then automated software programs could use "find and replace" functions to redact SSNs in a non-burdensome and low-cost way.
Question 7 - You stated that Social Security numbers were not widely used in the private sector prior in 1976. You stated that TRW (now Experian), a major credit bureau, did not use it as its main identifier for credit reports. Assuming that credit bureaus like TRW did not have difficulty identifying individuals in 1976, can you tell us why the Social Security number is so critical now?
7) Organizations claim the SSN is critical to identifying someone because so many of them are accustomed to using it. But the reality is that information technology allows many alternatives to SSNs, including PINs and passwords. A positive result of this legislation will be to wean organizations from their reliance on SSNs. This will not happen overnight, but will be an evolutionary process.
Question 8 - In their testimony, Mr. Dugan, Mr. Plesser and Ms. Leroy all mentioned the powerful consumer benefits to be derived from the use of an individual’s Social Security number as a common unique identifier. What is your response?
8) The Dugan/Plesser arguments about "powerful consumer benefits" because of the SSN are largely specious. These same "benefits" which they proclaim remain after this legislation puts the appropriate restrictions on their clients from exploiting SSNs without consumer consent. It simply a matter of adapting systems so they don't rely on SSNs. In the financial world, it's already mandated that banks use SSNs, so that won't change current practice.
Question 9 - Would you agree with Mr. Plesser’s testimony that the best means of preventing identity fraud is through use of personal identifying data like the Social Security number, often matched through individual reference services?
9) No, Mr. Plesser has it backwards. The credit reporting agencies' over-reliance on SSNs has facilitated fraud. Identity thieves know that as long as they have an innocent victim's SSN, the credit reporting agencies' systems will tolerate different first and last names, different addresses, even different States. Moreover, some of the IRSG group members do not provide one of the most fundamental anti-fraud solutions: easy consumer access to their own data.
I'd look forward to working with the subcommittee.
Financial Services Coordinating Council
Washington, DC 20004
1. The deterrence and prevention of fraud is an on-going effort of the financial services industry. Banks, insurance companies, and securities firms rely on information available from both public and private sources – with embedded social security numbers (SSN) to ensure correct identification – to check for inconsistencies that may suggest the occurrence of fraud or identity theft. Just as with any other crime in our society, best efforts will likely not be successful in eliminating every occurrence of a criminal activity. Elimination of financial fraud and abuse involving SSNs is our goal. While that is an ambitious goal, the financial services industry will use every tool available to us in order to limit such crimes as much as possible. The SSN is one of those tools, and it is one of the most valuable. [See my comments previously sent.] We are unable to comment on the specifics of this matter because we do not have enough facts concerning how this particular identity theft may have been perpetrated. However, financial institutions are required under section 501 of the Gramm-Leach-Bliley Act to implement policies and procedures that protect the security and confidentiality of customer information. Federal and state agencies have, or are in the process of, promulgating guidelines and regulations that financial institutions must follow to ensure that customer information is not misused by fraudsters. In this regard, the federal banking agencies recently issued advisory letters which specifically focused on the protection of customer information against identity theft. We believe that financial institutions are well along in the process of implementing systems and procedures that bolster their ability to prevent and detect identity theft perpetrated through the use of social security numbers or otherwise.
2. Financial institutions do not sell social security numbers except indirectly as incidental to normal business transactions, such as the sale of portfolio and securitization. The Gramm-Leach-Bliley Act (GLBA) and the federal and state laws and regulations which have been adopted to implement the GLBA already provide very specific rules and limits on the ability of financial institutions to disclose nonpublic personal information (NPI) -- including SSNs -- as well as to redisclose and reuse SSNs. As a result, additional restrictions on financial institutions’ disclosures of SSNs are unnecessary and would conflict with these existing laws.
More specifically, GLBA Section 502(c) provides that a nonaffiliated third party which receives NPI from a financial institution may not disclose such information to another nonaffiliated third party unless such disclosure would be lawful if made directly by the financial institution. Accordingly, an unrelated third party which receives a social security number from a financial institution is subject to the same rules to which the financial institution is subject in connection with any redisclosure of the social security number. The federal banking regulators and the state insurance regulators elaborate on this limitation in their respective rules to implement the GLBA. They provide very specific guidance with respect to the use and disclosure of NPI, including social security numbers, both by financial institutions and by nonaffiliated third parties which receive NPI from financial institutions. (GLBA Banking Regulators’ Rules Section___.11 and National Association of Insurance Commissioners (NAIC) Privacy of Consumer Financial and Health Information Regulation Section 12.)
In our testimony we expressed the concern that a prohibition on the direct or indirect sale of social security numbers could have the unintended consequence of being construed to apply to usual and customary business activities such as the sale of assets among financial institutions or the sale of financial institutions. Such a prohibition necessarily would be of grave concern to financial institutions. No inference should be drawn from our testimony that financial institutions sell social security numbers as free-standing commodities.
Finally, any restrictions on financial institutions’ use or disclosure of social security numbers beyond those already imposed under the GLBA and related federal and state laws and regulations are likely to have further unintended consequences and to impair financial institutions’ ability to combat fraud and identity theft and to provide customer service for the reasons set forth in our testimony.
3. Financial institutions use a variety of public records, including bankruptcy records and records involving real estate liens. They also use criminal and fraud detection databases, such as the National Fraud Center database, which are developed using public records. Access to information in public records, including social security numbers, is important to financial institutions’ efforts to uncover fraud and identity theft, to verify customers opening new accounts, to maintain internal security operations, and to make sound credit and other financial product determinations. It is also important for third parties such as credit bureaus to continue to have access to this information as well. Financial institutions rely upon these third parties to prevent and detect fraud and identity theft.
We believe that legislation to address identity theft should be carefully targeted to that particular problem and should avoid restrictions on normal and beneficial uses of social security numbers which actually serve to protect consumers against fraud and identity theft and which improve customer service. The type of fraudulent activity with which the Subcommittee is concerned does not arise from the aforementioned uses of public records. We are concerned that broad restrictions on the use of social security numbers could have the opposite effect from that intended by the Subcommittee and could result in making it easier for individuals’ identities to be stolen.
4. For the reasons stated above in response to question # 3, we believe that legislative efforts should be carefully targeted to address the specific fraudulent activity which is of concern and should avoid normal and beneficial uses of social security numbers.
5. We recognize that there are circumstances under which the use of social security numbers could be harmful. Identity theft associated with the misuse of social security numbers is a prime example. There are already some existing laws which address identity theft. Stealing someone’s identity is punishable by civil and criminal penalties under 18 U.S.C. § 1028 and the GLBA makes it a federal crime to obtain customer information of a financial institution through fraudulent or deceptive means (so-called "pretext calling). 15 U.S.C. §§ 6821 et seq. As noted above in our responses to questions #’s 3 and 4, we believe that legislation to restrict use of social security numbers should be carefully crafted to address the problems of identity theft not currently addressed in existing law.
6. As stated in our response to question #2, we believe that the GLBA and the federal and state laws and regulations adopted to implement the GLBA already impose comprehensive restrictions on financial institutions’ disclosure and reuse of social security numbers. These laws also address the circumstances under which a consumer must be given the opportunity to direct that his or her NPI, including a social security number, shall not be disclosed by a financial institution. Therefore, an additional requirement that financial institutions obtain consent prior to re-use or re-disclosure would not only give rise to a significant administrative problems and considerable expense, but would be in conflict with existing law governing financial institutions on the federal and state levels. Any restriction on access to social security numbers in public documents would give rise to the concerns addressed in our response to question # 3.
7. We believe that existing federal and state law and regulations adequately and appropriately govern financial institutions’ use and disclosure of social security numbers as expressed above and as stated in our testimony.
John C. Dugan
Partner, Covington & Burling
Individual Reference Services Group
July 19, 2001
Subsequent to the IRSG testimony, the IRSG has agreed not to further pursue its appeal challenging the FTC’s treatment of credit header information under the Gramm-Leach-Bliley Act. As a result, the IRSG is now facing a world of "regulated credit headers." Therefore, the IRSG is in the process of evaluating its self-regulatory program, which was developed to respond to a pre-GLB world.
The answers we are providing to you are based on the IRSG Principles as applied to date. To the extent that this self-regulatory approach changes, we will inform the subcommittee.
1. You indicated in your testimony that the Individual Reference Service Group’s (IRSG) principles focus on non-public information about an individual neither available to the general public nor obtained from a public record. Is it correct then to say that if the Social Security number you obtained from credit headers was obtained originally from public records, these principles would not apply?
No, this is not accurate. All information obtained from a credit header would be deemed subject to the IRSG Principles.
2. Not many people know of the IRSG industry and what it does. You indicated that your members are committed to educating the public about their database services. Shouldn’t they know what information you maintain and their access and rights to the use of that information? What steps have IRSG members taken to educate the public?
The IRSG has undertaken educational efforts to ensure that the public is aware of its self-regulatory Principles governing the dissemination and use of personal data. The IRSG Web site serves as the cornerstone of these education efforts. This site enables visitors to read the IRSG’s self-regulatory Principles, and provides links to each of the member companies’ privacy policies, which discuss the individual companies’ information practices. The member companies’ Web sites themselves also help educate the public about the commitment these companies have made to responsible information use. For example, ChoicePoint provides its users with IRSG FAQs. See <<http://www.dbtonline.com/irsg-faq.asp>> Similarly, Acxiom educates the public by informing consumers at its Web site "what every consumer should know" about its privacy. See <<www.acxiom.com/DisplayMain/0,1494,USA~en~777~938~0~0,00.html>>. In addition, several member companies, such as LexisNexis, produce educational brochures, targeted at both employees and members of the public, that explain the IRSG self-regulatory Principles. See attached Exhibit 1. Finally, the FTC Web site maintains various information about the IRSG.
3. You indicated in your testimony that you oppose legislation that would ban the purchase and sale of Social Security numbers by businesses that have legitimate business purposes to use the number. Could you elaborate on your objections? For example, what is a legitimate business purpose?
Any legislation that would restrict the use of SSNs to match records or allow retrieval of location information for an individual by searchers who already know that SSN would seriously undermine the broad range of important and socially beneficial activities by government, businesses and non-profit users that rely upon the use (but not display) of a known SSN obtained from a commercial database. For example, it would undermine: efforts to detect fraud and combat identity theft; child support enforcement; efforts to locate pension fund beneficiaries; and non-profit health services’ efforts to locate blood, bone marrow, and organ donors.
Legitimate business purposes also include: the facilitation of credit checks or background checks of employees, prospective employees, and volunteers; the retrieval of information from, or by other businesses, commercial enterprises, governmental agencies or private non-profit organizations; and identifying or locating individuals or verifying their identities, as well as verifying the accuracy of information identifying individuals. These purposes should not include the provision of SSNs on the Internet to the general public.
4. You testified about the uses of individual reference information. What role does the Social Security number play in obtaining this information? Is there no other way for your group to obtain the same information?
SSNs are used in our industry as a glue to ensure the accuracy of information as well as to ensure that information is attributed to the correct individual. Although there are other ways to match information, our experience indicates that SSNs are the best tool for indexing and organizing data accurately.
5. You stated that restricting the use of the Social Security number to indexing and verification would result in more rather than less identity theft. What studies do you have to support this?
This statement is based upon our members’ experiences in furnishing anti-theft products to their clients. Our members’ databases are used by department stores, banks, insurance companies, utility companies and governmental entities to detect and stop identity theft. Without SSNs, our members’ experience has been that it is more difficult to detect perpetrators of fraud who use another’s identity to illegally obtain products, services, or money.
6. You indicated that if a company receiving information from one of your members did not comply with the principles for resale, they risked losing access to the data. Have any companies been found to be in non-compliance so that their access to members’ data has been cut off? How would that work? If I am found to be in non-compliance with one member, would all members of the IRSG be prohibited from supplying me data? How could I correct my non-compliance?
The IRSG Principles were designed so that no IRSG suppliers would give information to companies in contravention to the Principles. That is, the signatories to these Principles require by contract that all companies buying non-public data from them for resale abide by the Principles then in effect. That has been the dominant practice. Any signatory company may be responsible under existing federal and state law on deceptive practices if the company fails to live up to these Principles. In addition, every IRSG member company is subject to an annual outside assurance review by qualified independent professionals. Information is provided only to IRSG member companies that successfully complete the annual assurance review.
7. You indicated that each member undergoes independent assurance reviews. Are copies of the reviews provided to the Federal Trade Commission? If not, what do you provide the Federal Trade Commission regarding the results of these independent reviews?
Each company is required to submit to the IRSG coordinator a copy of the letter it has received from an independent assessor certifying compliance with the Principles. We do not have back-up documentation of the assurance reviews, other than the letter indicating successful compliance. We have attached to this document examples of assurance letters. See attached Exhibit 2. We post, on an annual basis, a statement indicating successful completion of assurance reviews, and the names of the independent assessors that performed the assurances. See << www.irsg.org/html/irsg_assessment_letters--2000.htm>> for 2000 assessment letters. In addition, the criteria used for the assessments are posted on the IRSG Web site and the fact that these criteria are publicly available is referenced in the assessment letter.
8. You mentioned that companies that buy information from your members must sign a contract requiring them to abide by your principles. Who monitors compliance with the principles among your members’ customers?
The procedures vary from company to company, but compliance is monitored through the annual audit.
9. You stated that if your members’ customers don't comply with your principles, they risk losing access to the data they need. Isn’t there a financial incentive for your members to overlook violations of the group’s principles, since they would lose a customer and lose profits?
IRSG member companies may be responsible under existing federal and state law on deceptive practices if the company fails to live up to the IRSG Principles then in effect. Both the FTC and state AGs have authority to prosecute such violations.
10. Recently an article appeared in the Washington Post detailing how individuals would provide false information to on-line data brokers in order to obtain personal data. How do your member companies prevent somebody from purchasing personal data for illegal purposes? In other words, how do your member companies determine what is a legitimate request?
Principle V of the IRSG Principles sets forth the criteria for distribution of non-public information. The nature of non-public information being requested and the intended uses of such information determine what access a subscriber has to information. Companies that offer non-public information without restriction of its contents only provide such information to qualified subscribers who satisfy the requisite conditions. Member companies undertake extensive screening processes to pre-qualify users of these products. Such measures include positive proof of identification, site visits by account representatives or independent verification of customers’ name and affiliation. Companies also have guidelines for acceptable uses of information. Where a new use is contemplated, the new use is reviewed to determine whether this use comports with the Principles.
11. Do you have any statistics that support your assertion that reference services reduce credit card identity fraud?
No. We do, however, have anecdotal evidence from law enforcement and our members’ customers that supports this assertion.
Ronald L. Plesser
Pension Benefit Information
Tiburon, California 94920
July 24, 2001
Honorable E. Clay Shaw, Jr.
Chairman of the Subcommittee
On Social Security
House of Representatives
Washington, DC 20515
RE: Testimony before Subcommittee
On May 22, 2001 – Identity Theft issues
It was a privilege to testify before your Subcommittee and it is very gratifying to know that someone is listening. Thank you for this opportunity to respond to the questions you pose regarding privacy and Social Security Numbers.
1. Regarding the information we obtain from pension plans: When we receive information from a pension fund administrator or plan sponsor, our written policy is to only utilize the information for the purposes for which the data was collected. In other words, we pledge to do the job our client expects, and at no time do we re-disclose the information. We share no information outside of the client relationship.
We do keep the information we collect in our system, because over time, we receive numerous calls from participants who want to update their address for a second or third time. In effect, we become an "update" agent for people who were once lost, and want to stay "found". The information we store is available only to privileged users in the company with proper passwords, and every record entered or altered is encoded with the users name/date/time. Records cannot be printed from data entry screens.
2. Each day in our business we are keenly aware of the importance of an individual’s Social Security Number. It is a very vital pointer to an individual, and it is unique in that it points to only one person. I believe strongly that there should be restrictions on the use of the SSN, and it should be predicated upon the intent of the user, and oversight might be an important key. By way of example, let me explain our relationship with the IRS. We presently utilize the IRS letter-forwarding service, for the difficult cases we encounter--people that cannot be found any other way. We submit a letter to the IRS and pay a fee to have the IRS forward the letter to the person who owns the SSN that we submit for the search.
Corporate Headquarters l P.O. Box 111 l 1110 Mar West l Tiburon, CA 94920 l 415- 435-9611 l FAX 415-435-2400
The IRS uses the utmost care in investigating the users of this service, and each user must pass the litmus test: the location of the individual must be for the benefit of the individual. We have been utilizing this IRS program for over 11 years, month in and month out. This opportunity to use the IRS resources to locate people is available to our company because we pass the test of legitimacy—a test administered by the IRS. I am suggesting that the personal data be restricted, and that users be bonded, submit documentation on procedures, subject themselves to outside audit if necessary, and bear the burden of proving the need to know. Legitimate business can pass these tests.
Restrictions on usage of personal data, I believe, should be governed by the opportunity for personal benefit for the individual. In the case of restoring pension benefits to an individual, I believe that the personal benefit is real and tangible, because at one time the individual chose to enter the plan. By making a conscious choice to participate in the plan certainly underscores the benefits. This logic can be used with bank and brokerage accounts, insurance policies, and other such vehicles of personal benefit as well. For the record, may I also include class action lawsuits. We have been involved with searching for beneficiaries of class actions, and the benefits are obvious.
Lately, many millions of dollars have been spent in creating and disseminating privacy notices to individuals. These have largely been thrown away and ignored, because the public does not generally perceive the banks and insurance companies as the agents of privacy breaches. Perhaps they contribute to the "junk mail" we all receive, but not identity theft. The legitimate exchange of data that was effectively stopped in its tracks by the FTC interpretation of Title V under the recent GLB Act was not the source of harm to the greater public. The real danger has been the proliferation of the heretofore unregulated internet, and its data collection and dissemination ethics. There have always been scam artists, pickpockets, and savvy schemers that could invade a person’s private life, but now the internet has made their criminal endeavors a lot easier, and more removed from the light of day. Additionally, the manner in which credit is extended to the wrong individuals is shocking. Surely there must be some checks and balances before a person can receive a new credit card with a stolen identity? We all receive multiple offers each week for yet another ***must have*** credit card. I believe the credit grantors are not suffering enough pain to stop this cycle, and that once they tighten up the credit-granting process, at their own expense, theft identity will begin to diminish, and thieves will move on to more lucrative avenues. As long as a criminal can open up several credit accounts, wrestle into bank accounts, and juggle multiple identities, identity theft will continue and flourish, despite the new privacy laws.
Whatever the punishment might be for misusing an individual’s SSN, it has not been a deterrent to date, and I feel it has become even easier to commit such crimes, via the internet. Credit scam factories, versus individual small-time thieves present different problems, and I feel it is the responsibility of the criminal justice system to provide adequate investigation and punishment. Certainly restitution to the parties harmed must be enacted, and credit grantors must step up to the plate if they have allowed "easy credit" to criminals.
3. Regarding prior consent for using an SSN to look for a person, may I say that YES, this could be one way in which to operate our business. An employer could, at hiring date, or entry into the pension plan, require a release from each individual. And then file the release away somewhere, in case it is needed. And then, better be able to find it on the day the person comes up missing. (What about all the millions of people that have not signed a consent form at this time, and are missing now—or may turn up to be missing later?) Because of a crackdown on the criminal uses of SSNs, the burden of privacy will now move to employers and employee benefit programs. Not only will the employers/plan sponsors have the task of proper enrollment forms, vesting requirements, investment protocols, plan document construction, notification procedures, ERISA requirements, DOL reporting requirements --you see my point here? The benefits industry presently operates under so much legal pressure, that it will be construed as burdensome to put yet another set of documents under their purvey. And, like all other aspects of business, benefits departments are moving to a paperless environment. For a company like General Motors, this would involve more than 300,000 pieces of paper. How do you file them? Where do you keep them? Do they stay in Detroit, or do they go out to the various operating plants? What if they sell a division? Where do the forms go now? How do you find all the forms for the division being sold?
I think, as stated above, that it is IMPLIED in the relationship of plan sponsor/participant that an individual who enrolls in a pension plan would likewise want to receive the benefits covered under the plan. Why should they have to "opt-in" for a concept that is clearly understood? If an SSN must be utilized in the process of hiring a person, paying a person, withholding taxes from a person, filing tax documents, and providing health care and retirement benefits, then so be it. There are surely numerous justifications for utilizing an SSN. Note here that under the GLB, one of the exemptions is for "employers" use. When queried, the FTC informed me that this was for hiring individuals, and doing a background check as part of pre-employment investigations. Ask any man-on-the-street if he would rather have his employer use his SSN for an investigation into his personal credit history, or for returning vested pension benefits!
4. After approximately 13 years of locating individuals, there is no better resource than the SSN for searching purposes. Names are never constants. My own uncle legally changed his first name (after Grandma died) because he hated it. Women change from maiden name to married name, back to maiden name. Nicknames are used all the time, so Anthony becomes Tony to all who know him. Worse, birth dates are the most confusing pointers we see as far as information for searching. Pension plans often capture only mm/yy for actuarial purposes, and if the full mm/dd/yy is collected, it is not always entered correctly into the system. When we cannot find a match, is it the month that is wrong? Or is it the year? For John Johnson, one might find 1,000 men with that name, all born in March, 1945. To eliminate the use of SSN as an identifier performs a disservice to the pension plans as well. If you wanted to return $10,000 of pension benefits to someone, wouldn’t it be prudent to make sure you have the right John Johnson? John Johnson with the right name and date of birth could be the absolute wrong person unless the SSN is utilized.
5. Regarding the restriction of commercial databases, I do not believe that the culprit is the commercial data base industry (or information services, to use another name). What they have is valuable, vital information, which must be treated with care. There are legitimate, beneficial purposes to have access to the information in these databases. Because criminals use information that is either obtained from or coincidentally resides in these databases does not warrant a complete shutdown of the process. I very vividly recall the testimony before the Committee from the two poor souls whose identity was stolen: they were first victims of theft. Someone had stolen a gym bag with a wallet in it, and another person snooped into a medical file and lifted information. The tragedy is that the two thieves were able to obtain credit with the stolen identities. How can this be? What about mother’s maiden name? What about previous two addresses? What about the city of birth? These kinds of questions can easily be answered by the REAL person, and a would-be thief would have a tough time with the same questions. I am suggesting that credit is a privilege that requires authentication beyond the measures that are presently in place.
Lastly, regarding a move away from Social Security Numbers, I truly believe that matching on other personal items will cause more confusion and lead to more problems, because of the reasons I presented earlier; names and birth dates are not unique. SSNs paired with names are unique, and provide the best data. The data needs protection and oversight.
At PBI, my company, we want to do the best job we can in locating people who have pension benefits left with a former employer. We need accurate data from the pension plan, and likewise, accurate and reliable data to guide us in our search.
Thank you for this chance to respond. I would eagerly welcome the opportunity to continue a dialogue on these troublesome issues, and the future legislation that can best serve and protect your constituents at the same time. Legitimate business to business relationships must be preserved for the greater benefit of all, and these same businesses should be included in the solution.
U.S. Public Interest Research Group
Washington, DC 20003
July 20, 2001
The Honorable Clay Shaw
Chairman, Subcommittee on Social Security
U.S. House of Representatives
Washington, DC 20515
RE: Additional questions to witnesses on HR 2036
Dear Mr. Chairman,
Thank you for the opportunity to testify on Social Security Number misuse. Please note that I concur in full with any more detailed comments of my colleagues, Marc Rotenberg of EPIC and Evan Hendricks of Privacy Times. I do not repeat your questions below, but answer them in the order requested in your letter to me:
Question 1: In their testimony, Mr. Dugan, Mr. Plesser and Ms. Leroy all mentioned the powerful consumer benefits to be derived from the use of an individual’s Social Security number as a common unique identifier. What is your response?
I disagree with the statement by witnesses Dugan, Plesser and Leroy that powerful consumer benefits accrue from using SSNs as supposedly unique identifiers. In fact, the sloppy use of SSNs by financial institutions and consumer reporting agencies (along with the ease of obtaining these numbers) has paradoxically led both to credit denials due to mistakes in credit reports (where SSNs do not provide enough of a match for consumers to keep their credit reports accurate) and also to the growing problem of identity theft (where the ease of availability of SSNs makes it easy for thieves to obtain credit in others’ names). As I point out below in my answer to Question 6, numerous flawed practices by both credit repositories and creditors lead to identity theft and inaccuracies in credit reports.
Question 2: You strongly support enactment of overarching privacy legislation applicable to all business. You also recommend the extension of a strong anti-coercion credit header loophole. As you are aware, we recently introduced H.R. 2036, a comprehensive bill aimed at restricting access by the general public to the Social Security number in both the public and private sectors. I would appreciate your views as to what parts of the legislation you support and where you think we need to modify the legislation?
While U.S. privacy legislation has responded to needs as risks have been identified, the growing convergence of industry sectors suggests that one law applicable to all transactions, if strong enough, may be a useful solution. Until we can pass such an over-arching law, which is a politically complex endeavor, we should continue to attempt to pass positive laws that are achievable in the current political context. I believe that your bill, HR 2036, has many positive attributes. Of the current SSN protection proposals, it has two extremely laudable provisions that are not matched in any other SSN bills: its strong anti-coercion provision and its credit header loophole provision (of course, Rep. Kleckza, an original co-sponsor of HR 2036, does have a separate, broader credit header bill that includes further restrictions, but these measures are outside the subcommittee’s jurisdiction).
HR 2036 could be improved by narrowing its exceptions, as EPIC points out in detail in its responses. I concur with EPIC. In addition, the bill could be dramatically strengthened and improved by adding a private right of action for data subjects.
Question 3: You stated in your testimony that you support technology forcing time limits on private uses of Social Security numbers so that firms are forced to develop more accurate alternatives that do enable secondary use of Social Security numbers and potential theft. Can you expound on this?
My point in recommending technology-forcing time limits is simple. If the committee, in its wisdom, retains exceptions to the general ban on the use of SSNs in the private sector, for example, it should not make those exceptions permanent. The only way to wean industry from its over-reliance on the SSN is to set sunsets on its uses (or, what I called in my testimony, "technology-forcing time limits"). By "technology-forcing," I am not suggesting that the committee need develop any technical language or technical solutions. All the committee needs to do is set a reasonably-short sunset or deadline on further uses of SSNs, if it is reluctant to, for example, immediately ban private uses on passage. Industries would then be forced to finally develop their own technologies to solve the problem of working without SSNs.
Question 4: You stated in your testimony that you oppose the use of Social Security numbers as student identification or health record identifier. You suggested these uses should be phased-out with the enactment of trigger-based, sunset regulation prohibiting the use of Social Security numbers in the private sector. Can you elaborate on this?
Your goal should be to put the SSN genie back in the bottle. Again, if you face political pressure to grant exceptions to your general rule that the use of SSNs as health, college or other identifiers is allowed in your final bill, you should force industry to develop more accurate identifiers that do not invade privacy or violate the original uses of the SSN. Motor vehicle departments have demonstrated that alternatives to SSNs can be developed easily. There is no reason not to expect schools and hospitals to do the same. The use of the SSN in health-related situations is especially problematic, since the misuse of the SSN acts as a key for significant privacy invasions.
Question 5: You stated that you have used pretexts to prove how easy it is to get personal information. Can you elaborate on what pretexts you used and what information you got?
My use of pretexts has been on the Internet, on behalf of reporters, with the permission of the data subject. We have routinely visited information broker sites and used the pretext that the data subject "owed me money" to convince the broker that we met its so-called "standards" to obtain SSNs. We then used the SSN to obtain credit in the data subject’s name and commit identity theft. Of course, high school dropouts can also do this, as other witnesses pointed out at the hearing, suggesting strongly that SSNs need to be taken out of circulation. The ease of obtaining SSNs, of course, is only part of the problem. As I point out in my answer to Question 6, poor practices by creditors and credit bureau repositories then abet the problem.
Question 6: Would you agree with Mr. Plesser’s testimony that the best means of preventing identity fraud is through use of personal identifying data like the Social Security number, often matched through individual reference services?
I disagree with Mr. Plesser that individual reference services using SSNs will somehow prevent identity theft. The three national credit reporting bureaus (founders and members of the IRSG, at least until recently) have used SSNs for years as an identifier: the result has been more errors and more identity theft. See PIRG’s full platform to prevent identity theft at http://www.pirg.org/calpirg/consumer/privacy/idtheft2000/ . Taking SSNs out of credit headers and out of circulation, as the District Court’s decision upholding the Gramm-Leach-Bliley rules does in IRSG and Trans Union vs. FTC (District of the District of Columbia, 30 April 01) is the better way to prevent identity theft.
Thank you again for the opportunity to testify before the committee. We look forward to working with you on final passage of your important legislation to protect Social Security Numbers.
Consumer Program Director
[Submissions for the record follow:]
Conference of State Court Administrators, Arlington, VA, David K. Byers, statement
National Conference of State Legislatures, Hon. Brian Flaherty, letter
National Council of Investigation and Security Services, Inc., Bruce Hulme, statement
National Council on Teacher Retirement, Arlington, VA, Cynthia L. Moore, statement
Paul, Hon. Ron, a Representative in Congress from the State of Texas, statement