Through a process known as  “enumeration,” unique numbers are created for every person as a work  and retirement benefit record for the Social Security program. Lawfully admitted noncitizens may also qualify for a SSN for  nonwork purposes when a federal, state, or local law requires a SSN to  obtain a particular welfare benefit or service. As such, SSNs are often the identifier of choice among  individuals seeking to create false identities. Public and Private Sector Uses and Display of SSNs

As we reported to you last year, federal, state, and county government  agencies use SSNs. Certain records maintained by federal, state, and county courts  are also routinely made available to the public. Although public records have traditionally been housed in government  offices and court buildings, to improve customer service, some state and  local government entities are considering placing more public records on  the Internet. In our current work, we found that some private sector entities also rely  extensively on the SSN. Some of  these entities have come to rely on the SSN as an identifier to accumulate  information about individuals, which helps them determine the identity of  an individual for purposes such as employment screening, credit  information, and criminal histories. This is particularly true of entities,  known as information resellers, who amass personal information,  including SSNs. CRAs are also large private sector users of SSNs. These entities often rely  on SSNs, as well as individuals’ names and addresses to build and maintain  credit histories. These laws limit the disclosure of information by these entities to  specific circumstances. The extensive public and private sector uses of SSNs and availability of  public records and other information, especially via the Internet, has  allowed individuals’ personal information to be aggregated into multiple  databases or centralized locations. SSA Has a Role in Preventing SSNs from Being Used to Create False Identities but Some Areas Remain Vulnerable

Because SSA is the issuer and custodian of SSN data, SSA has a unique  role in helping to prevent the proliferation of false identities. Following the  events of September 11, 2001, SSA began taking steps to increase  management attention on enumeration and formed a task force to address  weaknesses in the enumeration process. We found that fewer than half the states have used SSA’s service and the  extent to which they regularly use the service varies widely. Factors such  as costs, problems with system reliability, and state priorities have  affected states’ use of SSA’s verification service. We also identified a key  weakness in the service that exposes some states to inadvertently issuing  licenses to individuals using the SSNs of deceased individuals. SSA’s Enumeration Process Helps Prevent the Proliferation of False Identities, but Additional Actions are Needed to Safeguard the Issuance of SSNs

SSA has increased document verifications and developed new initiatives to  prevent the inappropriate assignment of SSNs to noncitizens who  represent the bulk of all initial SSNs issued by SSA’s 1,333 field offices. SSA has increased  document verifications by requiring independent verification of the  documents and immigration status of all noncitizen applicants with the  issuing agency—namely DHS and the Department of State (State  Department) prior to issuing the SSN. In addition to the assignment of SSNs to children under the age of one,  SSA’s policy for replacing Social Security cards also increases the  potential for misuse of SSNs. SSA’s Verification of Driver License Applicants Helps Prevent Fraudulent Documents, but Vulnerabilities Still Exist

The events of September 11, 2001, focused attention on the importance of  identifying people who use false identity information or documents,  particularly in the driver licensing process. Conclusions

The use of SSNs by both public and private sector entities is likely to  continue given that it is used as the key identifier by most of these entities  and there is currently no other widely accepted alternative. To the extent that personal information is aggregated in  public and private sector databases, it becomes vulnerable to misuse. SSA has made substantial progress in protecting the integrity of the SSN  by requiring that the immigration and work status of every non-citizen  applicant be verified before an SSN is issued.
Why GAO Did This Study

In 1936, the Social Security Administration (SSA) established the Social Security Number (SSN) to track worker's earnings for social security benefit purposes. However, the SSN is also used for a myriad of non-Social Security purposes. Today, the SSN is used, in part, as a verification tool for services such as child support collection, law enforcement enhancements, and issuing credit to individuals. Although these uses of SSNs are beneficial to the public, SSNs are also a key piece of information in creating false identities. Moreover, the aggregation of personal information, such as SSNs, in large corporate databases, as well as the public display of SSNs in various public records, may provide criminals the opportunity to commit identity crimes. SSA, the originator of the SSN, is responsible for ensuring SSN integrity and verifying the authenticity of identification documents used to obtain SSNs. Although Congress has passed a number of laws to protect an individual's privacy, the continued use and reliance on SSNs by private and public sector entities and the potential for misuse underscores the importance of identifying areas that can be strengthened. Accordingly, this testimony focuses on describing (1) public and private sector use and display of SSNs, and (2) SSA's role in preventing the proliferation of false identities.

What GAO Found

Public and some private sector entities rely extensively on SSNs. We reported last year that federal, state and county government agencies rely on the SSN to manage records, verify eligibility of benefit applicants, and collect outstanding debt. SSNs are also displayed on a number of public record documents that are routinely made available to the public. To improve customer service, some state and local government entities are considering placing more public records on the Internet. In addition, some private sector entities have come to rely on the SSN as an identifier, using it and other information to accumulate information about individuals. This is particularly true of entities that amass public and private data, including SSNs, for resale. Certain laws have helped to restrict the use of SSN and other information by these private sector entities to specific purposes. However, as a result of the increased use and availability of SSN information and other data, more and more personal information is being centralized into various corporate and public databases. Because SSNs are often the identifier of choice among individuals seeking to create false identities, to the extent that personal information is aggregated in public and private sector databases it becomes vulnerable to misuse. As the agency responsible for issuing SSNs and maintaining the earnings records for millions of SSN holders, SSA plays a unique role in helping to prevent the proliferation of false identities. Following the events of September 11, 2001, SSA formed a task force to address weaknesses in the enumeration process and developed major new initiatives to prevent the inappropriate assignment of SSNs to non-citizens, who represent the bulk of new SSNs issued by SSA's 1,333 field offices. SSA now requires field staff to verify the identity information and immigration status of all non-citizen applicants with the Department of Homeland Security (DHS), prior to issuing an SSN. However, other areas remain vulnerable and could be targeted by those seeking fraudulent SSNs. These include SSA's process for assigning social security numbers for children under age one and issuing replacement social security cards. SSA also provides a service to states to verify the SSNs of driver license applicants. Fewer than half the states have used SSA's service and the extent to which they regularly use it varies. Factors such as cost, problems with system reliability, and state priorities and policies affect states' use SSA's service. We also identified a weakness in SSA's verification service that exposes some states to fraud by those using the SSNs of deceased persons.