Require Agencies to Review Use of SSNs. However, these actions have had limited success. OPM published a draft  regulation to limit federal collection, use, and display of SSNs but  withdrew the proposed rule because no alternate federal employee  identifier was available that would provide the same utility as SSNs. Agencies Reported Reducing Their Use and Display of SSNs and Cited Ongoing Challenges; Moreover, Poor Planning and Ineffective Monitoring Have Limited Their Efforts

In their responses to our questionnaire on SSN reduction efforts, the 24  CFO Act agencies reported successfully curtailing the collection, use, and  display of SSNs, thereby reducing individuals’ exposure to the risk of  identity theft. Moreover, poor planning by many of the 24 agencies and ineffective  oversight by OMB have limited SSN reduction efforts. Three key challenges were frequently cited: (1) statutes  and regulations that mandate the collection of SSNs, (2) requirements for  using SSNs in interactions with other federal and external entities, and (3)  technological impediments to implementing changes in agency systems  and processes. Lacking direction from OMB,  many agencies’ reduction plans did not include key elements, such as  timeframes and performance indicators, calling into question the plans’  utility. In addition, OMB has not required agencies to maintain up-to-date  inventories of SSN collections and has not established criteria for  determining when SSN use or display is “unnecessary,” leading to  inconsistent definitions across the agencies. OPM’s effort to define an alternate identifier ended  when it withdrew its proposed rulemaking on the use of SSNs, and SSA’s  clearinghouse of key SSN reduction practices is no longer available  online. Lacking OMB  direction to do so, not all agencies have developed effective SSN  reduction plans. Until OMB adopts more effective practices for  guiding agency SSN reduction processes, overall governmentwide  reduction efforts will likely remain limited and difficult to measure, and the  risk of SSNs being exposed and used to commit identity theft will remain  greater than it need be. Recommendations for Executive Actions

To improve the consistency and effectiveness of governmentwide efforts  to reduce the unnecessary use of SSNs and thereby mitigate the risk of  identity theft, we are recommending that the Director of OMB take the  following five actions:  specify elements that agency plans for reducing the unnecessary  collection, use, and display of SSNs should contain and require all  agencies to develop and maintain complete plans;  require agencies to modify their inventories of systems containing PII  to indicate which systems contain SSNs and use the inventories to  monitor their reduction of unnecessary collection and use of SSNs; provide criteria to agencies on how to determine unnecessary use of  SSNs to facilitate consistent application across the federal  government;  take steps to ensure that agencies provide up-to-date status reports  on their progress in eliminating unnecessary SSN collection, use, and  display in their annual FISMA reports; and establish performance measures to monitor agency progress in  consistently and effectively implementing planned reduction efforts. OMB did not provide comments on the  draft report or our recommendations. In addition, SSA, along with eight other agencies, provided technical  comments or information on their current SSN reduction policies, which  have been incorporated into the final report as appropriate. Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine (1) what governmentwide initiatives  have been undertaken to assist agencies in eliminating their unnecessary  use of SSNs and (2) the extent to which agencies have developed and  executed plans to eliminate the unnecessary use and display of SSNs  and have identified challenges associated with those efforts. To determine what governmentwide initiatives have been undertaken to  assist agencies in eliminating their unnecessary use of SSNs, we  examined key governmentwide guidance documents, including reports  issued by the Identity Theft Task Force and identified roles and  responsibilities assigned to the Office of Management and Budget (OMB),  the Office of Personnel Management (OPM), and the Social Security  Administration (SSA).
Why GAO Did This Study

The federal government uses SSNs as unique identifiers for many purposes, including employment, taxation, law enforcement, and benefits. However, SSNs are also key pieces of identifying information that potentially may be used to perpetrate identity theft.
GAO was asked to review federal government efforts to reduce the collection and use of SSNs. This report examines (1) what governmentwide initiatives have been undertaken to assist agencies in eliminating their unnecessary use of SSNs and (2) the extent to which agencies have developed and executed plans to eliminate the unnecessary use and display of SSNs and have identified challenges associated with those efforts. To do so, GAO analyzed reports and guidance on protecting SSNs. GAO also analyzed SSN reduction plans and other documents, administered a questionnaire, and interviewed officials from the 24 CFO Act agencies.

What GAO Found

Governmentwide initiatives aimed at eliminating the unnecessary collection, use, and display of Social Security Numbers (SSN) have been underway in response to recommendations that the presidentially appointed Identity Theft Task Force made in 2007 to the Office of Personnel Management (OPM), the Office of Management and Budget (OMB), and the Social Security Administration (SSA). However, these initiatives have had limited success. In 2008, OPM proposed a regulation requiring the use of an alternate federal employee identifier but withdrew it in 2010 because no such identifier was available. OMB required agencies to develop SSN reduction plans and requires annual reporting on agency SSN reduction efforts. SSA developed an online clearinghouse of best practices for reducing SSN use; however, it is no longer available online. Based on responses to GAO's questionnaire, the 24 agencies covered by the Chief Financial Officers (CFO) Act use SSNs for various purposes (see figure).
All 24 CFO Act agencies developed SSN reduction plans and reported taking actions to curtail the use and display of SSNs. For example, the Department of Defense replaced SSNs, which previously appeared on its identification cards, with new identification numbers. Nevertheless, the agencies cited impediments to further reductions, including (1) statutes and regulations mandating SSN collection, (2) use of SSNs in necessary interactions with other federal entities, and (3) technological constraints of agency systems and processes.
Further, poor planning by agencies and ineffective monitoring by OMB have also limited efforts to reduce SSN use. Lacking direction from OMB, many agencies' SSN reduction plans did not include key elements, such as time frames and performance indicators, calling into question their utility. In addition, OMB has not required agencies to maintain up-to-date inventories of their SSN holdings or provided criteria for determining “unnecessary use and display,” limiting agencies' ability to gauge progress. OMB also has not ensured that agencies update their progress in annual reports or established performance metrics to monitor agency efforts. Until OMB requires agencies to adopt better practices for managing their SSN reduction processes, overall governmentwide reduction efforts will likely remain limited and difficult to measure.

What GAO Recommends

GAO recommends that OMB require complete plans for ongoing reductions in the collection, use, and display of SSNs, require inventories of systems containing SSNs, provide criteria for determining “unnecessary” use and display, ensure agencies update their progress in annual reports, and monitor agency progress based on clearly defined performance measures.
OMB did not comment on GAO's recommendations. We received written comments from SSA and technical comments from eight other agencies, which were incorporated into the final report as appropriate. The other 15 agencies did not provide comments.