SPEAKERS CONTENTS INSERTS
Page 1 TOP OF DOC
JOINT HEARING: PREVENTING IDENTITY THEFT BY TERRORISTS AND CRIMINALS
THURSDAY, NOVEMBER 8, 2001
U.S. House of Representatives,
Subcommittee on Oversight and Investigations, Committee on Financial Services,
and the
Subcommittee on Social Security,
Committee on Ways and Means,
Washington, DC.
The subcommittees met, pursuant to call, at 10:10 a.m., in room 2128, Rayburn House Office Building, Hon. Sue W. Kelly, [chairwoman of the Subcommittee on Oversight and Investigations], and E. Clay Shaw, Jr., [chairman of the Subcommittee on Social Security], presiding.
Present from Subcommittee on Oversight and Investigations: Chairwoman Kelly; Representatives Weldon, Inslee, Tiberi, Jones, Shows and Clay.
Present from Subcommittee on Social Security: Chairman Shaw; Representatives Matsui, Cardin, Becerra, Doggett, Collins, Brady, and Ryan.
Also attending was Congresswoman Hooley.
Page 2 PREV PAGE TOP OF DOC
Chairwoman KELLY. This joint hearing of the Committee on Financial Services Subcommittee on Oversight and Investigations, and Committee on Ways and Means Subcommittee on Social Security, will now come to order.
I welcome today my colleagues, Clay Shaw, and Ben Cardin. I'm delighted that we also have other colleagues here—Darlene Hooley. Thank you very much.
I look forward to hearing what the witnesses have to say.
We're here this morning to see how we can prevent the awful crime and terrible tragedy of identity theft by terrorists and criminals. Our special intention is to protect the families of the deceased from such theft and financial fraud at their most vulnerable moment—when they are grieving from the shock of their loss.
Through the rapid transmittal of the information in the Death Master File from the Social Security Administration to the financial services industry and the immediate use of that information by the industry, we can prevent these crimes and spare the families pain.
James Jackson and Derek Cunningham stole hundreds of thousands of dollars in gems and watches from deceased executives of our major corporations before being caught by law enforcement. They stole the identity of the late CEO of Wendy's International within days after his death and were not arrested until about 2 months later.
In the past 2 months, we learned that identity theft could be a tool of the hijackers who murdered thousands of our fellow citizens, and of their accomplices as well.
Page 3 PREV PAGE TOP OF DOC
Last week, the Inspector General of the Social Security Administration testified that some of the 19 hijackers used phony Social Security numbers to perpetrate their murders. And we know that Lofti Raisi, an Algerian held on suspicion that he trained four of the hijackers how to fly, used the Social Security number of a New Jersey woman who has been dead for 10 years.
Even after these events, and after three of us serving on the Financial Services Committee requested the SSA to ensure the rapid transmission of the Death Master File, we've received no commitment from the SSA to take any specific action.
The file is still physically shipped to an agency at the Commerce Department, where copies are made and physically shipped to subscribers.
In other words, ''snail-mail.''
There has been no reduction for years in the time that it takes for the SSA to officially notify the financial services industry of a death. Identity theft is now part of the first war of the 21st Century, but the Federal Government is still treating it in a 1960s way.
That must end. That is why we asked the General Accounting Office to study the matter and report their findings to the committee. That is why we're so pleased that the Ways and Means Subcommittee on Social Security, chaired by my colleague, Representative Clay Shaw, can join us in holding a joint hearing today.
Page 4 PREV PAGE TOP OF DOC
We need the Social Security Administration to take bold and immediate action to get the information to the financial services industry. We will hear from the SSA, the Commerce Department, the General Accounting Office, and we expect an innovative and effective solution.
We also need the financial services industry to ensure that the information is immediately integrated into databases and available for permanently deactivating Social Security numbers of the deceased.
Moreover, with the passage of the USA Patriot Act, there will soon be Treasury Department regulations requiring them to verify the identification of new account-holders and for customers to provide the identification requested by the companies.
We know that the SSA and financial institutions can meet this challenge. In the past 3 years, they've already met two difficult challenges—the Y2K conversion and the aftermath of the terrorist attacks.
The SSA was a leader among Government agencies in successfully avoiding the Y2K glitch and the financial institutions breezed through the turn of the millennium without a single major problem.
As the acting SSA commissioner testified last week before Representative Shaw's subcommittee, the SSA regional offices in the New York and Pennsylvania area reacted with fortitude and compassion to assist the victims and their families, and I want to thank the Social Security Administration for their wonderful assistance to New Yorkers, including the many of those in my district.
Page 5 PREV PAGE TOP OF DOC
After the horrendous destruction in New York City interrupted the financial markets and killed many, financial institutions there and across the country picked themselves up, dusted off, and got back to work with an amazing speed and grace, even while mourning their compatriots.
And all of them did all of that, the Y2K conversion and the recovery from the attacks, without any specific mandate in Federal law.
Surely, we can work together to meet this challenge before us now. I urge all parties to get together and, based on the GAO's findings, leapfrog over the antiquated system now used, and stop identity theft of the deceased.
Representative Shaw will chair the hearing for the first panel of witnesses. I will chair the hearing for the second panel.
Thank you.
Chairman SHAW. Thank you, Ms. Kelly. We appreciate being here in your committee room and being able to join with you in this hearing this morning.
Today, our two subcommittees join together to examine ways to prevent identity theft by terrorists and criminals. When Social Security numbers were created 65 years ago, their only purpose was to track a worker's earnings so that Social Security benefits could be calculated. But today, use of the Social Security number is pervasive.
Page 6 PREV PAGE TOP OF DOC
Our culture is hooked on Social Security numbers. Businesses and Government use the number as their primary source of identifying individuals. You can't even conduct the most frivolous transaction, like renting a video at your local store, without someone asking you first to render your 9-digit Social Security ID.
Interestingly enough, I had a doctor's appointment last Friday. It was a doctor I had never been to before. And I noticed when I was signing in, my Social Security number was required.
I mentioned that to him back in the examining room and I told him, I said, the time is going to come when you're not going to be able to get that number. And he said, well, I hope it does, because he had been a victim of identity theft and it took him many years through the various layers of collection agencies to finally show that he was not the one that ran the tremendous debt up on the credit cards.
Your Social Security number is a key that unlocks the doors to your identity for any unscrupulous individual who gains access to it. Once the door is unlocked, the criminal or terrorist has at their fingertips all the essential elements needed to carry out whatever dastardly act that they conceive.
We now know that some terrorists involved in the September 11th attacks illegally obtained Social Security numbers and used them to steal identities and obtain false documents, thus hiding their true identities and their motives. These unspeakable acts shine an intense spotlight on the need for the Government and the private industry to be vigilant in protecting identities. It also demands that safeguards to prevent identity theft are put in place and put in place now.
Page 7 PREV PAGE TOP OF DOC
Earlier this year, I, along with several of my Ways and Means colleagues, introduced H.R. 2036, the Social Security Number Privacy and Identity Theft Prevention Act of 2001. This bipartisan bill represents a balanced approach to protecting the privacy of Social Security numbers, while allowing for their legitimate uses.
Because of its broad scope, the bill has also been referred to the Committee on Energy and Commerce and the Committee on Financial Services, in addition to Ways and Means. I urge prompt action by all three committees so that we may bring this important legislation to the floor as quickly as possible.
It is a needed part of our Nation's response to terrorism.
Sadly, identity theft is a crime not perpetrated just against the living. A Washington Post article on Saturday, September 29th, reported that a man detained in Great Britain and suspected of training the terrorists who hijacked the airliners on September 11th, used the Social Security number of a New Jersey woman who died in 1991.
The Associated Press reported on October 31st, that an individual from North Carolina had been indicted on charges he tried to steal the identity of someone killed in the terrorist attack at the World Trade Center.
Therefore, today, we will take a hard look at the sharing of death information. The Social Security Administration maintains the most comprehensive file of death information in the Federal Government. How this information is compiled, its accuracy, and the speed with which it is shared with the public will be explored.
Page 8 PREV PAGE TOP OF DOC
Because the financial services industry relies fundamentally on Social Security numbers as the common identifier to assemble accurate financial information, they are in a unique position to assist in the prevention of Social Security number fraud and abuse. Their timely receipt of death information and prompt updating of financial data is key in preventing identity theft.
In the past, some businesses have not been enthusiastic about further restricting the use of Social Security numbers. It is my hope they will rethink their resistance in light of September 11th.
Identity theft is a national security threat involving life and property. Safeguards will be made and I predict sooner rather than later.
Mr. Cardin.
Mr. CARDIN. Thank you, Mr. Shaw. Let me thank both Chairman Shaw and Chairwoman Kelly for convening this joint hearing today.
This is an extremely important subject. We're working in a very bipartisan way to do everything we can to prevent identity theft.
The FBI considers identity theft to be one of the fastest-growing crimes in the United States. 350,000 cases a year.
Page 9 PREV PAGE TOP OF DOC
We can do better.
The focus of today's hearing is going to spend a lot of time on the SSA's Death Master File, where it compiles the names and Social Security numbers of those individuals who have recently died.
Questions have been raised as to whether those files are as up-to-date as they need to be and whether that information is being shared, particularly with financial institutions, in the most effective way in order to reduce the amount of identity fraud.
I think there's a joint responsibility here and when the panel presents their testimony, I hope that they will deal with this. There's clearly a responsibility by SSA to have the information available so that we can prevent identity theft.
But there's also responsibility in the private sector, particularly of financial institutions, as to how they deal with identity in the use of fraudulent or false information.
Both need to work together in order to accomplish it.
The Chairmen have given us examples that should chill all of us. The fact that several of the hijackers had fraudulent SS numbers, that is something that is unacceptable. The fact that a terrorist apprehended in Britain had a Social Security number that was from a deceased person that was 10 years old is unacceptable. We can do better than that.
Page 10 PREV PAGE TOP OF DOC
There is now, of course, a ring of thefts involving recently-deceased business executives. Ms. Kelly mentioned the Wendy's executive.
We need to be wiser in how we deal with the Social Security numbers and updating the data bank at the public level, sharing with the private sector, to avoid these types of crimes.
I think the questions being raised is whether we can update these Death Master Files in a more effective way, would that have prevented some of these ID thefts?
But I must at least raise some additional questions here as we go through this hearing.
We have the question that the primary purpose, the primary mission of the SSA's use of the Social Security card is to maintain earnings records and pay benefits in the case of death, retirement and disability.
I have concern about making the list more up-to-date and easier to use, could compromise individual privacy and have the unintended consequence of making it easier, rather than more difficult, for people to steal and use false SSNs.
So there are tradeoffs here.
We also have the challenge of joint accounts, where one person dies and you have another person account. If we all of a sudden freeze those assets, in a way, we may be causing unintended problems for our constituents.
Page 11 PREV PAGE TOP OF DOC
So these are not easy issues.
But the bottom line is we cannot accept the number of thefts that are occurring today through the use of Social Security numbers. We need to do a better job. And we look forward to working with the people who will be here today on our panel and others so that we can effectively combat this criminal activity.
Thank you, Mr. Chairman.
Chairman SHAW. Thank you.
Mr. Weldon, do you have a statement?
Mr. WELDON. No, thank you, Mr. Chairman.
Chairman SHAW. Mr. Inslee.
Mr. INSLEE. No statement, Mr. Chairman.
Chairman SHAW. Mr. Tiberi.
Mr. TIBERI. No, thank you, Mr. Chairman.
Chairman SHAW. Ms. Hooley.
Page 12 PREV PAGE TOP OF DOC
Ms. HOOLEY. Thank you, Chairman Shaw, and Chairwoman Kelly.
We've heard numerous times today identity theft is an equal opportunity crime. It affects victims of all ages, all incomes, and all ethnic backgrounds.
Ms. Kelly told us about Wendy's CEO. But more often than not, identity theft is something that affects the ordinary citizen, the person who is working hard, paying their taxes, and trying to do their best in life.
For example, a little over a year ago, a young man from Oregon named Sean Bolden, appeared before the full Banking Committee to testify about his personal nightmare with identity theft.
In Sean's case, identity thieves had opened dozens of financial accounts with his Social Security number and, as a result, at age 23, he was unable to obtain any credit whatsoever, including student loans.
And then there's the case of the little boy in Salem, Oregon, named Tyler Bales. Tyler was 16 months old when he lost his battle with a rare genetic disease called Hurler's Syndrome.
Now there's nothing more tragic than losing a child. Unfortunately, the heartache of Tyler's loss hasn't been eased for his parents.
Page 13 PREV PAGE TOP OF DOC
Not only isn't it hard enough losing a 16-month-old child, but last spring, the Bales learned, courtesy of the Internal Revenue Service, that someone claimed Tyler as a dependent on their 2000 income tax return and, as a result, the Bales' income tax return was rejected.
As disturbing as that is, it gets worse.
Because of Federal disclosure issues, the IRS cannot give out the name of the identity theft to the Salem Police Department, even though identity theft is a felony offense in Oregon. The thief could live right down the street or 3000 miles away. But because of a loophole in the IRS, the Bales and the police department will never know who stole their son's personal information.
Mr. Chair, I submit that Tyler Bales and Sean Bolden are more than a name, a date of birth, or a Social Security number, and that's why I've been a strong advocate of stamping out the crime of identity theft.
In Tyler's case, I introduced H.R. 2077, the ID Theft Loophole Closure bill. It is in the Ways and Means Committee. It is a very simple bill that says the IRS, in fact, can give out the information to the local police.
I know our economy in a large degree depends on the flow of free information. However, it's imperative that we recognize that private information is just that—private—and not a salable commodity or something to be exposed by unscrupulous individuals.
Page 14 PREV PAGE TOP OF DOC
Literally, this is the fastest-growing crime there is. The numbers are outrageous. And I could spend some times with numbers, but I don't want to do that. What I want to express today is this is happening more and more frequently. It's happening with people who are committing other crimes.
In Salem, the police department has said that in the last 2 years, ID theft has increased by over 38 percent and much of that is related to also methamphetamine abuse, is the motivating factor.
We need to close some of these loopholes. We need to do something with identity theft, instead of just talk about it. And I think today's hearing is a good start and I yield back my time.
Chairman SHAW. Thank you very much.
Now I'd like to introduce our first panel this morning.
We first have:
The Honorable Philip Bond, who is the Undersecretary of Technology at the United States Department of Commerce;
Jim Huse is no stranger to the subcommittees, he is the Inspector General of the Social Security Administration;
Page 15 PREV PAGE TOP OF DOC
Fritz Streckewald, Acting Assistant Deputy Commissioner for Disability and Income Security Programs of the Social Security Administration;
Barbara Bovbjerg, the Director—Barbara, if I ever fail to mispronounce your name, would you please call me down on it?
[Laughter.]
Ms. BOVBJERG. It's ''Bo-berg,'' and everyone has trouble with it.
Chairman SHAW. And it seems, as long as I've known you, I'd have gotten it right by now.
[Laughter.]
But you certainly are no stranger to the subcommittees, because you're the Director of Education, Workforce and Income Security of the General Accounting Office.
And Richard Hillman, who is the Director of the Financial Markets and Community Investment of the General Accounting Office.
Welcome to all the witnesses. We have your full statements and they'll be made a part of the record. You may proceed as you see fit.
Page 16 PREV PAGE TOP OF DOC
Mr. Bond.
STATEMENT OF HON. PHILIP J. BOND, UNDER SECRETARY FOR TECHNOLOGY, U.S. DEPARTMENT OF COMMERCE
Mr. BOND. Thank you, Mr. Chairman, Chairwoman Kelly, Members of both subcommittees. I want to thank you for inviting me here to address an important issue, obviously of combatting fraudulent use of Social Security numbers of decreased individuals.
The National Technical Information Service, NTIS, is a component of the Department of Commerce. It's involved in this issue because it makes available to the public the Social Security Administration's Death Master File extract.
Let me just say by way of preface that as someone who spent 7 years working in the people's house, sitting back there in the staff row, it's a special and deep honor for me to come back here and work with you in trying to work toward a solution and improvement in the system in this regard.
Obviously, September 11th has caused all of us to revisit and reassess what we're doing in every branch of Government, and certainly that is true at the Department of Commerce, where Secretary Evans has us involved deeply in that reassessment.
So I want to commend you for holding this hearing, for the leadership, and for bringing some attention to this matter. And I'm confident that as the subcommittees look into this, that they'll find that technology is part of the solution.
Page 17 PREV PAGE TOP OF DOC
First, very quickly, a bit about NTIS.
For over 50 years, NTIS has collected, organized and permanently preserved most of the research and technical reports of the Federal Government. There are today about 3 million information products in its permanent collection.
NTIS, I want to stress, received no appropriated funds. It is self-sustaining, basically on the sale of these largely technical manuals and reports.
Many agencies in the Federal Government work with NTIS because they know the agency has the ability to make their information products more widely available, beyond their normal constituency, and in different formats.
Clearly, it would be more expensive if all of the agencies tried to replicate this infrastructure.
A quick example. The Defense Technical Information Center provides its technical reports directly to the folks in their community. But they turn to the NTIS for the release of unclassified research to the public at large.
Similarly, the Social Security Administration distributes the Death Master File to Federal agencies, some State and local agencies, but they turn to the NTIS to make it available to others, in part because SSA does not currently have the capacity or the distribution networks.
Page 18 PREV PAGE TOP OF DOC
Very quickly, my principal comments here will address what NTIS does with the files once we receive them and I'll defer to that agency on a description of the preparation of the files, other than to say that, on a quarterly basis, they do the full Master File and then monthly updates beyond that.
The Death Master File contains only basic information—Social Security number, last name, first name, date of death, date of birth, State or county of residence, zip code for the last residence, and last lump-sum payment.
Obviously, the Death Master File can be a great help for detecting erroneous or fraudulent payments.
Accordingly, SSA makes it available directly to a number of agencies that pay benefits or have other needs for this information, such as preparing statistical studies and to States which use the list to detect fraud or administrative errors, including fraudulent or erroneous food stamp payments, for example.
At the same time, SSA makes the Death Master File available to these Federal agencies, they make it available to NTIS for reproduction and distribution to others.
We receive this information on a cartridge via overnight mail and copy the information onto magnetic tape or cartridge or CD, depending on what our end-user has requested.
And I want to stress that NTIS will of course be pleased to consider other formats.
Page 19 PREV PAGE TOP OF DOC
It typically takes 1 to 3 days for NTIS to complete this production process, having received the cartridge and then turning it around.
We send the file to more than one hundred subscribers, either via overnight mail or first-class mail, if that is their preference. All formats are sent out at the same time.
The turn-around time does depend in part on the size of the file, but it is not generally a function of the fact that NTIS offers it in various formats.
That is not the source of delay.
We understand that the Social Security Administration is exploring new approaches to making the file available in a more timely technological manner. These include sending the file to NTIS electronically and sending updates on a weekly, rather than monthly, basis.
Clearly, electronic transfer would certainly reduce the turn-around time. Subscribers would probably find it easier to obtain just the updates electronically rather than the massive Master File.
In any event, we are committed to working with SSA to improve the delivery of this important product.
Page 20 PREV PAGE TOP OF DOC
Finally, let me express—I understand there's a desire in the financial community for a web-based search capability. That is an interesting proposal that we will certainly look at.
And again, NTIS is pleased to look at that further. If there's anything that we can or should do to expedite the process, we want to do it as soon as possible.
Thank you, Mr. Chairman.
Chairman SHAW. Thank you, Mr. Bond.
Mr. Huse.
STATEMENT OF HON. JAMES G. HUSE, JR., INSPECTOR GENERAL, SOCIAL SECURITY ADMINISTRATION
Mr. HUSE. Good morning, Mr. Chairman. Thank you for having me. Chairwoman Kelly.
While I have testified on the issue of identity theft before various committees in both the House and Senate, the issues of September 11th lend a renewed urgency to this issue.
Identity theft was already a significant problem facing law enforcement, the financial industry, and the American public before September 11th. In the weeks since that terrible day, it has become increasingly apparent that improperly obtained Social Security numbers were a factor in the terrorists' ability to assimilate themselves into our society while they planned their attacks.
Page 21 PREV PAGE TOP OF DOC
While this has heightened the urgency of the need for Congress, the Social Security Administration, and my office to take additional steps to protect the integrity of the Social Security number, it has not altered the nature of the steps that must be taken.
The Social Security number, no matter how much we avoid labeling it as such, is our national identifier. As such, it is incumbent upon those of us gathered here to do all in our power to protect it and the people to whom it is issued. There are three stages at which protections must be in place: upon issuance, during the life of the number holder, and upon that individual's death.
With respect to the issuance of SSNs, or what the Social Security Administration refers to as the enumeration process, our audit and investigative work has revealed a number of vulnerabilities and resulted in a number of recommendations.
The most critical of these recommendations centers around the authentication of documents presented by the individual applying for an SSN or a replacement Social Security card.
If we are to preserve the integrity of the SSN, birth records, immigration records, and other identification documents presented to SSA must be independently verified as authentic before an SSN is issued.
Further, if immigration records are to be relied upon, the Immigration and Naturalization Service must be required to authenticate those records.
Page 22 PREV PAGE TOP OF DOC
Regrettably, this will subject the enumeration process to delays. But just as we must endure lengthy waits at airports in the name of higher security, so must we now sacrifice a degree of customer service in the name of SSN integrity.
H.R.2036, introduced by the Social Security Subcommittee, moves us closer to these protections, the importance of which cannot be overstated. If we cannot stop the improper issuance of SSNs by the Federal Government, then no degree of protection after the fact will have any significant effect.
It would merely be closing the barn door after the horse has gone.
The second and most difficult stage of protecting the SSN comes during the life of the number-holder. Because the SSN has become so integral a part of our lives, particularly with respect to financial transactions, it is difficult to give the number the degree of privacy it requires, but there are important steps we can take.
We can limit the SSN's public availability to the greatest extent practicable, without unduly limiting commerce. We can prohibit the sale of SSNs, prohibit their display on public records, and limit their use to valid transactions. And we can put in place enforcement mechanisms and stiff penalties to further discourage identity theft.
Finally, we must do more to protect the SSN after the number-holder's death. The Social Security Administration receives death information from a wide variety of sources and compiles a Death Master File, which is updated monthly and transmitted to various Federal agencies. It is also required to be offered for sale to the public and can be accessed over the internet through a number of sources, as we've already heard.
Page 23 PREV PAGE TOP OF DOC
My concern under the current system is with the accuracy of the death information. Accuracy in this area is critical to SSA in the administration of its programs, to the financial services industry, and to the American people. Our audit work has revealed systemic errors in the Death Master File and we have recommended steps that SSA can take to improve the reliability of this critical data.
Among these recommendations were matching the Death Master File against auxiliary benefit records to ensure that individuals receiving benefits in one system are not listed as deceased in another, and reconciling 1.3 million deaths recorded in SSA's benefit payment files that do not appear in the Death Master File.
We are faced with striking a balance between speed and convenience, on the one hand, and accuracy and security on the other. This is true in the case of the Death Master File, just as it is true in the enumeration process.
At all three of these stages of an SSN's existence, improvement is needed. H.R. 2036 addresses many of these concerns. The Social Security Administration, my office, the Congress, and the American people must act together to accord the SSN the protections appropriate to the power it wields.
Thank you very much.
Chairman SHAW. Thank you, Mr. Huse.
Page 24 PREV PAGE TOP OF DOC
Mr. Streckewald.
STATEMENT OF FRITZ STRECKEWALD, ACTING ASSISTANT DEPUTY COMMISSIONER FOR DISABILITY AND INCOME SECURITY PROGRAMS, SOCIAL SECURITY ADMINISTRATION
Mr. STRECKEWALD. Chairman Shaw, Chairwoman Kelly, Members of the subcommittees, thank you for asking me to appear before you today to discuss the Social Security Administration's collection, maintenance and distribution of death information.
We use this information for a number of important program purposes and the integrity of this information is of utmost importance to us.
SSA's Death Master File was created because of a 1980 Consent Judgement resulting from a lawsuit brought by a private citizen. Under the Freedom of Information Act, we are required to disclose the Death Master File to members of the public.
SSA obtains death reports from many sources, with 90 percent of the reports obtained from family members and funeral homes. The remainder of the information comes from States and other Federal agencies through data exchanges and reports from postal authorities and financial institutions. We match death reports of the approximately 2.5 million people who die annually against our payment records and terminate benefits for those individuals who are deceased. We annotate the deaths on our master Social Security and Supplemental Security Income beneficiary records and on the Social Security number record file for beneficiaries and non-beneficiaries.
Page 25 PREV PAGE TOP OF DOC
Since studies have shown that death reports from family members and from funeral homes are over 99 percent accurate, we do not verify these reports. For our beneficiaries, we are currently verifying reports from financial institutions and postal authorities after terminating benefits. However, we are changing our policy to verify these reports before taking any action.
Reports obtained through data exchange require verification through our field offices before an individual's death is posted to our payment records and their benefit is terminated. This includes death data received from the States.
We do not verify death reports on persons who don't receive Social Security benefits, and it would be difficult for us to do so since we do not have addresses or other identifying information on these individuals.
The Death Master File is updated daily based upon reports SSA receives and contains approximately 70 million records, including Social Security beneficiaries and non-beneficiaries, with verified and unverified reports of death.
If available, the file contains the deceased's SSN, first name, middle name, surname, date of death, date of birth, State, county, zip code of the last address on our records, and the zip code of the lump-sum death payment. The record is also annotated to indicate where the report was verified.
Federal agencies, State and local government, and the private sector use the national death data file, and we are reimbursed for the cost of providing this information. Currently, as required by law, SSA shares the full Death Master File with Federal benefit-paying agencies that use the data to conduct matches against their own beneficiary rolls, such as the Department of Defense and the Office of Personnel Management.
Page 26 PREV PAGE TOP OF DOC
Under the matching agreement with SSA, these agencies are required to independently verify the fact of death before taking any adverse action.
The publicly available Death Master File is provided monthly to the Department of Commerce, National Technical Information Service, or NTIS, which in turn makes it available to the public under the Freedom of Information Act. NTIS distributes it to subscribers by either tape file or CD-ROM version. Some of these private companies, including genealogical publishing companies, create their own files from the Death Master File. Some private websites have these files on line.
In response to issues raised by the subcommittee Members, we are exploring electronically transmitting our Death Master File to the NTIS, rather than sending them through Federal Express.
We are prepared to do that immediately, as soon as NTIS is ready to receive it. Transmitting the data more frequently is also possible, perhaps on a weekly or bi-weekly basis.
SSA also has an electronic data exchange of all States and a large number of Federal agencies. This is an electronic overnight query process that enables requesters to enter a query for any individual. Using this process, State agencies can access our death records so they can ensure that benefits are not paid to deceased individuals.
Finally, I'd like to briefly mention recent initiatives to strengthen the enumeration process.
Page 27 PREV PAGE TOP OF DOC
In response to the events of September 11th and the indication that some terrorists had Social Security numbers and cards, some of which may have been fraudulently obtained, SSA formed a high-level response team to re-examine the enumeration process.
The response team, which includes representatives of SSA's Office of the Inspector General, will help determine what changes need to be made to ensure that we are taking all necessary precautions to prevent those of criminal intent from using Social Security numbers and cards to advance their operations.
Thank you again for the opportunity to discuss with your committees how SSA gathers and distributes death information.
I will be glad to answer any questions.
Chairman SHAW. Thank you.
Mrs. Bovbjerg.
STATEMENT OF BARBARA D. BOVBJERG, DIRECTOR, EDUCATION, WORKFORCE AND INCOME SECURITY ISSUES; AND RICHARD J. HILLMAN, DIRECTOR, FINANCIAL MARKETS AND COMMUNITY INVESTMENT ISSUES, GENERAL ACCOUNTING OFFICE
Ms. BOVBJERG. Thank you, Mr. Chairman, Members of the subcommittees.
Page 28 PREV PAGE TOP OF DOC
I'm really pleased to be here before the subcommittee again and to meet a new subcommittee to me, with my colleague, Richard Hillman, to discuss the distribution of death information to financial institutions.
As we've heard, the Social Security Administration collects and records the names and Social Security numbers of the more than two million Americans who die each year. This information is critical to the integrity of the Federal benefit system.
Properly used and distributed, death information can also help prevent the fraudulent use of Social Security numbers to steal identities, to obtain false identification documents, and to commit financial fraud.
In light of the recent terrorist attacks, it is more important than ever to safeguard Social Security numbers from criminal use.
Accordingly, our testimony today addresses three points. First, how death information is collected and distributed and how long this takes. Second, how the financial services industry uses such information. And third, possible steps to improve timeliness of distribution.
Our observations are based on prior GAO work, preliminary work at the SSA and the National Technical Information Service, and our discussions with financial services institutions.
Page 29 PREV PAGE TOP OF DOC
First, let me describe the collection and distribution process.
As we've heard, SSA receives about 90 percent of its death information from funeral homes and relatives of the deceased, and most of this information reaches SSA within a week of death. SSA takes another week to process the information and add it to individual Social Security records.
At the beginning of each month, SSA extracts this death information from its records to the Death Master File, and sends it to the NTIS. NTIS receives this information by the fourth or fifth day of each month and mails it to subscribers on tape or on CD-ROM within another 2 to 4 days.
Overall, most death information reaches these subscribers within 1 to 2 months of death, depending on when the death notice first reaches Social Security.
The remaining ten percent of death information comes to SSA from other Federal agencies that learn of deaths through data matches or undelivered benefit checks and from State vital statistics bureaus. However, these death reports are less timely than those sent directly from families and funeral directors to SSA, and require verification by SSA before they can be added to the Master File and distributed.
Death information may not reach SSA from State reports until 3 to 4 months after the date of death and is not available to private subscribers.
Let me now turn to how financial services institutions use this information.
Page 30 PREV PAGE TOP OF DOC
Representatives of such institutions told us they did not use a formal process or a central data source to identify deceased customers, although most receive death information either from family members or, in the case of Social Security beneficiaries with direct deposit, from SSA directly.
However, most also told us that they subscribe to fraud prevention products or services offered by credit reporting agencies for evaluating new credit applications. All three credit reporting agencies subscribe to the Master File and make this information available to their customers through these proprietary fraud prevention products.
Most institutions we contacted expressed an interest in receiving timely death information with frequent updates. Some of these institutions were aware of the Master File, but unfamiliar with the information they provide, or of the ability to subscribe, while others were not aware of it at all.
Finally, let me turn to possible steps for improving the distribution and use of death information.
As you've heard, SSA is exploring ways to speed up this process and has stated that it would be relatively easy to produce updates on a weekly, rather than a monthly, basis. SSA and NTIS officials have stated that it should also be possible for SSA to transmit updates to NTIS electronically and that NTIS could transmit the information to subscribers electronically as well.
Page 31 PREV PAGE TOP OF DOC
SSA is also piloting the electronic death registration system, which would enable States to collect and report deaths electronically to SSA, both streamlining and centralizing the collection reporting of such information.
However, existing restrictions on distribution of State-provided data could complicate adoption of such an approach.
In conclusion, most death information is available to the public within 2 months and improvements to the collection and transmission processes could make this information more complete and more timely. Educating the financial services industry about the availability and contents of the Master File would also be helpful.
Such measures are tangible steps that could act to narrow the window of time in which a criminal can open new accounts using a deceased person's identity and would raise the likelihood that such behavior would be detected.
However, improving the use and timeliness of death information will not by itself eliminate identity theft and is not a panacea for addressing the larger issue of criminal misuse of Social Security numbers.
That concludes my statement, Madam Chairwoman. Mr. Hillman and I would be happy to answer any questions you have.
Chairwoman KELLY. Thank you very much.
Page 32 PREV PAGE TOP OF DOC
Mr. Hillman, have you a statement, or is yours the same? It's a joint statement?
Mr. HILLMAN. Yes, Madam Chairwoman.
Chairwoman KELLY. All right. Thank you very much.
I appreciate you all indulging us up here as some of us are leaving to vote. This way, we can keep the hearing going without keeping you all in your seats for too long a period of time. I'm going to open the questioning.
Mr. Streckewald, I have a question for you. Actually, I have a couple of questions for you.
On page 6, in your testimony, you describe the State verification and exchange system that allows some States and some Federal agencies to verify a death within one day. Have you considered whether to open it to access by the financial services industry?
Mr. STRECKEWALD. We use that for, as you said, the State governments. We have, as far as I know, not looked into using it for financial institutions.
We do have the ability for employers to verify Social Security numbers in a batch mode, which is like an overnight type of mode as well. And so, employers can send us batches or individual Social Security numbers, so that we can verify for them.
Page 33 PREV PAGE TOP OF DOC
I'm not aware that we have specifically looked at the financial services' access to the information.
Chairwoman KELLY. I think that looks like the basis for a system that's needed by the financial institutions, so that they could do rapid verification.
Since the Patriot Act requires them to verify the identity of any new account-holder, I don't understand why the SSA can't commit to allowing that system to be used as part of verification procedures.
Mr. STRECKEWALD. We can certainly take a look at that and get back to the subcommittees on what we find.
Chairwoman KELLY. I wish you would, please. And to that effect, I'm going to send a letter to the Secretary of the Treasury with that recommendation to put into their regulations, because I think that that's a way of rapidly helping our financial institutions.
I also wondered if the SSA and the NTIS had ever collaborated on a study to determine a faster means of getting the information to the financial services industry, including this one, and including sending it electronically or even perhaps, that difficult word, contracting out the entire process, from extraction to dissemination.
Mr. STRECKEWALD. I think with recent events, we've come to the conclusion with NTIS that we do need to get this information to them quicker and that they need to be able to distribute it quicker.
Page 34 PREV PAGE TOP OF DOC
I think what remains to be worked out is just the details of that. It's certainly technologically feasible and as we've heard this morning, it seems like both agencies are willing to move to perhaps a weekly or biweekly update of the information and to transmit electronically rather than through overnight mail.
Chairwoman KELLY. That I read in the testimony. My question is, I really want to know how rapidly you're doing that, but also there's another piece of this.
There's a victim. I had my credit card stolen. I think there's a lot of people who have had things like that go on. I want to know with regard to the Social Security number what you're doing to help the victims who have their identity stolen, or the families of victims.
Mr. STRECKEWALD. We have a series of actions that kick into place when we hear about this type of event. First of all, we refer them to the inspector general hotline because it's perhaps a criminal event that needs to be investigated.
But we also work very closely with the person. We give them pamphlets that explain who they can contact. We give them referrals to some of the national financial services organizations so they can clarify and correct their credit ratings.
So we do have procedures in place for referrals to hotlines and other services that can help correct the problem.
Page 35 PREV PAGE TOP OF DOC
Chairwoman KELLY. It's been my experience in working with those that they are not terribly rapid. It takes a while. And it takes going through several people to get it done.
I'm going to ask you this, Mr. Bond, and I would like you both to answer both those questions, the prior question and this one.
What's the possibility of allowing people to do this kind of thing, to do it perhaps electronically with something as a follow-up that would be a verification.
Mr. BOND. I'm sorry? Just to understand, a verification of the receipt of the information or a verification of falsely secured numbers?
Chairwoman KELLY. I'm extending this to the people who are the victims of identity theft from the Social Security Administration numbers.
Those people would have to, when you have that happen, if it's in your family, you have to deal with a lot of different people. What's the electronic possibilities of letting people do that electronically, deal with people and do it rapidly, rather than having to make a lot of telephone calls?
Mr. HUSE. If I may be permitted, Chairwoman Kelly.
Chairwoman KELLY. By all means.
Page 36 PREV PAGE TOP OF DOC
Mr. HUSE. The Federal Trade Commission and our office of the inspector general have a reciprocal information exchange that going forward will only get better. But in the last 2 years, has rapidly improved the transmission of victim information so that it gets to the credit-reporting bureaus better than it used to.
Can it be improved? Yes. Like many other things in Government, it is based on this application of resources and we're certainly changing our approach to the amount of resources we apply to this as this crisis has developed over the last 5 years.
But that's the way it's done. It's better today, and does use, by the way, e-mail and electronic transmission, if victims have that available to them, to get the information to us.
From that clearinghouse, then, this information becomes available to local, county and State law enforcement.
Again, I'm not trying to paint a rosy picture here, but at least we have the dots on the paper and we're connecting them a little bit better than we used to.
Chairwoman KELLY. What's the timeline on that?
Mr. HUSE. It all depends on the application of resources. We work in our budget submission process to try and gain those to do this.
The technology is already there. It really is a matter of adjusting IT resources and the human capital that you need to make this happen.
Page 37 PREV PAGE TOP OF DOC
We're just learning that this is an issue that the people care about a great deal.
Mr. BOND. Madam Chairwoman, if I could add to that, too.
Technologically, of course, there's no reason you can't expedite things via the internet and secure communications and so forth. It really becomes part of a very fundamental e-government initiative that both the Congress and the Administration have to join hands on.
The Administration has sent up an aggressive proposal in that regard and appointed people at OMB to oversee it, to try to really push the agencies more toward quicker, more rapid response for our shared constituents.
But it's going to be a very fundamental effort to apply technology to the service of constituents.
Chairwoman KELLY. What's your timeline?
Mr. BOND. There is a multi-year plan out of OMB which does require some significant funding here on the Hill. And that will be one of the many issues in final appropriations discussions for this year because the request was not fully funded coming out of the two chambers.
Page 38 PREV PAGE TOP OF DOC
Chairwoman KELLY. So it's a matter of appropriated funds from Congress.
Is that correct?
Mr. BOND. Absolutely, to upgrade the IT capabilities in many of the Federal agencies.
Mr. STRECKEWALD. If I could, I would reinforce Mr. Bond's comments that the Federal Government as a whole, through the leadership of OMB and through individual agencies' initiatives, is looking at customer-oriented electronic services.
In some ways, SSA has been providing this with our online applications. But this particular example that you're using, which is to help people correct identity theft problems, would have to be a broad spectrum of stakeholders, financial services, Government agencies, States, would have to come together and plan this out and construct the communications lines and the procedures for solving this.
But it is technologically feasible and OMB is trying to lead us to a more electronically-focused, customer-oriented Government.
Chairwoman KELLY. Mr. Huse.
Mr. HUSE. One more thought on all of this.
Page 39 PREV PAGE TOP OF DOC
I think we understand now, with this identity fraud crisis issue and victim assistance as a key part of it, we've learned a lot the last few years that our traditional approaches to this just don't cut it. They don't work.
We have advanced a proposal in the budget process for innovative ways to change this model, so that law enforcement, Federal law enforcement integrates itself better with local law enforcement because it's a total issue. It just can't be relegated to the Federal Government or a burden on local governments.
And this model means non-traditional approaches. The key to it is rapid and effective information exchange. The work is there and the ideas are there.
In fact, some of this is in 2036. Some of the pieces that we need to get this done is in 2036. But I really want to assure you, Madam Chairwoman, that we are committed to trying to do this.
But, as I said, as in everything in Government, it is resource-dependent.
Chairwoman KELLY. Most people who come before these subcommittees ask for resources. That's not a surprise.
Mr. HUSE. No.
Chairwoman KELLY. But we're essentially in a terrorist war situation.
Page 40 PREV PAGE TOP OF DOC
One of the things that America has always had is ingenuity. This may be the time to do more with less. And I'm not saying that you can't get the resources. What I'm simply saying is that we have a limited budget. We all know that. And ingenuity is going to have to be the order of the day for all of us.
This may be the time, when you need to have that larger meeting, discuss how it's going to go and do it sooner rather than later, so you can get help from the financial institutions as well as from anyone else who is an interested stakeholder in this.
I want to ask the GAO, since there's no one else who has come back from the vote yet, I want to ask you, Barbara, if you don't mind, have you considered whether the Social Security Administration can open the State verification and exchange system to the financial services industry to allow the companies to verify?
Is that something that you've thought about?
Ms. BOVBJERG. GAO has done a lot of work on data sharing and the importance, on the one hand, of sharing information that allows you to safeguard benefits and safeguard identity and, on the other hand, being concerned about privacy and retention of personal information.
The death records are already public information, at least for the most part. What remains to be worked out with the States is this question of State restrictions on information that they provide that is not verified by SSA. That seems to be one of the sticking points. And we do hear about a resource question.
Page 41 PREV PAGE TOP OF DOC
I think we have been interested and have asked about the feasibility of doing some sort of online look-up, web-based approach that financial institutions could go to directly. And we're not in a position to make any recommendations. We would have to look at the cost versus benefits. But we thought that that might show promise.
Chairwoman KELLY. Perhaps we should ask for a cost/benefit analysis of something like that.
Ms. BOVBJERG. Well, may I add something?
Chairwoman KELLY. Yes.
Ms. BOVBJERG. Excuse me, Ms. Chairwoman.
We are doing some work that I wanted to call to your attention for Congressman Johnson on the Social Security Subcommittee that looks at law enforcement and identity theft across governments.
And one of the questions that he has us addressing is looking at the lead Federal and State law enforcement agencies with responsibilities in identity theft investigation and looking at how they cooperate across jurisdiction, including across Federal agencies.
I'm not sure when that work will be published. That's being done in another team. But I think that that will help get at some of the issues that have been raised this morning.
Page 42 PREV PAGE TOP OF DOC
Chairwoman KELLY. Thank you, and thank you for volunteering that.
What exposure did you find that financial institutions have? If a name is in the Master File and the institution processes a payment any way?
Mr. Hillman, do you want to answer that?
Mr. HILLMAN. I'm not exactly sure what the exposure may be to a financial institution who processes information and maybe provides funds out to an individual of a deceased person.
But we could find that out for you and let you know.
Chairwoman KELLY. I would appreciate your taking a look at that because that goes to the next question. And that is whether or not—I'm trying to get the acronym here—the FFIEC, the exam procedures, perhaps should take that into account.
I don't know if it does or not, but I think it's worth taking a look at.
I'm concerned also with the education of financial institutions with regard to what their exposure is and the appropriate usage of the Death Master File.
So perhaps you could take a look at look at that also.
Page 43 PREV PAGE TOP OF DOC
Mr. HILLMAN. We'd be happy to do that. We have looked at the examination procedures, as you might expect, that financial Federal regulators follow in looking at the financial services industry.
And in general, those examination procedures look to the safety and soundness of those depository institutions to ensure that they have sufficient funds to conduct their businesses.
They haven't in all cases looked at other important areas such as concerns with individuals or constituents. And I agree with you that that would be an important topic to further study.
Chairwoman KELLY. Thank you very much.
Mr. Brady, do you have any questions?
Mr. BRADY. Thank you, Madam Chairwoman. I'm sorry I missed the last part of the testimony. But, obviously, to solve this problem will take a combination of prevention and enforcement in the process.
We need to do all we can in prevention of identity theft. But I think what everyone understands is that, in this open society, it will be difficult to close that barn door completely, in this open, information-based society.
Page 44 PREV PAGE TOP OF DOC
So focusing a bit on the enforcement and the punishment side of it, what are the chances someone engaging in identity theft is going to get caught? What are the consequences in real life when they do?
Who's the best responsible and available to do that, State or Federal Government? What role can the business community play in catching them?
And the bottom line, what would it take to make the consequences harsher to be a real deterrent to people engaging in it?
And I'll open it up to anyone who's got an opinion.
Mr. HUSE. I'll take the first cut at an answer, Mr. Brady.
Mr. BRADY. All right.
Mr. HUSE. We don't do a great job from a criminal justice perspective with identity thieves because it's a relatively new crime.
We have a mixed result if you look across the Federal judicial system in terms of sentencing on these crimes. We need to do better.
One of the outreach efforts I think we need to make now with the post–9/11 consciousness that we have is to educate United States attorneys to the fact that these crimes need to be a priority concern in each of the 94 judicial districts.
Page 45 PREV PAGE TOP OF DOC
That may or may not be the case depending upon where you are in the United States. Other trendier crimes get priority.
Most States have very vigorous and good identity crime statutes themselves. So we need to cooperate more with local and State law enforcement to prosecute there where we can.
Clearly, though, the key to identity fraud because it transcends all boundaries is there has to be a better information-sharing mechanism. And the Congress, when it passed the Identity Theft Deterrence Act several years ago, an Assumption Deterrence Act several years ago, and established the clearing house in the FTC, I assure you that that is working and will only get better as we engage it more.
So that's my first try at an answer.
Mr. STRECKEWALD. If I could just elaborate a little bit. That particular law that was passed in 1998, which for the first time made it a Federal crime to fraudulently obtain identification, sell identification, or misrepresent yourself on obtaining any type of identification.
And for the first time, the Social Security number was included as a means of identification. So that did provide law enforcement with an added tool for enforcement.
Mr. BRADY. How many prosecutions have there been?
Page 46 PREV PAGE TOP OF DOC
Mr. HUSE. We can get that for you and follow that up. One thing I want to add, Mr. Brady, is one of the provisions of 2036, if it's passed, gives us some great civil money penalty tools.
Also, for those identity crimes that fall maybe under the prosecutorial thresholds in a given judicial district, but still have a fact pattern that supports an offense, we can sting those people with some money penalties, and I think that's a good thing, too.
Mr. BRADY. In real life, what are the consequences for getting caught? What's an average sentence, punishment, for identity theft?
Mr. HUSE. Well, with sentencing guidelines, probably for a first offender, it is several years of confinement. It depends on the criminal history involved.
Mr. BRADY. Sure.
Mr. HUSE. But it's a 10-year felony, the misuse is a basic Federal felony.
Mr. BRADY. Is there a feel for what first-time, second-time offenders, what they traditionally get? I'm not pushing. I'm just curious.
We all know what guidelines are. We all know what happens in real life.
Page 47 PREV PAGE TOP OF DOC
Mr. HUSE. As I said, it's confinement for several years. It hasn't reached the point, even though the violation is just as bad, of having, for example, the emotion involved of a bank robbery or something like that. But it's just as pernicious.
Mr. BRADY. What role—can I keep, while I'm on a roll?
Two questions, really. How can Washington help? Is it to create more resources here at the Federal level, or to complement better State prosecution efforts?
Second, what role can the business community play in helping us catch and enforce this?
Mr. HUSE. I'll let Barbara answer that.
Ms. BOVBJERG. I'll step into the breech.
We have talked in GAO about the need for both prevention and for law enforcement. One of the things that we're doing right now at the request of Chairman Shaw is looking at uses in Government at all levels—Federal agencies, various departments in State government, local government, and the courts, looking at uses of the number and looking at how the number is being safeguarded and developing options that could be considered for safeguarding.
So my answer to your question is more in a prevention side and working with SSA as they try to have the balance of making information available, but at the same time safeguarding it.
Page 48 PREV PAGE TOP OF DOC
That's always an issue with some of these web-based——
Mr. BRADY. And clearly, we need to do both. I'm not discounting either. I was just focusing on that side because I'm not as aware of it.
And second, it just seems, when you look at the number of people who have been hurt by identity theft and fraud, the average time it takes to try and clear their name, the costs to them, and then on September 11th, we had people who stole identities and then stole thousands of people's lives as a result of it.
So the obvious question is, what can we do to punish them to the fullest extent, or to deter the next person who has that in mind?
That was my focus.
Ms. BOVBJERG. And then I turn it over to the law enforcement end of the table.
Mr. HUSE. Well, I just wanted to take the piece of the question, is it all about resources? And that goes to Chairwoman Kelly's earlier comment.
It doesn't necessarily just mean resources, although some modest adjustments are needed here and there because you're short some capacity.
Page 49 PREV PAGE TOP OF DOC
But basically, the key to this is rethinking this particular crime top to bottom, and rethinking how we focus on this crime.
We're trying to apply an old model to this that just doesn't work. If we could just understand how serious it is, that's a big, huge step, and then work with ways to, using the magnificent technology that we have, to communicate better.
I think that's really the answer, rather than some new agency or the like.
Mr. BRADY. Thank you. Thank you all very much.
Chairman SHAW. Before I go to Ms. Hooley, I do have a question for you, Mr. Huse.
Does the law distinguish in the case of identity theft between a living person's identity who has been stolen or a deceased person?
Mr. HUSE. I don't believe it does. I think the law deals with the identity theft. I do know that a deceased person has no rights because they're not here to have them. But in terms of the identity theft, it still stays the same under the law.
Again, my staff——
Mr. BOND. I want to add, my understanding on that is that an individual under law is considered to be a living individual. And so the rights do not extend to the deceased.
Page 50 PREV PAGE TOP OF DOC
So when you talk about privacy laws, those are applied to living individuals and that is a fine point that I think some of the Executive agency lawyers would want to talk to the committee staff about in doing forward on your legislation.
Chairman SHAW. OK. If that answer needs sharpening up, let us know.
Mr. BOND. OK.
Chairman SHAW. Ms. Hooley.
Ms. HOOLEY. Thank you, Mr. Chair.
In the case of Tyler Bales, you could not give the information to local law enforcement agencies, even though identity theft is a crime in Oregon.
So I want to know, do we need to as a body fix that?
Mr. HUSE. Congresswoman, when you were speaking, I jotted down on a card that case and I passed it back to our chief investigator and I said, we should look at this case.
I don't know why under the IRS rules they didn't disclose. And that may be some arcane rule. I mean, they're governed by rules. We are at Social Security.
Page 51 PREV PAGE TOP OF DOC
But, usually, I'd like to see if there wasn't a way that the Social Security Administration might not be able to work with that case and take it forward.
And I'm not criticizing IRS. I'm just not sure.
Ms. HOOLEY. What I'm looking for is if we can do that, in the case of Oregon where identity theft is a crime.
Mr. HUSE. Right.
Ms. HOOLEY. And I'm just trying to figure out, do we need to fix it or if it's some rule that can be fixed.
Mr. HUSE. That's why I'd like to look at that.
Ms. HOOLEY. OK.
Mr. HUSE. And we'd be glad to talk to your staff about that and look into that case and then get back to you, if that's OK.
Ms. HOOLEY. OK. I have a couple of other questions.
The Death Master File, it contains everything that a thief would need to get up and running. It's now being transmitted, I understand, to 104 customers, up from about 51 in 1999.
Page 52 PREV PAGE TOP OF DOC
Is that correct?
Mr. BOND. Yes, that's about right.
Ms. HOOLEY. And all of the customers are paying for the information.
Mr. BOND. Correct.
Ms. HOOLEY. And do they use it for the purpose to flag financial holdings of the deceased individuals or is the information being used for other purposes? And if so, what are the other purposes?
Mr. BOND. It is a wide variety of purposes, from security to checking for fraud, obviously. I'm just flipping through here to try to see, because I had asked that question myself. Having just been sworn in on October 30th, I'm trying to find out everything I can quickly.
Ms. HOOLEY. I think sort of the irony of this thing is——
Mr. BOND. There are a couple of things that you need to know about. One is just the private genealogy sites that people talked about. That is one that is used, that you can go to. I did my own search and found that the Jasper County Public Library in Indiana has got the full Death Master File available there.
Page 53 PREV PAGE TOP OF DOC
So there's a variety of uses out there.
But the private sector is checking mostly for fraud in financial transactions.
Ms. HOOLEY. I guess sort of for me the irony is that the Internal Revenue Service can't pass the information on to law enforcement, but they can sell it to other organizations to be used.
And I just have a bit of a problem with that. Should I?
Mr. HUSE. I don't think any of us here are tax experts. We won't even go near there.
Mr. BOND. All I can add is that by the time it gets to NTIS, it is, as was explained, considered subject to the FOIA laws, and so it's out there.
Mr. STRECKEWALD. I have a little more information on the uses of that, at least in terms of the customers.
About 20 percent of the purchasers of the Death Master File are public sector groups. Some colleges use it, perhaps for research or checking against their databases of students. In addition, several private insurance companies use it extensively, along with a few banks.
Page 54 PREV PAGE TOP OF DOC
But there are not a lot of financial institutions on the list.
Mr. BOND. Here's the actual breakdown from NTIS, Congresswoman. It's 20 percent State and local, 20 percent information brokers, 15 percent insurance companies. Medical and cancer research organizations make up 15 percent. Security providers, five. Marketing companies, around five percent. Credit reporting bureaus and agencies, five percent. Pension funds, five percent. Banks and financial institutions, three. And genealogy, three.
Ms. HOOLEY. Thank you. Thank you and I yield back my time.
Chairman SHAW. Thank you.
I want to pursue the question of Ms. Hooley. I want to know, those death files, when they're put out, the Social Security numbers are on them. And I guess they're readily obtainable.
We know from experience and testimony before these subcommittees that they still have value to those that would attempt identity theft.
At the hearing that we had last week, we found that those numbers do survive the decedent and have a real purpose in State tax returns and things of this nature as an identifier.
And we also found that the numbers stay exactly the same. There's no D for decedent or something put after the number. So those numbers are still out there and for the layman looking at it, wouldn't know whether that was a decedent or somebody who was very much alive.
Page 55 PREV PAGE TOP OF DOC
What is the suggestion—and I open this to any member of the panel, that any of you might have—with how we could safeguard those numbers and yet, release them for legitimate purposes?
Obviously, insurance companies need them and some public officials need them—public agencies need them, rather.
Are there any thoughts on that?
Mr. STRECKEWALD. Yes. Let me see if I can give a couple thoughts on that.
I think it goes to the whole purpose of the Death Master File. Originally, it was a court settlement that required us to do this under the Freedom of Information Act law. But we sell the Death Master File for commercial purposes through NTIS, so that those with a reason to know individuals' Social Security numbers will know which numbers belong to deceased individuals. If a number comes through their system and it matches up with a number on the Death Master File, there's a problem.
So, in fact, the number is flagged. It is annotated when you compare it against our Death Master File.
If the Death Master File is not used extensively, then, of course, people won't have awareness of it.
Page 56 PREV PAGE TOP OF DOC
So, on the one hand, if it's out there, anybody can use it and try to take a number from it and create an identity or use it to apply for a credit card. But if the financial services and insurance companies and others make greater use of the Death Master File, then they'll know which numbers belong to deceased individuals.
Chairman SHAW. How can we safeguard that, those lists being misused?
We have to assume that if they're out there, they're being marketed, that they are available to the bad guys.
Mr. STRECKEWALD. From Social Security's perspective, if a person uses a Social Security fraudulently to work—sometimes numbers are used fraudulently for working—if earnings are reported on that number the year after the real number-holder dies, then we automatically investigate because we know that number belongs to a person who is shown as deceased on our records.
We issue an alert to the field office and they call the employer and ask who is this person that's giving these wages under this number. On our records, it shows that the number belongs to deceased individuals.
So, again, from the original purposes, earnings recordation, we do track back and see if it belongs to a dead person and if so, why are earnings being recorded.
Page 57 PREV PAGE TOP OF DOC
Chairman SHAW. It takes a year. You know the person is dead, money is coming in, it is going into his account. Why wouldn't it be kicked out in the first——
Mr. STRECKEWALD. Well, if a person works in January, February and dies in March, those earnings are reported to us after the end of the year. So we know that we haven't heard from the IRS yet until the year is over.
The next year, if we receive earnings from that person, that's suspicious and that triggers an alert.
Chairman SHAW. Yes, that would be suspicious. How do we handle death in foreign countries? Someone has retired in a foreign country, their money is being electronically transferred to a bank down in Mexico. How is that dealt with?
Mr. STRECKEWALD. I believe that we receive from embassies lists of deceased beneficiaries in foreign countries—they have Social Security numbers—so we would annotate our records and we would terminate their benefits.
Chairman SHAW. How do the embassies accumulate that? Now here, the funeral home turns them in. The death record is required on that.
So where is it in countries that don't have that process in place?
Mr. HUSE. To get to a bottom line here, it's not a perfect system and it's totally dependent on cooperation in those countries to give that information back to the benefit officers that we have in foreign stations.
Page 58 PREV PAGE TOP OF DOC
So what happens is, periodically, the agency does send out a survey team based on ages of beneficiaries—I think they set the number in the 1990s, but they're take a look to see if those people are still alive in the foreign population areas.
And those are done on a cycle basis by the international operations.
Mr. STRECKEWALD. It's the international operations. And in fact, for countries that are considered to be high risk, such as Yemen, they send a team out there.
Not only do they look at the elderly people, they ask to see in person every beneficiary in Yemen. That's one example. But we also go to the Philippines regularly and other countries.
Chairman SHAW. Would it help if we actually sent checks to foreign countries that required signatures, or is the expense of doing that more than the savings on electronic transfer?
Mr. STRECKEWALD. I think we'd have to take a look at that and get back to you. I'm not sure. It certainly would be an issue.
Chairman SHAW. And actually ask for an endorsement on the check. I think people would be a little less likely to endorse or forge somebody's name than they would be to just simply let the thing slide and let the money continue to accumulate in the bank account.
Page 59 PREV PAGE TOP OF DOC
That's my off-hand opinion.
Anyway, any further questions? The gentleman from Wisconsin?
Mr. RYAN. No questions.
Chairman SHAW. OK. Well, at this point, I turn the gavel over to Ms. Kelly, who will preside over the next panel.
Chairwoman KELLY. Let me make the introductions of the second panel.
We have: Mr. Stuart Pratt, Vice President for Government Relations, Associated Credit Bureaus;
Tom Lehner, Executive Vice President for Government Affairs, American Financial Services Association;
Tom Sadaka, Special Counsel, Office of Statewide Prosecution, Orlando, Florida. We welcome you, Mr. Sadaka. Am I pronouncing that correctly?
Mr. SADAKA. Sadaka.
Chairwoman KELLY. John Dugan, Covington & Burling, representing the Financial Services Coordinating Council.
Page 60 PREV PAGE TOP OF DOC
Mark Rotenberg, Executive Director, Electronic Privacy Information Center.
And Evan Hendricks, Editor and Publisher of Privacy Times.
We welcome you all. We look forward to your testimony. And I'd like to advise all Members and witnesses, I intend to keep to the 5-minute rule. So I'm going to remind witnesses when they have a minute remaining. Please check the clock.
I will also ask unanimous consent that all Members' questions be included in the record. I'd like to begin with you, Mr. Pratt.
STATEMENT OF STUART K. PRATT, VICE PRESIDENT FOR GOVERNMENT RELATIONS, ASSOCIATED CREDIT BUREAUS, INC.
Mr. PRATT. Thank you both very much for this opportunity to appear before this joint hearing today.
For the record, my name is Stuart Pratt and I am the Vice President of Government Relations for the Associated Credit Bureaus.
By way of background, the ACB, as we're commonly known, represents more than 500 consumer information companies and produce a wide range of products, including fraud prevention, risk management, credit reports, mortgage reports, tenant employment screening services, check fraud, and verification services.
Page 61 PREV PAGE TOP OF DOC
And so the subject matter here today is obviously very relevant to us and all of our members.
I think it's clear, perhaps more than ever before, that how we authenticate, how we verify, and how we ensure the authenticity of information in various types of applications is an essential need in this country. Unfortunately, I think we've learned that for all of the wrong reasons.
But at the core of this need is also the availability of information to be used and deployed in the authentication of application processes. And at the core of all of that, in many cases still, is the need for the availability of the Social Security number, which plays a particularly important role in our ability and our members' ability to build authentication and fraud prevention products, which then in turn allow us to mediate disparate sets of information and bring them back together in order to partner with our financial services customer bases, insurance and so on, in ensuring that they are, in fact, opening up lines of credit, depository accounts and so on, for legitimate individuals and for legitimate purposes.
I want to applaud your subcommittee, of course, and the Congress as a whole for the enactment of the USA Patriot Act and the very fact that this Act itself recognizes the need to have a robust system of authentication, and in turn specifically directs the Secretary of the Treasury to establish minimum standards for financial institutions to verify account applicant information.
I think, further, Chairman Shaw, in your hearing last week, we heard additional challenges in terms of even the enumeration process, how do we authenticate and verify information about individuals who are making applications for Social Security numbers.
Page 62 PREV PAGE TOP OF DOC
And in fact, I think we heard information in your hearing last week about the challenges even the States will face on a go-forward basis in authenticating and verifying individuals who make applications for something as simple, but as consequential, as a driver's license.
So it's a changed world in which we live.
The ACB was asked to address some questions or some areas in our testimony and I thought I would attempt to do that very quickly. And then of course we can amplify on that in questions and answers that you may have.
You first asked how we, as consumer-reporting agencies, use the Social Security Administration's Death Master File. And let me start by discussing something about the scope of the industry that we represent.
Our three major credit reporting system members—Equifax, Experian, and TransUnion—each maintain databases of approximately 200 million files on credit-active consumers in this country.
In addition to that, members such as E-funds and Dole & Media, maintain Nationwide systems as well that help prevent checking account fraud and check fraud at the point of sale and further.
In fact, we estimate, easily, that more than a billion consumer reports are sold every year in this country. And those consumer reports can carry forward and do carry forward in most cases a notification where there is a Death Master File record that we have been able to obtain.
Page 63 PREV PAGE TOP OF DOC
There are many members within our association who are, in fact, on that subscriber list. And I thought I would clarify one point that I think was lost perhaps in the previous round of testimony.
And that is that, when we say there were not many financial institutions on that listing of subscribers, that's in part, because the channel of distribution through which the DMF data is made available to a majority of the financial institution market place is through companies like the ones that we represent here with the ACB.
You've asked about technical problems with the current system and I think a lot of that has been covered in previous testimony. I think our members are also encouraged by the fact that there may be new and different technologies that could be brought to bear. There could be greater efficiencies achieved.
And I think those are the right questions and I think we'll have to work toward achieving the right answers.
Regarding other means of obtaining information, really, the only other way that the Associated Credit Bureau's members would be aware of an individual having died is through notifications that come through the systems directly from credit lenders.
When a credit lender is notified through a trustee of an estate, they in turn will notify through coding back to us the fact that that consumer's credit account is now associated with a deceased individual. And that would be a code that would then be included in a statement that would be included and referenced on that account in subsequent credit reports issued on that individual.
Page 64 PREV PAGE TOP OF DOC
You've asked about outlining ways in which sources of information can be better integrated. And let me just say that today, integration is something that we achieve through the systems that we have.
Unfortunately, I do want to state that the FTC's rules under GLB restrain us significantly in terms of building fraud prevention products outside of the Gramm-Leach-Bliley Act or the Fair Credit Reporting Act.
And let me close by making just a couple of announcements. I see I'm slowly losing time here.
Chairwoman KELLY. Mr. Pratt, you've lost time.
[Laughter.]
So if you could sum up, that would be great.
Mr. PRATT. Two announcements. Number one, we've asked all of our DMF subscriber members of the Associated Credit Bureaus to convert to monthly receipt. All members will convert to monthly subscriptions with the DMF Master File, which I think will help escalate and help make information available.
And number two, our members have established and will work with a task force to work with the Social Security Administration in working through technology and legal issues that might be associated with escalating availability of information from the Administration.
Page 65 PREV PAGE TOP OF DOC
Chairwoman KELLY. Thank you very much, Mr. Pratt.
We move now to Mr. Lehner.
STATEMENT OF THOMAS J. LEHNER, EXECUTIVE VICE PRESIDENT FOR GOVERNMENT AFFAIRS, AMERICAN FINANCIAL SERVICES ASSOCIATION
Mr. LEHNER. Thank you, Chairwoman Kelly, Chairman Shaw, Members of the subcommittees. Thank you for inviting me to testify today.
I'm Tom Lehner. I'm the executive vice president of the American Financial Services Association. AFSA is the leading trade association for market-funded financial services companies.
Our 400 member companies include consumer and commercial finance companies, auto finance/leasing companies, mortgage lenders, credit card issuers, and industry suppliers.
I'm here to address the issue of identify theft using Social Security numbers and, specifically, the industry's use of the Social Security Administration's Death Master File.
Social Security numbers are the most unique identifier of individuals in the United States. The financial services industry uses these identifiers for a variety of reasons, such as customer verification, credit checks, bankruptcy filings, and monetary judgments such as tax liens.
Page 66 PREV PAGE TOP OF DOC
The use of Social Security numbers is not generally secure. They are readily available and, indeed, used by companies, State and local governments, motor vehicle departments, colleges, and even by consumers who willingly print the numbers on the face of their checks.
Thieves often steal Social Security numbers and ultimately the identity of individuals, both living and dead. Financial institutions such as credit card companies and banks have also incurred significant losses resulting from misuse of Social Security numbers.
Consumers have also experienced monetary losses, impaired credit and legal problems because others have amassed debts using their identities.
Financial firms have an obvious interest in making sure that individuals who open accounts are who they say they are. Companies rely on the Social Security Death Master File to protect against theft.
In most cases, firms do not directly subscribe to the Death Master File, but access it indirectly through credit reporting agencies or other vendors who do subscribe to it.
This is both more efficient and less costly to the consumer.
For example, bank issuers of credit cards routinely obtain consumer reports on card applicants from credit reporting agencies. Because the credit bureaus periodically update their files by comparing information to the Death Master File, the credit report will contain an indicator if the individual has been reported as deceased. And the bank can use this information to decline the application or investigate the circumstances.
Page 67 PREV PAGE TOP OF DOC
Other financial firms such as securities broker/dealers also access the Death Master File as part of the account-opening process. This screening is typically done by third-party vendors who utilize Death Master File information.
Consumer lenders regularly use information from credit-reporting agencies to review and adjust the status of existing accounts as well. It also helps to verify customers seeking to refinance existing mortgages or those who are interested in other services offered by the financial institution.
Naturally, financial firms have other sources of information that might indicate that a customer has died and that access to the account should be frozen or terminated. The principal source is family members who called to notify the institution of the death of the customer and may request changes in the name on the account or the address where statements are sent.
Lawyers and estate executors are another source of this information.
Whether financial institutions obtain information about deceased individuals directly from the Death Master File or indirectly from other subscribers, they have an interest in obtaining information and data that is accurate and current. Delays between the date on which an individual dies and the date on which this information is made available to the public through the Death Master File increases the opportunity for identity thieves to defraud survivors, beneficiaries and financial institutions.
Page 68 PREV PAGE TOP OF DOC
One of the disadvantages of the current Social Security numbering system is that the agency is not always immediately notified upon the death of an individual. There appears to be no requirement for local officials to notify the Social Security Administration when someone dies.
Despite their best intentions, having incomplete and incorrect information makes it very difficult for the Social Security Administration to issue an accurate Death Master File.
Many companies have established internal processes that deal with fraud and identity theft. In addition, companies work with customers who are victims of identity theft and they also work with prosecutors to pursue those responsible.
AFSA supports the efforts to encourage the Social Security Administration to obtain death information promptly and report it more frequently. We also support the continued dialogue between credit-reporting agencies and financial institutions to facilitate the flow of the Death Master File information and bureau files.
For example, there may need to be a change in procedures so that when creditors report account status information to credit-reporting agencies, and this information is placed in a file of a customer about whom the bureau has received death information, the creditor is made aware of this fact on a timely basis.
We believe that more financial institutions would consider subscribing to the data directly if the information provided was in real time and more accurate. Whether financial institutions obtain information about deceased individuals directly from the DMF or indirectly from other subscribers, it's in our interest and that of the consumer that we obtain correct information.
Page 69 PREV PAGE TOP OF DOC
We've hopeful that the Social Security Administration will make both the procedural and policy changes necessary to ensure the security of our individual unique identifiers, our Social Security numbers.
Thank you.
Chairwoman KELLY. Thank you very much and thank you for limiting your testimony to the time.
We now move to Mr. Thomas Sadaka.
STATEMENT OF THOMAS A. SADAKA, SPECIAL COUNSEL, OFFICE OF STATEWIDE PROSECUTION, ORLANDO, FL
Mr. SADAKA. Chairwoman Kelly, Chairman Shaw, I truly thank you for the opportunity to be here today.
For the record, my name is Thomas Sadaka and I am Special Counsel to the Statewide Prosecutor of Florida for computer crime and identity theft prosecutions.
As the only representative of State government, as well as State law enforcement, I think a bit of a background is in order.
Florida ranks third in the Nation currently in identity theft complaints, according to the FTC. As such, we have embarked on a rather strenuous effort to combat and to curb the epidemic of identity theft.
Page 70 PREV PAGE TOP OF DOC
At the request of Gov. Bush and as a result of the Privacy Technology Task Force, which addressed issues of Social Security abuse, public records abuse, and identity theft in general, we have impaneled a State-wide grand jury and have partnered with the Florida Department of Law Enforcement to focus specifically on identity theft cases as well as what Florida can do to minimize the effects of identity theft and the victimization of her citizens.
As such, the use of the Social Security number and the use of other public records information has become apparent. It is the constant in all of the crimes that we have currently investigated.
The State of Florida, through my office, was instrumental in passing an identity theft statute. In 1999, the statute went into effect, and at that time, we were one of only three States in the Nation to actually criminalize identity theft on the local level.
That is improving. State law enforcement and legislatures are quick to enact these laws and are quick to operate on them.
As such, the investigation and the prosecution of these cases is moving along slowly. So while we've addressed the after-the-fact dealings of identity theft, we now need to turn to the issues of prevention of identity theft.
The use of the Social Security number and the use of other public records information is vitally important to the identity thief, as well as to the terrorists and others who want to shelter from society who they truly are.
Page 71 PREV PAGE TOP OF DOC
From the law enforcement encounter with the individual on the street to the airport security checker who is relying on the State-issued identification card, identity theft has a very broad base, both public safety concern as well as financial industry concern.
Our public safety issues are much more in the forefront now since September 11th. But we've been addressing these issues over the past year to try to develop fraud-proof identification as well as uniform identifiers throughout the country so that we can rely on information that's provided from other States.
State driver's license offices rely heavily on the Social Security number. Every State requires a Social Security number to be provided. Yet, the States don't avail themselves of the information available from the Social Security Administration, nor the other required information that would be available.
Several of the States do check the Master Death File. The Florida legislature commissioned us in July to conduct a study on developing a fraud-proof Florida DL.
So as part of that, I have been researching what other States do in the issuance process of identification cards.
Of those that do some type of independent verification, only a select number of them interact with the death index on a real-time basis. And although the Social Security Administration has made limited availability for online data verification of Social Security, name and geographical region, there are no States currently that avail themselves of that ability.
Page 72 PREV PAGE TOP OF DOC
The State of Florida is currently looking into the ability to expand their infrastructure such that they can rely on the information from the Social Security Administration.
There are two issues that face Congress. One is, the Social Security number has become basically our de facto national identifier. There are two subissues to that.
Do we want that to be the case? And if the Congress' decision is that, yes, that is to be the case, then there need to be laws and initiatives in place that can basically back up the integrity of that number.
There needs to be the ability of both the financial industry as well as State and local governments to verify that the Social Security number that's provided by the citizen or by the customer is truly that individual's Social Security number.
We need to confirm that the identify of that person is their true identity.
We rely heavily on breeder documents. There are currently 262 different birth certificates in circulation in the United States. Those linked with Social Security numbers and passports and documents that are available from other countries create an daunting task on the part of the administrator, who is issuing this identification card.
The Social Security Administration has within its grasp and within the other agencies of the Federal Government all of the information that is necessary to both the State and local governments, as well as the financial industry, to confirm the identity of the person who is before them.
Page 73 PREV PAGE TOP OF DOC
That information needs to be streamlined in its distribution and needs to be made available.
If the other alternative is to not allow the Social Security number to be used for that purpose, then we face another undaunting task of developing some other unique identifier, such that all of our citizens can be comfortable that the information that is represented to financial industries and to State and local governments is correct and accurate information.
Again, I want to thank you very much for the opportunity to be here today and I'd be more than willing to answer any questions at the close of the testimony.
Chairwoman KELLY. Thank you very much.
We now move to Mr. Dugan.
STATEMENT OF JOHN C. DUGAN, PARTNER, COVINGTON & BURLING, ON BEHALF OF THE FINANCIAL SERVICES COORDINATING COUNCIL
Mr. DUGAN. Thank you very much, Madam Chairwoman, Mr. Chairman. It's a pleasure to be here today.
I'm testifying today on behalf of the Financial Services Coordinating Council, or FSCC, whose members are the American Bankers Association, the American Council of Life Insurers, the American Insurance Association, the Investment Company Institute, and the Securities Industry Association.
Page 74 PREV PAGE TOP OF DOC
The FSCC represents the largest and most diverse group of financial institutions in the country, consisting of thousands of large and small banks, insurance companies, investment companies, and securities firms.
Together, these financial institutions provide financial services to virtually very household in the United States.
The FSCC continues to believe that the Social Security number plays a central role in deterring and detecting fraud and identity theft because Social Security numbers are the best unique identifier that financial institutions can use to determine whether an individual really is who he or she says he or she is.
To that end, the FSCC welcomes the attention the subcommittees are giving to the misuse of Social Security numbers of deceased individuals.
My testimony today makes three fundamental points. First, Social Security numbers are key unique identifiers that are essential to guard against identity theft.
Second, the SSA's Death Master File is a comprehensive record of deceased individuals' Social Security numbers, but delays in updating and disseminating this list can create opportunities for fraud and identity theft.
Third, because financial institutions ultimately rely, usually indirectly, almost exclusively on the Death Master File to determine whether a Social Security number belongs to a deceased individual, the more frequently the DMF is updated and disseminated and the more accessible that information is, then the more effective the list will be as a tool to detect and deter fraud and identity theft.
Page 75 PREV PAGE TOP OF DOC
On the first fundamental point, following the lead of the Federal Government, the financial services industry has used the Social Security number for many decades as a unique identifier for a broad range of responsible purposes.
For example, our Nation's remarkably efficient credit-reporting system relies fundamentally on the Social Security number as a common identifier to compile disparate information from many different sources into a reliable credit report.
The banking, insurance and securities industries each use SSNs as unique identifiers for a variety of important regulatory and business transactions, primarily to ensure again that the person with whom the financial institution is dealing really is that person.
It's that essential need to verify a person's identity using a common unique identifier—the Social Security number—that leads financial institutions to rely on the reporting of deceased individual's SSNs to guard against identity theft.
We believe there are two keys to preventing the misuse of Social Security numbers of deceased individuals.
First, the list of such numbers must be kept current. Second, the current list must be widely accessible and easy to search and cross-hatch against a given Social Security number.
Unfortunately, while the current DMF is used to accomplish both these goals, there's clearly room for improvement.
Page 76 PREV PAGE TOP OF DOC
On the first point, with respect to the currency of information in the DMF, there can be significant delays in updating the list. These are delays caused by the time taken for deaths to be reported to the SSA, delays caused by the entry of inaccurate information, and delays caused by the fact that the SSA releases comprehensive updates on only a monthly basis.
On the second point, the DMF is not provided in a form that is readily searchable. As a result, because it contains such a large amount of information, the most practical way to use the list, at least for financial institutions, is through intermediaries that convert the DMF into a searchable database that can be used by financial institutions and others.
This service by third-party vendors is valuable, but it can be costly, and cost can thus be a deterrent to the widespread use of the DMF.
Obviously, if a centralized, searchable database containing the DMF were widely available at a reasonable price, it's likely that the DMF would be used more routinely for a wider variety of authentication checks.
Let me now conclude by talking about financial institutions' use of the Death Master File.
Although the main purpose of the DMF is to inform the SSA that an individual has died, it's also purchased by private information vendors. Financial institutions ultimately rely on these vendors for accurate information about the status of individuals' SSNs.
Page 77 PREV PAGE TOP OF DOC
Therefore, while the accuracy of the DMF is crucial to saving the SSA money, it's equally crucial to financial institutions who seek to prevent fraud and identity theft.
For example, many large banks contract with information vendors to compare the bank's list of individuals who have been approved for credit cards against the DMF.
Similarly, banks, securities broker/dealers, mutual fund transfer agents, and insurance companies frequently use these information vendors to conduct the same kind of search with new account openings, changes in parties on accounts, to determine whether to allow a client to maintain a margin account, to locate lost shareholders, and for other purposes.
Simply put, the more current the DMF is, then the more current the vendor's data is, and the better financial institutions can be at uncovering identity theft and other fraud.
And with that, I would conclude. We certainly welcome suggestions for achieving both of the goals I've outlined in the testimony and we'd be happy to work with the subcommittees and their staffs to facilitate these efforts.
Thank you very much.
Chairwoman KELLY. Thank you, Mr. Dugan.
We move next to Mr. Rotenberg. Mr. Rotenberg, I'm sorry I did not have your testimony before we had this hearing. Usually, I like to have a chance to read it before.
Page 78 PREV PAGE TOP OF DOC
But I'm going to be very interested in what you have to say today.
STATEMENT OF MARC ROTENBERG, EXECUTIVE DIRECTOR, ELECTRONIC PRIVACY INFORMATION CENTER; ADJUNCT PROFESSOR, GEORGETOWN UNIVERSITY LAW CENTER
Mr. ROTENBERG. Well, thank you, Chairwoman Kelly, and Chairman Shaw. I would ask that my statement be entered into the record and I will briefly summarize the points that I'm going to make this morning.
I appreciate the opportunity to be here. I'm the Director of the Electronic Privacy Information Center. We are a public interest research group in Washington concerned with privacy issues relating to American consumers.
I have also been on the faculty at Georgetown for more than 10 years, where I teach the law of information privacy.
I think it's critical to make clear at the outset for the purposes of this hearing that there's a long-standing effort by Congress and by the courts to protect the privacy of the Social Security number in law. And this has been done from the outset out of recognition that the particular status of this number, which can be used in so many different contexts, is ripe for misuse and abuse and, as we've seen in the last few years, the growing crime of identity theft.
Page 79 PREV PAGE TOP OF DOC
So, for example, Section 7 of the Privacy Act of 1974 makes very clear in the collection and use of the SSN that Federal agencies may only use the number for certain statutory purposes.
And I'd like to say at the outset that the efforts of Chairman Shaw and other Members of the subcommittees to move forward legislation, H.R. 2036, which would extend similar protections to the private sector and strengthen as well the protections in the public sector, is a very important measure that I hope you will move quickly in this session.
Now the second part of the problem to understand is that the ID theft problem results from the growing dependence of the Social Security number as a general form of identification unrelated to the original purpose, which was of course the management of SSA benefits.
And if I may, Chairwoman Kelly, to pick up on your opening statement, I'd like to make a brief observation about this case involving Lahfti Raisi, who is the Algerian who may be responsible, in fact, for training the hijackers in the great tragedy of September 11th.
Now it has been reported that Raisi took advantage of the Social Security number of a deceased person in the State of New Jersey, presumably to obtain access to facilities in other places that he would not otherwise be able to go.
But it's not clear, at least from the reports that we have reviewed, that Raisi sought the Social Security number of a deceased person.
Page 80 PREV PAGE TOP OF DOC
In other words, this may have just been a nine-digit number pulled from the air that turned out, in fact, to be the number of a person who was deceased.
And I make this point because it's critical to understand that in the area of identity theft, there are many ways to create Social Security numbers that are not one's own that don't require access to a deceased's SSN.
You can spoof SSNs in a number of different ways. I can look at a Social Security number and probably determine whether it's accurate—in fact, a real Social Security number, computer programs and financial institutions do this on a regular basis.
But my point here is I think we need to understand that it is the growing dependence on the use of the Social Security number and whether that number comes from a person who's deceased or whether it's simply made up, is going to be an ongoing problem in systems of identification going forward.
Now this then relates to my third point about the expanded use of the Death Master File. And I fully appreciate the interest of the financial institutions in having more timely, more accurate information on an ongoing basis. So that when they are making these determinations about whether or not an SSN is the SSN of the person who represents it, they have better information on which to make that decision.
But in expanding the use of the DMF, I'm concerned also that it will create new opportunities for misuse and abuse by others, who will use that information for other purposes. Because, of course, now you will have access to a very convenient file in electronic format that will give the public a great deal of detailed personal information.
Page 81 PREV PAGE TOP OF DOC
And so I think an assessment needs to be done. How do you ensure that that information will be used only by the financial institutions for the appropriate purpose and not by others for ill-intended purpose?
I'd like to conclude, then, with three recommendations.
The first recommendation, having worked on this issue now for more than 10 years, is to urge you once again to think about systems of identification that are not solely dependent on the Social Security number. It is the SSN that contributes to ID theft and our growing use of the SSN leads to more ID theft.
Second, as I suggested at the outset, I think the legislation before the subcommittees is excellent.
And finally, if you do go forward with the proposal to make the DMF readily available in electronic format, I urge you to create some mechanism of oversight, some way to evaluate, maybe a year out, how that information is being used, because it could well be the case that that file will become a new source of identity theft, and that could simply compound the tragedy.
Thank you.
Chairwoman KELLY. Thank you very much.
Page 82 PREV PAGE TOP OF DOC
We now move to Mr. Hendricks.
STATEMENT OF EVAN HENDRICKS, EDITOR AND PUBLISHER, PRIVACY TIMES
Mr. HENDRICKS. Thank you, Madam Chairwoman, and Mr. Chairman. My name is Evan Hendricks, Editor and Publisher of Privacy Times.
I've been qualified as an expert in identity theft cases by the Federal courts and I realize I'm the last witness between not only you and lunch, but the lunch of my son, Daniel, who has accompanied me here today.
Chairwoman KELLY. We welcome your son.
Mr. HENDRICKS. Yes, thank you.
Chairwoman KELLY. Welcome, Daniel.
Mr. HENDRICKS. Thank you. This is an important issue. I'm grateful to follow my colleague, Marc Rotenberg, because I concur in his remarks and incorporate them.
What we've seen in this terrible tragedy is that not only has identity theft figured in the use for passport and visa purposes, but also the terrorists supported themselves by committing identity theft and credit fraud.
Page 83 PREV PAGE TOP OF DOC
We followed this in my newsletter, Privacy Times, which is in its 21st year; there is an excellent article in the November 4th, Chicago Tribune which summarizes many of the activities they did, including skimming, which is using a machine to swipe a card and steal all the information and then make a counterfeit card out of it.
There are two things that fraudsters want in this day and age: either a Social Security number so that they can do identity theft, or a credit card number and an expiration date.
We also know that the fraudsters are using stolen credit card numbers to buy people's Social Security numbers so that then they can commit more identity theft.
So it's becoming a vicious circle.
When the World Trade Center tragedy hit, unfortunately, it became somewhat like when there's a black-out in New York: the thieves know they can break into buildings because there's no electronic burglar alarms any more.
And unfortunately, one of the World Trade victim's friends took her credit card and went on a credit joyride, and I'm told by my friends at the Privacy Rights Clearinghouse and the Identity Theft Resource Center that a plane crash victim was going to be picked up by a limo driver who had all his information and then went on to commit identity theft.
As indicated by Congresswoman Hooley's opening remarks, there are some really sick people out there and a lot of them are now gravitating toward identity theft.
Page 84 PREV PAGE TOP OF DOC
I come here to say that, like Mr. Rotenberg, the goal of privacy laws is to give people control over their personal information. And some of the gaps and the weaknesses in our current privacy laws help the fraudsters get control over other people's information.
One of the fundamental principles of privacy laws is the information collected for one purpose should not be used for another purpose without your knowledge and consent. And this is at the heart of the Fair Credit Reporting Act, which is one of the first privacy laws enacted in 1971, amended by Congress in 1996.
It's a good law and it recognizes in practice that there are other purposes. And so, the Fair Credit Reporting Act defines permissible purposes. And it also gives people remedies, private right of action, penalties.
And I think even my colleague down the table, Mr. Pratt, will agree, this privacy law has made the credit-reporting industry a better industry. They do a better job handling data. They have to be more responsive. And if things go wrong, people have a remedy.
And so I'm also here to dispel the myth because there is really not much of a conflict between privacy law and security: all of our existing privacy laws make exceptions for law enforcement, for health and safety, and for intelligence purposes.
I think if you get into an honest discussion with the investigators, you'll see that the privacy law has not impeded the investigations here.
Page 85 PREV PAGE TOP OF DOC
But that's why we look for solutions, as Mr. Rotenberg said, we need to take advantage of information technology. We need automated exchanges of data.
Just as the Fair Credit Reporting Act defines purposes and gives people a degree of confidence that data will be used for permissible purposes, so we need to expand that concept to our larger society, including automating any sort of a Master Death File that will be shared with the banks on an instant basis, or with the credit-reporting agencies, too.
I also want to agree with Mr. Rotenberg that we need to have a national oversight office. Every other western country has an independent privacy commissioner that answers to the legislative branch.
We need one, too.
In terms of three practical solutions, the first is that, conceptually, people need to be plugged into their credit report. The technology allows for it today, and actually, we're gravitating toward this and we need to accelerate it. So if there's activity on your credit report, you should receive some sort of electronic alert.
This is not that difficult to set up and it would be one of the best ways to guard against identity theft.
Second of all, though the credit reporting agencies sell a service where they can do a trace on SSNs, it's not clear to me that they do an audit of their own systems to see how many names and addresses are associated with one SSN.
Page 86 PREV PAGE TOP OF DOC
And if they did that simple audit function, they would guard against some real problems and help clean up the integrity of their databases.
The final thing I'd like to mention is something that's called single-use credit card numbers. And Ms. Chairwoman, I heard that you had your credit card number stolen. I don't know if it was by skimming or through a database.
One company that I work with, called Privasys, has developed these prototype cards. You punch your pin number into the credit card so it can issue you a single-use number that is only good for one purchase.
So if later that number is stolen, it's worthless.
And so, there are solutions that we need in law, in organizational practice, and in technology.
Thanks very much. I'd be happy to answer any questions.
Chairwoman KELLY. Thank you, Mr. Hendricks. I'm going to ask just a couple of questions.
Mr. Rotenberg, on page 2 of your statement, I have to say, I was multi-tasking up here and reading it at the same time.
Page 87 PREV PAGE TOP OF DOC
I find this a fascinating statement. It is the financial services industry's misplaced reliance on the SSN, lacks verification procedures and aggressive marketing, that are responsible for the financial consequences of identity theft.
I want you to enlarge on that.
Mr. ROTENBERG. Well, my point, Chairwoman, is simply that the SSN has been moved from the realm of processing Social Security benefits within the Federal Government and the purpose of tax identification when it become recognized by Congress for that purpose in 1961, to a generalized identifier across the financial services sector.
Chairwoman KELLY. Yes, sir, I do understand that. My question is why you are blaming—it appears you're blaming the financial service industry's use and reliance on that Social Security number for some of the fraud.
As a matter of fact, that integrates with a comment by Mr. Pratt when he talks about the Gramm-Leach-Bliley effect on the FTC rules.
I'm wondering if the two of you can tell me—if what my interpretation is is a correct one. Are you saying that the Gramm-Leach-Bliley bill has had an effect on the use of the SSN by the financial services industry that would increase the ability for fraud to exist?
Mr. PRATT. If I may, from our perspective, the point we wanted to make in the testimony was simply that the Gramm-Leach-Bliley Act did take into account that there would be a series of exceptions to a consumer's choice for how non-public personal information could be transferred. And one of those exceptions was for purposes under the Fair Credit Reporting Act.
Page 88 PREV PAGE TOP OF DOC
But the FTC's interpretation appears to foreclose on a consumer reporting agency's ability once they have that information to then build fraud prevention products that might apply to other exceptions within the GLB 502[e] exceptions.
And clearly, to foreclose on our ability to build a fraud prevention or a verification product which would use identifying information outside of GLB and outside of the Fair Credit Reporting Act.
So, in that case, the law seems to have tightened down the screws a little too tightly on some information that we might be able to use.
Chairwoman KELLY. Do you agree with that, Mr. Rotenberg? Anyone is welcome to join in, but I want to ask that specifically of Mr. Rotenberg.
Mr. ROTENBERG. Well, I don't agree that one of the consequences of GLB was to make the Social Security number more widely available to financial institutions. I understand the point that it in some ways may restrict certain verification procedures.
But I do want to be clear about the point in my statement here. Clearly, the theft itself is not committed by the institutions. That's not what I said.
What I said, that the use of the SSN to link financial records across institutions means that when the theft has occurred, the damages are amplified.
Page 89 PREV PAGE TOP OF DOC
And so, when I said earlier that we need to think about systems of identification that are not so dependent on the SSN, it is very much based on the experience that victims of ID theft have had. When their Social Security numbers get out, then they lose control of their bank account, their credit account, and the other accounts that they may have with financial institutions.
Mr. HENDRICKS. Madam Chairwoman, can I respond to that?
Chairwoman KELLY. Mr. Hendricks.
Mr. HENDRICKS. I'll give you one example.
Identity thieves are in the business of getting credit fraudulently. They're able to do that because they apply for credit in somebody else's name and Social Security number.
The first problem is the credit-reporting agencies are too liberal in disclosing the innocent victim's credit report in response to an application made by an imposter. In many of these cases, I've seen that the city is different, the address is different, and the spelling is different. Yet, they err on the side of maximum disclosure from the credit-reporting agency to the credit granter, and that's the first problem.
The second problem is that, if the imposter simply has your Social Security number, I've seen cases—if you write these two names down—Myra Coleman and Maria Gaten. If you have the same Social Security number, their algorithms work so, since there's an M and an R and another letter in the first name, that it's similar enough to go ahead and disclose the information, even though the names are completely different.
Page 90 PREV PAGE TOP OF DOC
So there are some real application problems that were built from earlier days when they were thinking—well, women get married, they change their last name. People move a lot. As opposed to now, where we have a clear threat of identity theft and they need to update their rules for disclosing consumers' credit reports.
Mr. DUGAN. Madam Chairwoman, I'd just like to make two points.
Number one, we think the Gramm-Leach-Bliley Act, in fact, makes the misuse of Social Security numbers much more unlikely because it gives individuals more control over the ability of a financial institution to share that information with any non-affiliated third party, number one.
And number two, to the extent that information is provided for permissible purposes under the Gramm-Leach-Bliley Act, like fraud prevention, then the law specifically prohibits the recipient from using it for any other purpose.
So we think that that goes to that point particularly.
The second point I wanted to make was, it's nice to say that it's easy to steal a Social Security number, and, therefore, it's easy to steal someone's identity. But think what it would be like if you did not have a Social Security number used at all for identification purposes.
What Mr. Sadaka was saying earlier, you have to have some way to have a common, unique identifier in many circumstances, which is precisely what financial institutions use it for, to make sure that they know you are the Madam Sue Kelly that comes in the door and not a different Sue Kelly.
Page 91 PREV PAGE TOP OF DOC
There have to be ways to link that up. And the use of the Social Security number is the way we do that. Without it, and with improper restrictions on its use, it would increase the occurrence of identity theft, not decrease it.
Chairwoman KELLY. Thank you very much. I have just one follow-up for Mr. Pratt.
What percent of your membership gets the DMF?
Mr. PRATT. I actually don't have a good answer for you, but I'll be happy to follow up.
Chairwoman KELLY. I wish you would, please.
Mr. PRATT. And I think your question is in terms of the total customer base, how many customers are using the DMF product that our members produce.
Is that it?
Chairwoman KELLY. I'm going to withhold any of my further questions because I've run out of time, and go to Chairman Shaw.
Chairman SHAW. I'd like to direct my question to Mr. Pratt again.
Page 92 PREV PAGE TOP OF DOC
Our subcommittee has heard from many victims of identity theft over the last 2 years and there are stories that raise some very troubling issues pertaining to harassment and other matters.
First of all, fraudulent accounts were opened using their Social Security numbers, even though all of the information on the application was actually incorrect, including their names, addresses, and even their birthdays. And the Social Security number was the only piece of information that was correct on these applications.
A second troubling issue is that credit-reporting agencies verified this incorrect information. Verifications of a name, address, place of employment, age, or spouse's name were not questioned. If the Social Security number matched up, the information was verified and the fraudulent application was approved.
First of all, can you explain how these fraudulent applications could have been verified or accepted?
Mr. PRATT. Well, let me go to, if I could break out your question into some parts.
Chairman SHAW. Maybe you could start just by telling us, what is the process and what are the checkpoints?
Mr. PRATT. The checkpoints that we use are the Social Security number, the name, the address, and, when available, we may be also able to cross-check previous address. Those would be the principle cross-checks.
Page 93 PREV PAGE TOP OF DOC
Clearly, where we have 3 million consumers each year with last names changing, our cross-checks try to accommodate the fact that marriage and divorce occur and names can change in cycle.
Date of birth, some of the other identifying elements that you've indicated might have been on the application are not transmitted to the consumer reporting systems.
These may be issues that are addressed today differently than they may have been previously, but the cross-checks we use today are Social Security number, name and address.
In terms of why an application was approved, I'm not trying to put the monkey on someone's else back, but of course I can't tell you why the application was approved.
We transmit the information. We show the lender what information we believe in our file matches——
Chairman SHAW. Do you have any indication of where the system failed in this event?
Mr. PRATT. Well, no, sir, I really don't, because I don't have the facts in front of me specific to those particular situations.
Page 94 PREV PAGE TOP OF DOC
I'd have to look at those, I suppose, to better understand where the failure occurred.
Chairman SHAW. Let me ask the question of liability because, from your previous answer, it sounds like it's nothing but negligence on the part of whoever is putting this information together.
Under the current law, are creditors and credit-reporting agencies accountable when their negligence contributes to identity theft and to other Social Security number misuses?
Mr. PRATT. Well, I have to resist the industry being characterized as negligent under the Fair Credit Reporting Act.
Chairman SHAW. I'm not characterizing the industry. I'm just saying, in the event of negligence, are they liable?
That's a simple, straightforward question.
Mr. PRATT. The answer to the question would be, under the Fair Credit Reporting Act, we're liable for being accurate. And therefore, if we're not accurate and a lender in turn is also liable as a user and as a furnisher under the same Fair Credit Reporting Act.
Chairman SHAW. So it's your testimony that they would be liable in the cases of negligence.
Page 95 PREV PAGE TOP OF DOC
Mr. PRATT. There is negligence, there are willful and negligent standards under the Fair Credit Reporting Act and there are liabilities associated with the accuracy of the information and the use of the information.
Chairman SHAW. I'll have to go to the Act and see exactly what it says. What does it say—willful negligence, or do you know?
Mr. PRATT. There are two standards of civil liability, for example, and then of course there's administrative enforcement through the Federal Trade Commission and other functional regulators under the Act.
But the civil liability standards are willful and negligence.
Chairman SHAW. Ordinary negligence.
Mr. PRATT. Yes.
Chairman SHAW. And that makes them liable.
Mr. PRATT. Those are two standards of liability depending on the fact pattern, depending on how the suit is brought, against any one of the parties that is regulated under the Act.
Chairman SHAW. Do you think the creditors and credit-reporting agencies should be liable for these kinds of mistakes?
Page 96 PREV PAGE TOP OF DOC
Mr. PRATT. Well, I think we're on the same side of this along with you. We don't want these mistakes to happen and we want accurate information in our files, sir, really.
Chairman SHAW. If we weren't on the same side, I wouldn't be here listening to you.
Mr. PRATT. I appreciate that.
Chairman SHAW. We're trying to figure this thing out so that we don't disrupt a system of a national identifier that, for good reason or bad reason, has been in place now for a number of years.
But we do know that there's been serious misuse. We do know that this is the fastest-growing crime in the country today.
And I personally believe and I think many other people personally believe, and I think Mr. Sadaka would agree with me on this—Mr. Sadaka, I think you agree that failure to do something is going to create a snowball effect and that this thing will be totally out of control after a reasonable period of time.
Do you agree with that?
Mr. SADAKA. Yes, sir, I do.
Page 97 PREV PAGE TOP OF DOC
Chairman SHAW. Thank you. I yield back my time.
Chairwoman KELLY. Thank you.
We go to Mr. Hooley.
Ms. HOOLEY. Thank you, Just a couple of quick questions.
Anyone from the industry side can answer the first question. And that is, I understand the need for the industry to have this master list, so you can flag your files to prevent compromise by an identity thief.
What else do you do with the information? I mean, you use it to flag your files. What else do you do with the information?
Any one of you.
Mr. LEHNER. Well, as I mentioned in my testimony, it's oftentimes used to verify information on existing accounts, if people change the status of their account for some of our mortgage lenders. If a customer is refinancing their home, they're changing credit products within a company.
Usually, that information is asked as a means to verify that they are who they say they are.
Page 98 PREV PAGE TOP OF DOC
Mr. PRATT. Our members as subscribers are using it principally for fraud prevention.
Ms. HOOLEY. That's what I assume, all of you are using it for fraud prevention.
Mr. DUGAN. There are other reasons to use the information: to track down or locate lost shareholders, or to review loan applications. But principally, it's to make sure that the person is who they say they are.
Ms. HOOLEY. Would you have any opposition to having it in law that the information is solely used to flag the file of a deceased individual or for fraud prevention?
Mr. PRATT. Like all good trade associations, I'd have to go back and talk to the members, I guess, and find out whether there's anything out there that I'm just not aware of here today.
Ms. HOOLEY. OK. By the way, Mr. Pratt, thank you very much for clearing up the file of Sean. I really appreciate your doing that.
Mr. PRATT. Thank you.
Ms. HOOLEY. For either Evan or Marc Rotenberg, are you aware of any instances where information from the Death Master File has been intercepted by identity thieves?
Page 99 PREV PAGE TOP OF DOC
Are you aware of that at all?
Mr. HENDRICKS. No, not per se. The cases that I've heard of, the identity is just doing straight to the local government agency and getting information off death certificates. I've heard about cases like that and I've asked for more documentation of that.
Ms. HOOLEY. Do you think we should use it solely for flagging the files, using the Death Master list solely for flagging the files or for fraud?
Mr. HENDRICKS. Yes. You create an automated information exchange here and you specify what those purposes are and you create penalties for people that violate that and remedies for individuals whose privacy is violated.
I think that's the way to go. And I think if you look at the kind of privilege that goes between a lawyer and a client or a doctor and a patient, the privacy privilege is not so people can hide or keep data secret. It's to allow for the open exchange of information for the purposes you need—better health care, better legal advice.
And I want to take that concept and expand it to everything in our society. So privacy is protected within certain spheres, but that allows for open data exchange within the approves spheres.
Ms. HOOLEY. Thank you. That's all the questions I have.
Page 100 PREV PAGE TOP OF DOC
Chairwoman KELLY. Thank you very much. I have a couple of other questions. One for all of you as panel members.
I'd like to know if you can commit to participating on a task force with the SSA to solve this problem.
I think that if we put together—if there's a task force of the SSA, the GAO, the Commerce Department, and all of you, we could probably get to the root of the problem and get it solved much more quickly than every agency acting without consulting the others.
So I'd like to ask for a commitment from all of you to being a part of that task force. Can you commit to that?
Mr. DUGAN. Madam Chairwoman, we'd be delighted to commit to do that.
Chairwoman KELLY. Am I hearing that from all of you?
Mr. PRATT. Our testimony already indicates we support doing that.
Mr. SADAKA. Absolutely, yes.
Mr. LEHNER. Absolutely.
Page 101 PREV PAGE TOP OF DOC
Mr. HENDRICKS. Yes.
Mr. ROTENBERG. Yes.
Mr. SADAKA. We'd be very willing to commit as well.
Chairwoman KELLY. I thank you very much.
One final thing for you, Mr. Hendricks. Your son is going to have to wait for lunch for one second.
You said in your testimony that there was an independent national office to oversee and enforce the privacy law, was a recommendation of the U.S. privacy protection study commission in 1976.
I think it's time we consider something like that and I hope that you will consider that within the framework of this task force.
That being so, then I would like to, if there's no more questions, the Chair notes that some Members may have additional questions for this panel that they may wish to submit in writing.
So without objection, the hearing record is going to remain open for 30 days for Members to submit written questions to these witnesses and to place their responses in the record.
Page 102 PREV PAGE TOP OF DOC
On behalf of the subcommittees, I want to thank all of the witnesses for taking the time to be here today. I believe it's been a very productive hearing that has highlighted a problem that can be solved with regards to identity theft.
This panel is excused with our appreciation. I want to thank Chairman Shaw and his staff and other Members and all of their assistants, and my staff, for making the hearing possible.
The hearing is adjourned.
[Whereupon, at 12:25 p.m., the hearing was adjourned.]