Social Security Numbers: Governments Could Do More to Reduce	 
Display in Public Records and on Identity Cards (09-NOV-04,	 
GAO-05-59).							 
                                                                 
While the use of Social Security numbers (SSN) can be very	 
beneficial to the public sector, SSNs are also a key piece of	 
information used for committing identity crimes. The widespread  
use of SSNs by both the public and private sectors and their	 
display in public records have raised concern over how SSNs might
be misused and how they should be protected. In light of this	 
concern, GAO was asked to examine (1) the extent to which SSNs	 
are visible in records made available to the public, (2) the	 
reasons for which governments collect SSNs in records that	 
display them to the public, and (3) the formats in which these	 
records are stored and ways that the public gains access to them.
As well as looking at public records, GAO also examined the	 
practices of several federal agencies regarding the display of	 
entire nine-digit SSNs on health insurance and other		 
identification cards issued under their authority.		 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-05-59						        
    ACCNO:   A13375						        
  TITLE:     Social Security Numbers: Governments Could Do More to    
Reduce Display in Public Records and on Identity Cards		 
     DATE:   11/09/2004 
  SUBJECT:   Crime prevention					 
	     Crimes or offenses 				 
	     Federal records management 			 
	     Fraud						 
	     Identification cards				 
	     Identity verification				 
	     Public records					 
	     Social security number				 
	     Privacy law					 
	     Right of privacy					 
	     Policies and procedures				 
	     Identity theft					 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-05-59

United States Government Accountability Office

GAO

Report to the Chairman, Subcommittee on Social Security, Committee on Ways
and Means, House of Representatives

November 2004

SOCIAL SECURITY NUMBERS

 Governments Could Do More to Reduce Display in Public Records and on Identity
                                     Cards

GAO-05-59

[IMG]

November 2004

SOCIAL SECURITY NUMBERS

Governments Could Do More to Reduce Display in Public Records and on Identity
Cards

What GAO Found

Social Security numbers appear in any number of records exposed to public
view almost everywhere in the nation, primarily at the state and local
levels of government. State agencies in 41 states and the District of
Columbia reported visible SSNs in at least one type of record and a few
states have them in as many as 10 or more different records. SSNs are most
often to be found in state and local court records and in local property
ownership records, but they are also scattered throughout a variety of
other government records. In general, federal agency display of SSNs in
public records is prohibited under the Privacy Act of 1974. While the act
does not apply to the federal courts, they have taken action in recent
years to prevent public access.

With regard to the SSNs maintained in public records, various state and
local officials commonly reported needing them for identity verification.
A few, however, said they had no use for the SSN, but that documents
submitted to their offices often contained them. States also commonly
reported using the SSN to facilitate the matching of information from one
record to another. The federal courts largely collect SSNs when required
by law to do so; however, due to privacy concerns, SSNs are not in
documents that are available electronically to the public.

Public records with SSNs are stored in a multiplicity of formats, but
public access to them is most often limited to the inspection of
individual paper copies on site or via mail by request. Few state agencies
make records with SSNs available on the Internet; however, 15 to 28
percent of the nation's 3,141 counties do place them on the Internet and
this could affect millions of people. Overall, GAO found that the risk of
exposure for SSNs in public records at the state and local levels is
highly variable and difficult for any one individual to anticipate or
prevent.

Another form of SSN exposure results from a government practice that does
not involve public records per se. GAO found that SSNs are displayed on
cards issued to millions of individuals under the authority of federal
agencies for identity purposes and health benefits. This involves
approximately 42 million Medicare cards, 8 million Department of Defense
identification cards, as well as some insurance cards, and 7 million
Veterans Affairs identification cards, which display the full nine-digit
SSN. While some of these agencies are taking steps to remove the SSNs,
there is no governmentwide federal policy that prohibits their display.
Although we did not examine this phenomenon across all federal programs,
it is clear that the lack of a broad, uniform policy allows for
unnecessary exposure of personal Social Security numbers.

                 United States Government Accountability Office

Contents

Letter

Results in Brief
Background
SSNs Are Widely Exposed in a Variety of Public Records Held by

States, Local Jurisdictions, and Courts, but Less Exposed in
Federal Records
Identity Verification Is the Most Common Use of SSNs in Public
Records

Public Documents with SSNs Are Stored in a Multiplicity of
Formats, but Hard Copy Is Still the Most Widely Available Form
of Public Access

Millions of Federal Health Insurance and Identity Cards Display the

SSN
Conclusions
Recommendation
Agency Comments and Our Evaluation

                                       1

                                      3 5

                                       8

15

19

29 31 32 33

Appendix I Objectives, Scope, and Methodology

Appendix II State and Local Government Survey Questions

Appendix III State Survey Response Rates by Function and State 47

Appendix IV Extent of SSN Availability in State Public Records

Appendix V	Types of Public Records Held by Local Government
Offices 52

Appendix VI Comments from the Department of Defense 55

        Appendix VII Comments from the Office of Personnel Management 56

Appendix VIII Comments from the Social Security Administration

Appendix IX GAO Contacts and Staff Acknowledgments 59

GAO Contacts 59 Staff Acknowledgments 59

Tables

Table 1: Availability of Public Records Containing SSNs by Number of
States

Table 2: Reasons Reported by State Agencies for Collecting or Using SSNs
That Are Displayed in Public Records

Table 3: A Sample of Responses from County Officials Who Selected "Other"
in Response to "Why does your office collect or use SSNs" for Specific
Types of Records

Table 4: State Office Use of Multiple Storage Methods for Specific Types
of Records Containing SSNs

Table 5: Recent State Laws Restricting Public Disclosure of SSNs Cited by
Survey Respondents

Table 6: Out of Sample Respondents and Reasons for County Government
Survey

Table 7: Response Rates for State Functions Surveyed

Table 8: State Response Rates

Table 9: Record Type Forms Sent to Local Government Officials, by
Functional Area

9 16

18

21

24

39 47 48

53

Figures

Figure 1: Types of Public Records Displaying SSNs Most Often Cited by
State Offices 10 Figure 2: Percent of Local Government Records with SSNs
Available to the Public, by Function 11 Figure 3: Percent of Counties in
Which Specific Publicly Available Records Contain SSNs 13

Figure 4: Percent of Local Government Records with SSNs, by Reason for
Collecting or Using SSNs 17 Figure 5: State Agency Practices for Storing
Public Records That Display SSNs 20 Figure 6: Methods of Access to State
Public Records Containing SSNs 22 Figure 7: Number of State Agencies
Citing Each Change to SSN Access for at Least One Record Type 23 Figure 8:
Percent of Counties Giving Access to Public Records Displaying SSNs, by
Method of Access 27

Abbreviations

CMS Centers for Medicare and Medicaid Services
DoD Department of Defense
MCD minor civil division
NACO National Association of Counties
NARA National Archives and Records Administration
OMB Office of Management and Budget
SSA Social Security Administration
SSN Social Security number
UCC Uniform Commercial Code
VA Department of Veterans Affairs

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

United States Government Accountability Office Washington, DC 20548

November 9, 2004

The Honorable E. Clay Shaw
Chairman
Subcommittee on Social Security
Committee on Ways and Means
House of Representatives

Dear Mr. Chairman:

The Social Security number (SSN) is used by federal, state, and local
government agencies for a myriad of purposes, including data sharing,
research, and the administration of programs that deliver services and
benefits to the public. In the course of public business, government
agencies create, collect, or maintain many records or documents that
contain SSNs, many of which are often made available to the public in
their entirety for inspection. These governments may also handle SSNs
that, while not exposed in public records, are nevertheless subject to
public view because they are printed on individual eligibility and
identification cards. While federal and state laws may authorize or
require
the use of SSNs, there is no single federal law governing their handling
by
all levels and branches of government or restricting their display to the
public. State laws also vary in regulating SSN use and exposure to public
view.

While the use of SSNs can be extremely beneficial to the public sector,
SSNs are also a key piece of information used in identity thefts,
including
creating false identities for financial misuse or for assuming another
individual's identity. The widespread use and retention of SSNs by both
the public and private sectors may provide opportunities for criminals to
easily obtain and misuse this personal information. In particular, the
availability of individuals' SSNs in public records has raised concern
over
how this personal information might be misused and how it should be
protected. Historically, the general public has gained access to public
records by visiting the offices that maintain them-this offered practical
limits on the volume of SSNs that could be disclosed. Today, however, the
growth in electronic record keeping and the increasing availability of
such
information in volume over the Internet have heightened concern about
misuse, particularly in view of the rise in identity thefts. We previously
reported in 2002 that few government entities that display SSNs in public

records were making them available on their Web sites, but some were
considering doing so or expanding the volume and type of such posting.1

In light of the potential for increasing exposure, theft, and misuse of
SSNs, you asked us to identify common methods of storing public documents
with SSNs and to determine the extent to which the public has access to
them. To do this, we addressed three questions: (1) To what extent are
SSNs visible in records that are made available to the public? (2) For
what purpose do governments collect SSNs in records that display them to
the public? (3) How are these records stored and what methods can the
public use to access them? In addition to looking at public records, we
examined the practices of several federal executive branch agencies
pertaining to the display of SSNs on health insurance cards and other
identification cards issued under their authority.

To answer these questions, we conducted research at federal, state, and
local levels of government. To obtain information at the federal level, we
reviewed the Privacy Act and other related statutes and conducted personal
interviews with officials of 10 federal agencies. Data gathering at the
state level included a Web-based survey to state agency heads that oversee
eight pre-selected programs or functions in all 50 states and the District
of Columbia (D.C.). In a previous GAO survey, these programs or functions
were identified as frequent users of SSNs and likely to have public
records.2 They included (1) human services, (2) health and vital
statistics, (3) selected professional licensing offices, (4) law
enforcement, (5) the judiciary, (6) corrections, (7) public safety, and
(8) labor. At the state level, our survey of the judiciary consisted of
the office of the State Court Administrator in each state. We also
conducted a survey of various local government officials within a
probability sample of 200 counties across the United States, allowing us
to generalize to the population of U.S counties. At the local level, we
surveyed (1) courts, (2) health departments, (3) law enforcement, (4)
recording officials,3 (5) social

1GAO, Social Security Numbers: Government Benefits from SSN Use but Could
Provide Better Safeguards, GAO-02-352 (Washington, D.C.: May 31, 2002).

2GAO-02-352.

3County recording officials typically maintain documents pertaining to
property ownership, including mortgages, deeds, and leases. Their offices
also may maintain wills, creditor filings, notices of liens, military
discharge papers, and marriage licenses. The responsibilities of these
officials varies by state and county and they may be referred to by any
number of titles including, clerk, recorder, register, or auditor.

services, (6) tax assessors, and (7) voter registrars. At the local level,
our survey of the judiciary included trial courts and courts of limited
jurisdiction operating in the counties in our sample. The state survey
results are based on responses from 338 out of 542 state agencies, with
responses from all 50 states and D.C. The local government survey results
are estimated with a response rate of about 81 percent.4 The questions
asked in each survey are listed in appendix II. We conducted our work
between March 2003 and September 2004 in accordance with generally
accepted government auditing standards. For additional information on our
methodology, see appendix I.

                                Results in Brief

We found that SSNs are widely exposed to view in a variety of public
records, particularly those held by state and local governments, and
appear in some public record nearly everywhere in the nation.
Specifically, agencies in 41 states and the District of Columbia reported
that SSNs are accessible in at least some of the public records they hold
and a few reported this to be the case for as many as 10 or more different
records. Additionally, we estimate that more than three-quarters of U.S.
counties hold at least one type of record that displays SSNs, which has
implications for the 94 percent of the U.S. population that we estimate
live in those counties.5 While we found SSNs displayed in a great variety
of state and county records, they were most often displayed in court and
property records. On the other hand, SSNs in records held by federal
executive branch agencies are protected under the Privacy Act of 1974 and
are, therefore, not generally available to the public. However, we found
that SSNs are sometimes available in federal court records.

State and local government respondents to our survey commonly cited
identity verification as a reason for collecting or using SSNs in records
that are available to the public, but some agencies reported having no use
for the number. State agencies also reported collecting the SSN to

4While we received a completed survey from at least one program area in
each county, the response rates within each county varied from 1 program
area in a county to all program areas. The response rates for each program
area were courts (79 percent), health departments (79 percent), law
enforcement (80 percent), recording officials (88 percent), social
services (79 percent), tax assessors (85 percent), and voter registrars
(86 percent).

5Population estimates are based on July 1, 2002, Census Bureau estimates
of the entire county population, adults and children. We acknowledge that
not all people in a county would be directly identified on a public record
but rather that there is the potential to be identified on certain
records.

facilitate matching with other records or data-the second-most cited
purpose among states. For local government offices, the second most
frequently cited reason was to meet state legal or regulatory
requirements. However, some state and local offices said they had no
specific use for the SSN in a particular type of record, but that
documents submitted to their offices often contain them. The federal
courts routinely collect SSNs for records in bankruptcy filings in order
to ascertain the identities and holdings of debtors. SSNs are also
routinely collected by the federal courts for Social Security claims
cases. According to the Administrative Office of the U.S. Courts, however,
due to privacy concerns Social Security cases are not available
electronically to the public.

Public documents with SSNs are stored in a multiplicity of ways, and we
found that public access methods are highly variable. State government
offices tend to store such records electronically, while most such local
government records are stored on microfiche or microfilm. However, for
both levels of government, inspection of paper copies is the most commonly
available method for public access. Few state agencies make records
containing SSNs available on the Internet. However, we estimate that local
government offices in as many as 15 to 28 percent of counties do make SSNs
available through the Internet. Still, few state or local offices reported
plans to put additional records on the Internet. Additionally, some state
and local offices have begun restricting access to SSNs in public records
overall. Moreover, at the federal level, the federal court system has
recently taken action to restrict access to SSNs in their public records.

In our work, we also found another kind of exposure in the form of
identity cards issued by federal agencies to individual employees, program
beneficiaries and military personnel. Though not visible through public
databases, these SSNs are nevertheless visible on the identity cards
issued to millions of individuals by federal agencies. The display of
nine-digit SSNs on such cards, which may need to be carried and must often
be disclosed, puts cardholders at risk for identity theft due to the
increased potential for accidental loss, theft, or visual exposure.
Currently, this practice involves an estimated 42 million Medicare cards,
8 million Department of Defense identification cards, as well as some
insurance cards, and 7 million Department of Veterans Affairs
identification cards. Approximately 830,000 federal employees also carry
health insurance cards, issued as part of the Federal Employees Health
Benefits Program (FEHBP), which display the bearer's full SSN. Three
federal agencies, the Office of Personnel Management (which administers
the FEHBP), Department of Defense, and Veterans Affairs, are taking action
to remove

SSNs from health insurance cards or some identification cards in
recognition that the exposure of individuals' SSNs may increase their
vulnerability to identity theft. However, there is no single federal
policy governing SSN display on such cards.

Given the potential for misuse created by the display of SSNs on cards,
therefore, we are recommending that the Office of Management and Budget
identify all those federal activities that require or engage in the
display of nine-digit SSNs on health insurance, identification, or any
other cards issued to federal government personnel or program
beneficiaries, and devise a governmentwide policy to ensure a consistent
approach to this type of display. We provided a draft of this report to
the Administrative Office of the United States Courts, the Centers for
Medicare and Medicaid Services, the Department of Defense, the National
Archives and Records Administration, the Office of Management and Budget,
the Office of Personnel Management, the Social Security Administration,
and the Department of Veterans Affairs for comment. Officials at each
agency confirmed that they had reviewed the draft and generally agreed
with its findings and recommendation. See appendixes VI through VIII for
the formal written comments from the Department of Defense, the Office of
Personnel Management, and the Social Security Administration respectively.

Because the SSN is unique for every individual, both the public and
private sectors increasingly use it as a universal identifier. It is
particularly useful to government for data matching or identity
verification to ensure that individuals are eligible for program benefits
or services. Though the use of SSNs by government entities is often
mandated or authorized by law, there is no one law that regulates the
overall use of SSNs by all levels and branches of government, and state
laws pertaining to SSN display vary in terms of the restrictions they
impose on both use and disclosure. Due to the pervasive use of SSNs,
individuals are routinely asked to disclose their SSNs along with other
personal, identifying information, for numerous purposes. In some
instances where individuals provide their SSNs to government entities,
documents containing the SSN are routinely made available to the public
for inspection.

Generally, the overall use and disclosure of SSNs by the federal
government is restricted under the Privacy Act, which, broadly speaking,
seeks to balance the government's need to maintain information about
individuals with the rights of individuals to be protected against
unwarranted invasions of their privacy. Section 7 of Public Law 93-579

  Background

requires that any federal, state, or local government agency, when
requesting an SSN from an individual, tell individuals whether disclosing
their SSN is mandatory or voluntary, cite the statutory or other authority
under which the request is being made, and state what uses it will make of
the individual's SSN.6 Based on a survey for prior work, we reported that
while nearly all government entities we surveyed collect and use SSNs for
a variety of reasons, many of these entities reported they do not provide
individuals the information required under this statute when requesting
their SSNs.7 Further, it is unclear who has responsibility for overseeing
these requirements placed on state and local governments.

The growth in the use of SSNs is important to individual SSN holders
because these numbers, along with names and birth dates, are among the
three personal identifiers most often sought by identity thieves, and
recent statistics indicate that the incidence of identity theft is
growing. The widespread disclosure of SSNs in public records has raised
concern because it can put individuals at increased risk for identity
theft. The passage of identity theft legislation by the federal government
and state governments indicates that this type of crime is widely
recognized as a serious problem. Some of these laws include limits or
restrictions on the display of SSNs, and government agencies have taken
other measures to restrict the exposure of SSNs as well. For instance,
most states have modified their policies on placing SSNs on state drivers'
licenses, some prohibit the use of SSNs as a student identification
number, and others have removed SSNs from checks and benefit statements.
These actions suggest that the risk of SSN exposure is also widely
recognized.

As governments move increasingly to electronic record keeping, access to
documents that include Social Security numbers has become easier. To the
extent that such records are available through the Internet, ease of
access can increase exponentially. The growth of electronic record keeping
has, in fact, made it easier for some agencies to provide or even sell
their data in bulk. In our previous research, a few government agencies
and courts reported to us that they were also considering the prospect of
expanding the volume and type of public records that would be available on
their Web sites. Currently, congressional lawmakers are considering
legislation to curtail such exposures, looking at both public and private
sector uses.

6This provision is found at 5 U.S.C. 552a(note).
7For more information on the prior study and on the Privacy Act see
GAO-02-352.

Not all records held by government or public agents are "public" in terms
of their availability to any inquiring person. Governments hold many
records that are not generally available and other records that are
protected from public access. For example, adoption records are generally
sealed. Personnel records are often not readily available to the public,
although newspapers may publish the salaries of high, elected officials.
Furthermore, governments may release portions of records but protect
sensitive information within them, which includes Social Security numbers.
Treatment of similar types of records varies among federal, state, and
local governments. Furthermore, there is no common definition of public
records. For this report, however, we refer to public records as those
records generally made available to the public in their entirety for
inspection by a federal, state, or local government agency. Such documents
are typically accessed in a public reading room, clerk's office, or on the
Internet.

In our previous review of government use of SSNs, we found that they are
prevalent in records held by government agencies, some of which were
available to the public.8 We also learned that courts at all three levels
of government maintain public records containing SSNs, such as divorce
decrees, child support orders, and bankruptcy cases. At that time, some
officials who maintained these records told us their primary
responsibility was to preserve the integrity of these records rather than
protect the privacy of the individual SSN holder. However, we also found
that some agencies were trying to better safeguard the SSN by using
innovative approaches, such as by modifying their processes or their
forms. Some agencies and courts also reported limiting the practice of
placing public records containing SSNs on Web sites. The most far-reaching
efforts we identified took place in states that had established statewide
policies and procedures. However, this research focused, in general, on
how and why governments use SSNs, and did not examine in detail, the
extent to which SSNs are exposed to the general public and potentially
available for misuse.

8See GAO-02-352.

  SSNs Are Widely Exposed in a Variety of Public Records Held by States, Local
  Jurisdictions, and Courts, but Less Exposed in Federal Records

We found that SSNs are widely exposed to public view in state and local
records, but less so in federally held records. Specifically, 41 states
and the District of Columbia reported displaying SSNs in public records,
and we estimate that over three-quarters of counties do so as well. The
number and type of records in which SSNs are displayed varies greatly for
both states and counties, but they are most often found in court records
and local property records. For federal executive branch agencies, records
are covered by the Privacy Act of 1974, which generally prohibits
disclosure of SSNs and other personal information. However, we found that
SSNs are available in some federal court records.

Most States Display SSNs in at Least Some Public Records, but the Types of
Records Vary

According to our survey, most states maintain at least one type of public
record that reveals individual SSNs. Agencies in 41 states as well as the
District of Columbia reported holding at least one type of public record
that shows the SSN. This may understate their exposure, however, given
that we received responses from only 62 percent of the state agencies we
surveyed. Nevertheless, we received responses from agencies in every
state. The number of these reported records ranged from 1 to 9 for most
states, but was much higher for a few states. (See table 1.) (Appendix III
provides a complete list of state and state function response rates9).

9The overall response rate for the state survey was 62 percent. In 37
states and D.C., we received responses from more than half of the agencies
surveyed. We received responses from about half or fewer of the states in
three functions: law enforcement, cosmetology licensing, and notary public
licensing. For the judiciary, human services, and health services and
vital statistics, three functions that we believe are most likely to
maintain records impacting large proportions of residents, the response
rates were 61 percent, 69 percent, and 60 percent, respectively.

Table 1: Availability of Public Records Containing SSNs by Number of
States

This many types of public In this many states records contain SSNs

1 - 4

5 - 9

10 - 19

20 or more

Source: GAO survey of state agencies.

Note: Out of 338 agencies that responded to our survey, 90 have at least
one type of public record in which SSNs are openly displayed. Our
responses also show that in 9 states, SSNs are not shown in any public
records. However, since we did not receive responses from all state
agencies we surveyed, SSNs could be available through public records in
these 9 states.

Among the types of records reported by the 338 state agencies responding,
we found no one public record in which the SSN was always displayed. The
most frequently cited, however, were those held by state courts. These
ranged from criminal proceedings and litigation and civil case files to
traffic records and records of judgments. (See fig. 1.) Appendix IV shows
how state agencies responded to our question on whether SSNs are displayed
in public records.

Figure 1: Types of Public Records Displaying SSNs Most Often Cited by
State Offices

Number of states

19 19

                                       20

We estimate that individuals' SSNs are displayed in some public records in
80 to 94 percent of U.S. counties. While not everyone would be identified
in such records, we estimate that this exposure could potentially affect
any one of the estimated 91 to 97 percent of the U.S. population that
lives

10

in these counties.

According to our survey, the county records in which SSNs are most often
revealed are those held by recorders and court clerks. (For a description
of the types of records held by each program area see app. V.)
Specifically, we estimate that 58 to 68 percent of records held by courts
and 50 to 68

10Population estimates are based on July 1, 2002, Census Bureau estimates
of the entire county population, adults and children.

                                       18

                                       16

                                       14

                                       12

                                      10 8

                                       6

                                       4

                                       2

                                       0

Records of criminal proceedings civil case filesDeath recor

                                     ds ds

judgmentsRecords of

cialCode filingsDiv

                              ds essional licenses

affic recorrT

ce recorro

                                   rm Commer

oUnif

ofpr

                     Source: GAO survey of state agencies.

Note: Results based on responses from 90 agencies in 41 states and the
District of Columbia that have at least one type of public record in which
SSNs are openly displayed, out of 338 total responses.

More Than 75 Percent of U.S. Counties Hold Some Public Records That
Display SSNs

percent held by recording offices contain publicly accessible SSNs, while
only 5 to 9 percent of records held by all other functions included in our
survey contain SSNs.11 Figure 2 shows our estimates of the percent of
records that display SSNs to the public held by different types of local
government offices.

Figure 2: Percent of Local Government Records with SSNs Available to the
Public, by Function

Percent

63

                                       59

tsCour

officialsRecordingw

Lacement Health

                                       s

vicesSocialser

                                   department

xTaassessor Registrar

                                    of voter

orenf

Source: GAO survey to local governments.

Note: The 95 percent confidence interval is within +/-6 percent, except
for recording officials, for which it is +/- 9 percent.

Courts and recording offices hold a substantial variety of records. For
example, courts hold criminal proceedings, civil cases files, and traffic
records, among others. Recorders also maintain a variety of records,
including many concerning property ownership. We estimate that 80 to 94
percent of U.S. counties have publicly available court or property

11The county survey results were estimated based on a sample allowing us
to generalize to the population of U.S. counties. We are 95 percent
confident that when sampling error is considered, the results we obtained
for the county survey are within +/-7 percentage points unless otherwise
indicated.

ownership records with SSNs. Specifically, SSNs are available to the
public in records of criminal proceedings in 44 to 64 percent of counties
and in divorce records in 12 to 26 percent of counties-two kinds of
records that are often held by courts. SSNs are also displayed in some
other types of records-including, military discharge records and Uniform
Commercial Code (UCC) filings.12 Figure 3 shows the percent of counties in
which specific types of records display SSNs to the public.

12The UCC addresses commercial transactions (including sales and leasing
of goods, transfer of funds, commercial paper, bank deposits and
collections, letters of credit, bulk transfers, investment securities, and
secured transactions). As used in this report, a UCC filing-or financing
statement-is a document stating that a person (secured party) has a claim
(security interest) in certain property (collateral) financed for someone
else (debtor). UCC recordings are filed either at the state or local
level, according to state law. Typically, a person would not file a UCC
financing statement unless they are engaged in some form of commercial
transaction that involves a debtor and a secured party.

Figure 3: Percent of Counties in Which Specific Publicly Available Records
Contain SSNs

Records of criminal proceedings 54 Litigation and civil case files Records
of property liens and other judgments

                                                              Traffic records
                                  Mortgage and real property transfer records
                                                         Records of judgments
                                                        Child support records
                                                        Child custody records
                                               Estate and inheritance records
                                                   Military discharge records
                                                      Child paternity records
                                                                  UCC filings
                                                        Name change petitions
                                                   Property ownership records
                                                              Divorce records

Death records

Marriage licenses or applications

Records of criminal arrest warrants

Voter registration records

0 10 20 30 40 50 60 70 80 90100

Percent of counties Source: GAO survey of local governments. Note: The 95
percent confidence interval is within +/-10 percent.

While we know of no particular type of record relevant to all individuals
in a given county, there are some records that may pertain to a large
number of residents. These would be records that document activities or
transactions many people engage in-for instance, home mortgage records or
voter registrations.

To illustrate the potential for an individual's SSN to be identified in a
public record, we have estimated the percent of the population that lives
in counties in which SSNs are available in certain types of records. For
instance, we estimate that 27 to 41 percent of the population lives in
counties in which SSNs are available to the public in traffic records.
Further, from 49 to 63 percent of the population lives in counties in
which SSNs are available in mortgage and real property transfer records,
and from 16 to 28 percent lives in counties in which SSNs are available in
divorce records.

Under the Law, SSNs Are Generally Not Available to the Public in Federal
Executive Records, but They Can Be Viewed in Some Federal Court Records

While the federal government compiles a wide range of information on
individuals that often includes SSNs, the Privacy Act of 1974 may prohibit
their disclosure, along with other personal information, without the
consent of the individual.13 Specifically, SSNs in record systems-specific
groups of records-held by federal executive agencies are generally not
available to the public.14 SSNs that are not held in a system of records,
however, may not be governed by any other law or regulation and,
therefore, may be exposed on a limited basis. However, there was no way to
ascertain where they might be or the degree of any public access.
Nevertheless, officials we interviewed in 5 selected agencies reported
that they were not aware of any records maintained by their agencies-in a
system or otherwise-that display SSNs to the public.

Federal court records are generally available to the public, but the
courts have supervisory power to withhold certain information from public
examination.15 Statutes also require records disclosure in some
instances.16 Social Security numbers are sometimes found in these
records.17 According to officials of the Administrative Office of the U.S.
Courts, SSNs are available in certain types of records because the SSNs
are required by

13The Privacy Act applies to records about individuals maintained by
agencies in the executive branch of the federal government. For a fuller
discussion of the Privacy Act see GAO-02-352.

14The act applies to records only if they are in a "system of records,"
which means that they are retrieved by an individual's name, SSN, or some
other personal identifier.

15See Nixon v. Warner Communications, Inc., 435 U.S. 589 (1978).

1611 U.S.C. S:107(a).

17The Privacy Act does not apply to Congress, the federal courts, and
other nonexecutive branch agencies (see S:S: 551(1), 552(f)(1) and 552
(a)(1). However, it is the policy of the Administrative Office that the
intent of the Privacy Act be followed in the judicial branch.

  Identity Verification Is the Most Common Use of SSNs in Public Records

law. Occasionally, but not routinely, SSNs are available in other files
throughout the federal court system when attorneys of record include this
information in documents filed with the court. In the last 2 years,
however, the Judicial Conference of the United States, which establishes
policy for the federal judiciary, revised federal policy in bankruptcy
cases so that only the last four digits of any SSN will be visible to the
general public in new record entries.18

State and local government respondents to our survey reported frequently
using SSNs in public records to verify identities or to meet state legal
requirements, but some agencies said they had no need for them.19 For
state agencies, the second most frequently cited purpose for using SSNs
was to match information in other records or databases. Among local
government agencies the second most frequently cited reason was to comply
with state law or regulations. However, some state and local offices
reported that they had no specific use for the SSNs in certain records,
although they were often contained in documents submitted to their
offices. The federal courts reported routinely collecting SSNs to
ascertain the identities and holdings of debtors involved in bankruptcy
filings. Courts also reported routinely collecting SSNs for Social
Security claims cases.

In State Public Records the SSN is Most Often Collected or Used for
Identity Verification

Identity verification was the most frequent reason given by our state
survey respondents for collecting or using SSNs that are shown in public
records. Fifty-four state agencies representing 30 states cited this
reason. Ten agencies, representing 8 states, indicated there was no
specific reason for collecting or using the SSN in a particular type of
public record. Table 2 shows the reasons cited for collecting or using
SSNs in public records and the number of state agencies that gave each
reason.

18The Judicial Conference of the United States was created by federal law
and establishes policies for the judicial branch. The Administrative
Office of the United States Courts is the administrative arm of the
federal Judiciary charged with implementing Conference policies.

19Survey respondents were asked to provide reasons for collecting or using
SSNs in public records. They were provided a list of responses and asked
to check all that apply for each record type. See appendix II for a
complete list of the survey questions and possible responses.

Table 2: Reasons Reported by State Agencies for Collecting or Using SSNs
That Are Displayed in Public Records

          Reasons for collecting or using SSN Number of state agencies

Identify verification

Matching with other records or data

Directed by state law or regulation

Data exchange or sharing

Directed by federal law or regulation

Used as file or record number

Benefit coordination or credit check

Other

No specific use

Source: GAO survey of state agencies.

Note: Out of 90 state agencies that provided responses to our question on
reasons and uses for collecting SSNs. Respondents were asked to provide
reasons for each record type they maintained and were allowed to check
more than one reason or use for each record type.

Other reasons state agencies gave were primarily to collect fines, fees,
or judgments, and because the SSNs were already included in documents that
became part of the public records. Some of these respondents gave specific
examples of how the SSN is used for identify verification or benefits
determination. Three respondents noted that SSNs are used to facilitate
investigations of wrongdoing.

SSNs in Local Government Public Records Are Most Often Used for Identity
Verification, but Many Recording Offices Receive Records with SSNs They Do
Not Need

SSNs in local government public records are most often collected or used
for identity verification. After identity verification, other common
reasons include complying with state laws and regulations and matching
with other records. Additionally, quite a few offices maintain public
records that contain SSNs for which they have no use. Figure 4 shows
reasons that SSNs are in local public records and our estimates for the
percent of such records that contain SSNS for each purpose.

Figure 4: Percent of Local Government Records with SSNs, by Reason for
Collecting or Using SSNs

Percent

                                       47

50

40

30

20

10 0

                       verification records/dataData e e

BenefitcoordinationCredit c

                                       y

                          w/regualation w/regualation
                                       la
                                   Directed b

hangcxor sharing

                          state Other No specific use

File orumber Identityd n

                                Match with other

khec

                                    ederalf

y laDirected b

recor

Source: GAO survey of local governments.

Note: The 95 percent confidence interval is within +/-7 percent.
Respondents were asked to provide reasons for each record type they
maintained and were allowed to check more than one reason or use for each
record type.

Reasons for collecting SSNs in public records varied across different
functional areas at the county level. Among local courts, identity
verification is the single most common use of SSNs in public records,
while recording offices collect or use SSNs in public records to comply
with state laws or regulations more often than any other specific purpose.
Among all other functions, SSNs are most frequently used for identity
verification, matching with other records, and complying with state laws
or regulations. Recorders also frequently maintain records that contain
SSNs for which they have no use. On the basis of our survey, we estimate
that 25 to 51 percent of records with SSNs held by recording offices
contain the number for no specific purpose. In addition, the survey
responses of some recording officials indicated that SSNs are not required
or requested by their offices, but they may appear in records filed in
their offices nonetheless. Some respondents indicated that their job is to
maintain the record only-they cannot amend or change it. Table 3 is a

sample of responses from those who checked the "other" option to the
question asking why SSNs are collected or used in specific types of public
records. (For the complete survey question and response categories, see
appendix II.)

Table 3: A Sample of Responses from County Officials Who Selected "Other"
in Response to "Why does your office collect or use SSNs" for Specific
Types of Records

              Form             Function             Survey response           
      Records of criminal     Court clerk It is provided to us; we don't ask  
          proceedings                                   for it.               
      Records of criminal     Court clerk We don't want them - they just put  
          proceedings                                  them on.               
      Records of criminal     Court clerk Other agencies provide - the court  
          proceedings                              does not collect.          
Litigation and civil case  Court clerk Attorney places # on complaint & is 
             files                           not used by court in any way.    
Litigation and civil case  Court clerk SSNs are part of records file with  
             files                           us by parties to the action.     
     Estate and inheritance   Court clerk We do not screen public records for 
            records                       SSNs & remove. If there, we leave   
                                                         them.                
     Estate and inheritance   Court clerk We do not request the information,  
            records                         attorneys add it to some forms.   
                                            Not required in Maine, but listed 
Mortgage and real property  Recorder     on some documents prepared out of 
            transfer                                                   state. 

records Records of property liens and other judgments

Mortgage and real property  Recorder     SSNs are added by the mortgage    
            transfer                                  companies.              
            records                       
                                                  Documents are presented for 
Mortgage and real property  Recorder      recording with the # on them. We 
            transfer                                                  are not 
            records                              authorized to change.        
                                          We do not use or collect. The       
Mortgage and real property  Recorder   lender chooses to put the SSN on    
            transfer                      the                                 
            records                                    document.              
Records of property liens   Recorder     We do not require SSNs for our    
           and other                                   purposes.              
           judgments                      
Records of property liens  Court clerk                                     
           and other                           Must record as presented.
           judgments                      

 Recorder We do not collect SSN. If they are on the document they are recorded.
  Records of property liens and other Recorder Preparer of instrument does not
                   want to remove the # from the instrument.

judgments

Records of property liens  Court clerk Documents are received with SSN and 
           and other                            we cannot alter or change any 
           judgments                                   document.              
Military discharge records  Recorder   The SSN is on the document when it  
                                                comes into the office.        
Military discharge records  Recorder    Already on record when presented.  

      Military discharge     Recorder    We do not use or collect SSNs - they 
           records                         are put on document by government. 
Child paternity records  Court clerk     Included in petition filed by     
                                                      attorney.               
                                             We have no control over the      
                            Court clerk  information people want to disclose  
Child paternity records                               in                   
                                                     pleadings.               
       Divorce records      Court clerk   Documents are submitted that way.   

Source: GAO survey of local governments.

Federal Executive and Judicial Branches Collect and Use SSNs for Purposes
Required or Permitted by Law

  Public Documents with SSNs Are Stored in a Multiplicity of Formats, but Hard
  Copy Is Still the Most Widely Available Form of Public Access

Federal agencies engage in a wide range of required or permitted uses of
SSNs, such as electronic matching of information in databases. Various
federal laws and regulations require or permit federal agencies to collect
and use SSNs when administering federal programs. However, as noted above,
due to Privacy Act provisions, in most cases these SSNs are not available
to the public. Concerning the federal judiciary, SSNs are generally
required for bankruptcy and Social Security claims cases. SSNs are
generally not required with regard to other civil or criminal cases.

Storage methods and forms of public access to records with SSNs vary
somewhat among the different levels of government, but hard copy is the
most common form of access for the public, and some agencies have begun to
reduce SSN exposure. State government offices tend to store such records
electronically, while most such local government records are stored on
microfiche or microfilm. However, for both these levels of government,
inspection of paper copies is the most commonly available method for
public access to such records. Few state agencies make them available on
the Internet. In counties, however, we estimate that offices in as many as
15 to 28 percent-several hundred-do so. For the future, however, few state
or local offices reported any plans to place additional records on the
Internet. Some state and local offices reported that in recent years they
had begun to restrict access to SSNs in public records. At the federal
level, the National Archives stores many federal agency documents, with
access restricted by law. For its part, the federal court system has
recently taken action to restrict access to SSNs in its public bankruptcy
records, including those on the Internet.

While State Public Records State agencies responding to our survey
generally store public records that Containing SSNs Tend to display SSNs
electronically. Electronic databases or indexes was the most be Stored
Electronically, frequently cited storage method. Microfiche or microfilm
and computer

usable media such as DVDs, CD-ROMs, diskettes, or tapes were alsoPublic
Access Is Usually frequently cited. Figure 5 shows the number of state
agencies using eachLimited to Hard Copies storage method we asked about in
our survey.

Figure 5: State Agency Practices for Storing Public Records That Display
SSNs

                          Number of state agencies 60

                                       55

                                       50

                                       40

                                       30

                                       20

                               10 0 CD-ROM,disk,

etc.) ect,etc.)obat,ge, f Electronic text file

Ped

orWscanned ima d, Other electronic format

Microfiche/film ,D

xetc.),

le

Orac,

Electronic database orinde(MS Access

r tape, o

le data file or other

                               diskette geDV taba

roP

digital im

or(MS W

Source: GAO survey of state agencies.

Note: Respondents could check more than one storage method for each record
type they maintain. Based on responses from 90 state agencies that
reported SSNs are available in public records they maintain out of 338
total survey respondents.

Other electronic formats cited were primarily references to agency or
function specific data systems and general references to digital imaging.
Some respondents to this option also noted that records were only
maintained in paper formats.

Many state offices also use more than one method to store the same type of
records. This pattern could be due to retention of older records in
noncomputerized formats such as microfiche/film and placement of newer
records into computerized formats, rather than having a single record
available in multiple formats. Table 4 shows the extent of this practice.

  Table 4: State Office Use of Multiple Storage Methods for Specific Types of
                Records Containing SSNs Number of state agencies

                                                                    5 or more 
                            1 storage 2 storage 3 storage 4 storage   storage 
    Type of public record    method    methods   methods   methods    methods 
     Records of criminal            5         2         4         2 
         proceedings                                                
     Litigation and civil           7         1         4         2 
          case files                                                
       Traffic records              5         2         2         1 
     Records of judgments           4         1         3         0 
     Records of property                                            
       liens and other                                              
          judgments                 3         1         3         2 
         UCC filings                5         2         5         2 
        Death records               3         5         6         0 
       Divorce records              4         1         4         1 
Business or professional                                         
           licenses                 2         4         3         1 

Source: GAO survey of state agencies.

Note: Based on responses from 90 state agencies that reported SSNs are
available in public records they maintain-out of 338 total survey
respondents.

While state agencies generally store most public records displaying SSNs
electronically, in most cases, members of the public are not able to
access the records electronically. Despite reliance on electronic storage
methods, based on our survey responses, walk-in inspection of paper copies
and mail requests are the most commonly available forms of access to state
public records containing SSNs. Fifty-four state agencies-out of 90 where
public records display SSNs-reported these were the only way for the
public to access such records. Comparatively few state agencies responding
to our survey provided Internet access to records containing SSNs. In most
offices where it is available, a fee or user registration is required. Of
those offices that make records available on the Internet, more reported
making court records and UCC filings available than any other type of
record. Figure 6 compares the extent of Internet access with walk-in
inspections and on site electronic databases.

      Figure 6: Methods of Access to State Public Records Containing SSNs

Number of state agencies

79

Mail request

lWa

k-in inspection Internet access,

ee and/or ee and/orf f,

database

registration required Onsite use of electronic

Onsite use of electronic registration required

no fee or ,

registration requiredInternet,access,no fee or

                         registration requireddatabase

Source: GAO survey of state agencies.

Note: Based on responses from 90 state agencies that reported SSNs are
available in public records they maintain-out of 338 total respondents.
Respondents could check more than one access method for each record type
they maintain.

Based on their responses to our survey, state agencies are not planning to
significantly expand Internet access to public records that show SSNs.
Only 4 state agencies indicated plans to make such records available on
the Internet, and one agency plans to remove them from Internet access.
Three agencies plan changes in Internet access. One said that a state law,
with limited exceptions, barred the release of SSNs held by any state
government entity. Another agency plans to charge a fee for Internet
access to records it maintains. The third agency plans to remove SSNs and
place records on the Internet

Our survey results show that state offices have recently taken some
measures to change the way they display or share SSNs in public records.
Again, because of the number of nonrespondents, the results may not
account for all such measures. As figure 7 shows, state agencies most

often have either redacted-covered or otherwise hidden from view- SSNs
from public versions of records or restricted access.

Figure 7: Number of State Agencies Citing Each Change to SSN Access for at
Least One Record Type

                            Number of state agencies

109

110

100 90

80

70

60

50

40

30

20

10 0

lic ds

Restricted accessvided to the pub to recor

                          some derivation of SSNsOther

of

)ukolac

(b

                                  Redactionpr

o

Source: GAO survey of state agencies.

Note: Based on responses from all 338 agencies that completed the survey.
Of that number, 275 agencies responded that no changes were made for at
least one record type they maintain. Total counts exceed 338 because some
agencies provided responses for more than one record type. Therefore, some
agencies that responded no change for one record type may have indicated a
change for another record type. Respondents could check more than one
change for each record type they maintained.

Specific restrictions and other actions state agencies reported taking
included blocking or removing SSNs from electronic versions of records,
allowing individuals identified in records to keep their SSNs out of
publicly available versions, replacing SSNs with alternative identifiers,
and restricting access only to individuals identified in the records. A
number of state agencies also described broader policy changes taken by
their state

governments in the last 2 years.20 According to survey respondents, at
least 8 states have enacted new laws to restrict public disclosure of
SSNs. These states, with brief descriptions of the newly enacted laws are
listed in table

5.

Table 5: Recent State Laws Restricting Public Disclosure of SSNs Cited by
Survey Respondents

Florida 	In October 2002, a law took effect making SSNs held by state
agencies, employees, or contractors confidential and exempt from
disclosure under the state's public records law and constitutional right
of access to public records. The same law also barred the inclusion of
SSNs on any document filed with a county recorder in the state.

Nebraska 	In 2002, a provision was added to the state's public records law
allowing state and local government entities to withhold the disclosure of
SSNs in the release of public records unless they are disclosed in open
court or administrative proceedings or open meetings, or by a government
entity in the course of its duties.

North Dakota 	In 2003, the state added a provision to its public records
law making SSNs held by public entities confidential. They may only be
disclosed pursuant to other provisions of law.

Oregon 	In 2003, two statutory provisions were enacted. The first limited
the re-disclosure by other state agencies of SSNs obtained from motor
vehicle records; the second requires the state court system to develop a
system preventing the disclosure of the SSNs of individuals involved in
divorce proceedings to the general public.

Tennessee 	In 2002, the state enacted a statutory provision barring state
entities from publicly disclosing the SSNs of citizens of the state,
unless given permission by an individual citizen or required by other
provisions of state or federal law.

Texas 	Numerous statutory changes were made since 2003: SSNs that are
maintained in voter registration records, marriage license applications,
or the state's central criminal history database may not be disclosed.
Individuals may have their SSNs removed from real property records before
they are filed with county clerks. SSNs of persons employed in law
enforcement in Texas cannot be disclosed, with the exception of documents
filed with county or district clerks. However, this law also states that
county clerks may not reject any documents that do not contain SSNs for
recording.

Virginia 	In 2003, the state added two provisions to its law on the
disclosure or display of SSNs: The first bars the display of full SSNs on
agency-issued identification cards, student identification cards, or
license certificates issued or replaced on or after July 1, 2003; the
second bars state and local courts from posting any document containing
SSNs on court-controlled Web sites. This provision expires in July, 2005

West Virginia 	In early 2004, the state enacted two new laws affecting SSN
disclosure: The first restricted the circumstances under which SSNs
maintained in motor vehicle records could be disclosed to other parties;
the second barred state executive branch agencies from disclosing SSNs in
any records subject to the state's public records law, and barred all
state entities from disclosing to nongovernmental entities SSNs of state
employees and their dependents under the state's public records law.

Source: GAO survey of state agencies and review of associated state
statutes.

We previously reported that Washington and Minnesota had enacted
comprehensive policies to restrict the display of SSNs.21 Minnesota's law-

20The survey asked agencies to indicate actions taken in the last 2 years
prior to administration of the survey in February/March, 2004.

21GAO-02-352.

the Minnesota Government Data Practices Act-among other provisions
specifically classifies SSNs collected by state and local government
agencies as nonpublic. Washington's policy was implemented through an
executive order signed by the governor in April 2000. In response, state
agencies removed SSNs from forms and documents where their display was
found to be not vital to the business of the agency. They also changed the
format of certain public records to limit disclosure of SSNs, such as
recording SSNs on portions of forms or duplicate forms that are not
released to the public.

In October 2002, the Conference of Chief Justices and the Conference of
State Court Administrators issued a report (CCJ/COSCA Guidelines)22 for
state court systems regarding public access to court records, which
recommended that courts take various means to protect SSNs within the
court records they maintain. One strategy discussed in the Guidelines
would be for courts to have SSNs be available in records only when viewed
at a court facility. Such records might be available electronically, but
only through workstations in a court facility. The Guidelines also suggest
that parties to a case or individuals identified in records be allowed to
request additional restrictions for good cause. Finally, the Guidelines
advise state court systems not to disclose SSNs protected by any state or
federal law.

Local Government Records with SSNs Are Most Often Stored on Microfiche or
Microfilm, but Are also Posted to the Internet

Overall, microfiche or microfilm are the most commonly used methods of
storing local government public records that contain SSNs-38 to 52 percent
of such records are stored in these manners. To a lesser degree, county
offices use DVDs and CD-ROMs, electronic text files, portable data files,
and electronic databases. We found no real variation in the storage
methods used by different functions.

Overall, the predominant methods for gaining access to local government
public records containing SSNs are by visiting an office in person to
inspect paper copies or requesting a copy through the mail. Records
containing SSNs are available in onsite electronic databases in 49 to 68
percent of counties. According to our survey, the Internet is the least
common form of access, although records with SSNs are accessible on the

22Developing CCJ/COSCA Guidelines for Public Access to Court Records: A
National Project to Assist State Courts, the National Center for State
Courts and the Justice Management Institute, (Oct. 18, 2002)
(www.courtaccess.org/modelpolicy/).

Internet in 15 to 28 percent of U.S. counties. We estimate that 34 to 48
percent of the population lives in these counties. Figure 8 shows the
estimates for the percent of counties in which different methods can be
used to access public records with SSNs.

Figure 8: Percent of Counties Giving Access to Public Records Displaying
SSNs, by Method of Access

                              Percent of counties

84

                                       81

k-inl

Wainspection

                Mail request electronic databaseInternet access

Source: GAO survey of local governments. Note: The 95 percent confidence
interval is within +/-10 percent.

According to our survey, few or no offices other than courts or recording
offices currently make records containing SSNs available via the Internet.
With regard to future plans, while we estimate that offices in only 2 to 8
percent of counties plan to introduce Internet access to records
containing SSNs, this may have consequences for the 13 to 25 percent of
the U.S. population that lives in those counties.

In the past 2 years, the vast majority of local government offices have
not made changes to the way they display or share SSNs in particular
records. However, we estimate that offices in 13 to 27 percent of counties
have begun redacting SSNs on copies of records provided to the public and
offices in 12 to 26 percent of counties have begun restricting access to
records containing SSNs. Some offices also have begun using partial SSNs
in public records.

Access to Many Federal Records Is Restricted, and Federal Courts Are
Removing SSNs from Their Web Sites

Federal agencies transfer paper records containing SSNs to records centers
operated by the National Archives and Records Administration (NARA) for
storage.23 Access to these records remains under the legal authority of
the transferring agencies, which, as noted previously, generally do not
make SSNs accessible to the public. According to NARA officials, NARA is
considering adding electronic records storage services to the records
center program, but the same rules of access would apply to those records.

At the end of the period in which the agency records are expected to be
needed, those that have continuing value are transferred into the National
Archives and NARA's legal custody. NARA provides public access to archival
records unless the records have access restrictions. Some records are
subject to restrictions prescribed by statute, executive order, or by
restrictions specified in writing in accordance with 44 U.S.C. 2108 by the
agency that transferred the records to the National Archives of the United
States. Additionally, the Archivist of the United States imposes general
restrictions to certain kinds of information or classes of records.

NARA has many series of federal agency records in its legal custody that
contain SSNs. NARA officials told us that it has two broad categories of
archival records with SSNs: (1) name retrievable records and (2)
operations records that are not name retrievable.24 NARA is unable to
screen the latter records for SSNs unless the records must be screened for
another restriction. In response to requests for name retrievable records
made under the Freedom of Information Act, NARA screens the records and
redacts SSNs (if the individual is not deceased) prior to public
disclosure or release. NARA also masks the SSNs of living individuals in
archival databases that NARA makes available to the public on its Internet
Web site.

23Some of the major series of federal agency records that contain SSNs
stored in NARA records centers include alien case files, court cases,
employee medical folders, investigative files (including Offices of
Inspectors General), Medicare claims folders, official civilian personnel
folders, official military personnel folders, Social Security
Administration claims and litigation folders, tax returns, and folders
pertaining to deceased veterans and their dependents.

24The largest major series of name retrievable records in the National
Archives of the United States that contain SSNs include Navy and Marine
Corps muster rolls, 1971-76, and three Department of Defense combat
casualty databases, 1961-2002. SSNs also may be dispersed among operations
records such as Navy deck logs of nuclear ships and Department of Justice
case files.

We discussed Judicial Conference policies and procedures pertaining to
privacy and SSNs with officials from the Administrative Office of the U.S.
Courts. They told us that the Conference has taken a number of actions in
recent years to increase privacy and reduce Internet access to SSNs that
are in federal court documents. These actions include (1) implementing a
rule for bankruptcy cases, effective December 1, 2003, that requires SSNs,
except for the last four digits, to be redacted from electronically
available (Internet) documents accessible to the public; (2) issuing a
"model local rule" for criminal cases that eliminates SSNs from documents
filed with the court, unless necessary, and includes only the last four
digits of SSNs in publicly available paper and electronic versions of such
documents; and (3) issuing privacy policy guidance for electronically
available court documents in civil cases. Citing its bankruptcy case rule
and model local rule for criminal cases, the Conference also advises
attorneys for parties filing court documents to include only the last four
digits of SSNs. In its report, the committee that developed the policy
noted that there should be "consistent, nationwide policies in federal
courts in order to ensure that similar privacy protections and access
presumptions apply regardless of which federal court is the custodian of a
particular case file."25

Although they are not displayed in public records en masse, we found that
millions of SSNs are still subject to exposure on individual identity
cards issued under federal auspices. Although some agencies are taking
action to address this display of the SSN, we found that, currently, an
estimated 42 million Medicare cards display entire nine-digit SSNs, as do
some Department of Defense insurance cards and approximately 8 million
identification cards, as well as 7 million Department of Veterans Affairs
(VA) beneficiary cards. In addition, approximately 830,000 federal
employees carry health insurance cards issued through Federal Employees
Health Benefits Program that display the bearer's full SSN. Such cards are
used at the point of service - at pharmacies, medical offices, or merely
to enter buildings - and are usually carried almost everywhere,
circulating through many hands and even photocopiers, increasing
opportunities for the card and the SSN on it to be stolen, copied, or even
lost.

  Millions of Federal Health Insurance and Identity Cards Display the SSN

25Report of the Judicial Conference Committee on Court Administration and
Case Management on Privacy and Public Access to Electronic Case Files,
http://www.privacy.uscourts.gov/Policy.htm.

Three of four federal agencies have begun taking action to remove SSNs
from such health insurance or identification cards issued under their
auspices. In 2003, the federal Office of Personnel Management, which
handles personnel for executive branch agencies, directed all health
insurance carriers affiliated with the Federal Employee Health Benefit
Program to eliminate SSNs from insurance cards as soon as it is
operationally and financially practical. As of August 2004, about 57
percent of these insurers were using numbers others than SSNs on their
cards- this represents over 79 percent of the subscribers in the FEHBP.
The office projected that by the end of 2005 only 3.7 percent of FEHBP
subscribers will have their SSNs on their health insurance cards, as more
insurance companies have signaled their intention to replace the SSN.
Meanwhile, VA is eliminating SSNs from 7 million VA identification cards
and is replacing cards with SSNs or issuing new cards without SSNs from
2004 through 2009, until all such cards have been replaced. In 2004, the
Department of Defense (DoD) began replacing approximately 6 million health
insurance cards that display SSNs with cards that do not display the
bearer's SSN, but continues to include SSNs on approximately 8 million
military identification cards.26 In addition, the Centers for Medicare and
Medicaid Services (CMS), with the largest number of cards displaying the
entire nine-digit SSN, does not plan to remove the SSN from Medicare
identification cards. During 2003, CMS's Office of Financial Management,
Program Integrity Group conducted a study of identity theft issues, during
which they considered the possibility of removing SSNs from Medicare
cards. CMS officials who served on the workgroup told us that the group
had concluded that eliminating SSNs from 40 million Medicare cards would
be cost prohibitive.

The Social Security Administration (SSA), which is the issuer of Social
Security cards (displaying the bearer's SSN), addresses this vulnerability
differently than the other agencies. SSA recommends that cards be kept in
a safe place and that a person "not carry" it with them unless it is
needed "to show it to an employer or service provider."27 In contrast, CMS

26The Geneva Accord requires all military personnel and civilian personnel
accompanying the Armed Forces to have an identification card showing the
owner's serial number. DoD has employed the SSN as the serial number.
According to DoD, to remove this SSN from identification cards would
require a change to the Geneva Accord or a change to the serial number
that DoD currently employs. Of the 8 million DoD identification cards that
display SSNs, approximately 2.5 million meet the requirements of the
Geneva Accord.

27Social Security Administration, Your Social Security Number And Card,
Electronic Leaflet, SSA Publication No. 05-10002, July 2004.

instructs Medicare participants to show the card whenever medical care is
provided, and to carry the card when traveling, but to keep the number as
safe as they would a credit card number.

While the Social Security Administration advises individuals to avoid
exposure of their SSN card, we found no federal policy regarding its
display on identity and insurance cards. Specifically, there is no
presidential executive order, federal law, or common federal policy in
effect. Although SSA has authority to issue policies and procedures over
the Social Security cards that it issues, it does not have authority over
how other federal agencies use and display SSNs. While the Office of
Management and Budget has issued guidance for managing federal information
resources and protecting records on individuals, it has not provided
guidance for the display of SSNs on cards. Rather, the Centers for
Medicare and Medicaid Services, the Office of Personnel Management, VA,
and DoD each have their own policies for the cards issued under their
authority.

                                  Conclusions

Today, the SSN has become a universal identifier; as such, it offers
government as well as the private sector an efficient way to verify the
identity and the qualifications of people for programs or activities
ranging from taxes to health benefits to worker's compensation payments.
As a single, unique number assigned to one person, the SSN also allows for
tracking that individual through more than one database and comparing
information for a variety of uses, including police work.

In short, SSNs are a lynchpin to other personal information held in a
variety of records. The extent to which they are exposed to public view,
of course, increases the likelihood that they will be misused for
inappropriate mining of personal information, violation of privacy, and
identity theft. The increased use of SSNs in both the public and private
sectors means that SSNs are more widely circulated and more likely to
appear in public records that document common life events and
transactions, such as marriages and home purchases.

The continued visibility of SSNs in public records in virtually every
corner of the country presents continued risk of widespread, albeit
small-scale, identity theft. Since the public usually obtains such records
in individual hard copies, the risk of SSN theft in large volume from
public records may be small. Indeed, a variety of government agencies and
oversight bodies appear to be taking steps to eliminate the open display
of SSNs, but there is no uniform practice or policy at the federal, state,
or local level to

protect them. Such initiatives to protect the SSN may slow its misuse, but
the absence of uniform and comprehensive policy is likely to leave many
individuals vulnerable. For example, the 15 to 28 percent of counties that
we estimate post some records with SSNs on the Internet creates a broad
vulnerability that, together with the lack of uniform protections, makes
it difficult for any one individual to mitigate. In one of our previous
reports, we recommended that a representative group of federal, state, and
local officials develop a unified approach to safeguarding SSNs used in
all levels of government and particularly those displayed in public
records. We still believe such an approach would be constructive.

On another front, there is jeopardy in the display of SSNs on identity and
eligibility cards issued under government auspices. The cardholder is
usually required to use his or her card at the point of service-which
means a practical need to carry and display it often-thus increasing the
likelihood for accidental loss, theft, or visual exposure. The risk this
poses has been both recognized and addressed by, among other things,
prohibitions against using SSNs as student identification numbers and
policy changes concerning use of SSNs on drivers' licenses. While we did
not examine the phenomenon of SSN display on identification cards across
all federal programs, it is clear that the lack of a broad, uniform policy
allows for inconsistent, but persistent exposure.

To address the overall problem of exposure for the SSN, congressional
lawmakers are considering legislation that would, among other things,
curtail display of SSNs in both the private and public sectors. For its
part, the public sector has already demonstrated that it is possible, for
example, to substitute another number for the SSN on displayable cards,
and link it to actual SSNs in a protected database. Given the size of
federal programs, the lack of such safeguards across all agencies
currently leaves millions of people unprotected.

Recommendation 	To address this potential vulnerability, we recommend that
the Director, Office of Management and Budget, identify all those federal
activities that require or engage in the display of nine-digit SSNs on
health insurance, identification, or any other cards issued to federal
government personnel or program beneficiaries, and devise a governmentwide
policy to ensure a consistent approach to this type of display.

  Agency Comments
  and Our Evaluation

We provided a draft of this report to the Administrative Office of the
United States Courts, the Centers for Medicare and Medicaid Services, the
Department of Defense, the National Archives and Records Administration,
the Office of Management and Budget, the Office of Personnel Management,
the Social Security Administration, and the Department of Veterans Affairs
for comment. Officials at each agency confirmed that they had reviewed the
draft and generally agreed with its findings and recommendation. Officials
from the Administrative Office of the United States Courts, the Department
of Defense, and the Office of Personnel Management provided us with
technical comments, which we have incorporated into the report as
appropriate. We received formal comments from officials from the
Department of Defense, the Office of Personnel Management, and the Social
Security Administration; those comments are included in appendixes VI
through VIII. We did not receive formal written comments for this report
from the Centers for Medicare and Medicaid Services, the National Archives
and Records Administration, or the Department of Veterans Affairs, though
officials from each confirmed that they generally agreed. Additionally,
OMB did not provide formal written comments, but officials from OMB's
Office of General Counsel and Office of Information and Regulatory Affairs
confirmed that they generally agreed with the report and that they would
take our recommendation into consideration for future action.

We are sending copies of this report to the Director of the Administrative
Office of the U.S. Courts, the Administrator of the Centers for Medicare
and Medicaid Services, the Secretary of Defense, the Archivist of the
National Archives and Records Administration, the Director of the Office
of Management and Budget, the Director of the Office of Personnel
Management, the Commissioner of the Social Security Administration, and
the Secretary of Veterans Affairs, and appropriate congressional
committees, and other interested parties. In addition, the report will be
available at no charge on GAO's Web site at http://www.gao.gov/.

If you have any questions concerning this report, please contact Barbara
Bovbjerg at (202) 512-7215. See appendix IX for other contacts and staff
acknowledgments.

Sincerely yours,

Barbara D. Bovbjerg Director, Education, Workforce and Income Security
Issues

Appendix I: Objectives, Scope, and Methodology

To complete the objectives for this assignment, we collected original
information at the federal, state, and local government levels. We
reviewed previous GAO reports on Social Security numbers (SSN), identity
theft, data mining, information security, record linkage and privacy, and
related topics. In addition we reveiwed various studies of state SSN use,
privacy laws such as the Information Technology Management Reform Act of
1996 (Clinger-Cohen Act), the Privacy Act of 1974, the Freedom of
Information Act, the Family Educational Rights and Privacy Act of 1974,
Health Insurance Portability and Accountability Act of 1996, the Computer
Matching and Privacy Protection Act of 1988, the Identity Theft and
Assumption Deterrence Act of 1998, several memoranda from the Office of
Management and Budget (OMB), and other related documents. We used
different methods for selecting units of study and for collecting data for
each of the three levels of government reviewed for this engagement. The
methods used in the three studies are detailed in the following sections.

                                 Federal Level

We conducted personal interviews with officials of 10 federal agencies:
the Administrative Office of the United States Courts, the Centers for
Medicare and Medicaid Services, the Department of Defense, the National
Archives and Records Administration, the Office of Management and Budget,
the Office of Personnel Management, the President's Council on Integrity
and Efficiency, the Social Security Administration, the Department of
Agriculture, and the Department of Veterans Affairs. We selected these
agencies because they have responsibility for implementing the Privacy
Act, the Freedom of Information Act, or programs that are generally known
to include SSNs.

We obtained information from six federal agencies using an interview guide
based on federal privacy laws and OMB's general and/or agencyspecific
disclosure criteria. The interview guide also addressed each agency's own
privacy regulations and practices. Additional queries dovetailed with
questions asked at the state and local levels: public access to the
agencies' public records that contain SSNs, availability of these records
on the Internet, privacy and protecting records about individuals and
other issues unique to the agency. The interview guide has face validity
and was used as a talking point instrument.

Survey Development 	To gather information about public records that
contain SSNs and whether they are made available to the public at the
state and local levels, we surveyed state and local government officials
in program areas that were determined likely to maintain or collect public
records. We developed a

Appendix I: Objectives, Scope, and Methodology

list of questions to be used for both surveys, although the state survey
was Web-based and the county survey was administered by mail.

The survey was designed to address questions about multiple public records
while allowing for analysis on specific types of records. To this end, we
developed a standardized two-page questionnaire, which could be replicated
for various types of public records and could be used at both the state
and the county level. In addition, the survey design allowed for specific
groupings of different types of records to be sent to different
respondents. For instance, court clerks were sent forms concerning types
of records different from those sent to public health officials. The
questionnaire include such items as accessibility of records displaying
SSNs to the public; reasons for collecting or using SSNs in the record;
formats for storing records with SSNs; plans for changing those formats;
methods by which the public can access or view records with SSNs,
including Internet usage and changes the office has made in the past 2
years in the way records with SSNs are displayed to the public.

We selected 35 different types of public records for our review. We
developed the list based on research we conducted on public records, the
results of a prior GAO survey concerning government use of SSNs,1 expert
reviewers, and pretesting of the survey instrument. These records can be
grouped in the following major categories: court records (e.g., records of
criminal proceedings, child support/child custody, divorce, etc); law
enforcement records (e.g., criminal arrest warrants, prison records);
motor vehicle records; lien and security interest records; vital records
(birth, death, and marriage); health records (immunizations and
communicable diseases); and "other" category which includes professional
licensing, military discharge records, and social service records among
others. Appendix V includes a full list of the 35 record types.

For the development of both the list of records types and the survey
questions, we obtained assistance from both internal and external expert
reviewers.

1GAO-02-352.

Appendix I: Objectives, Scope, and Methodology

State Level

Data gathering for the state level consisted of a Web-based survey to
state officials in previously identified program areas or functions in all
50 states and the District of Columbia. These program areas, identified in
our previous work on government use of SSNs as likely to maintain public
records containing SSNs, included: (1) courts/judiciary, (2) law
enforcement, (3) human services, (4) health and vital statistics, (5)
selected professional licensing offices, (6) labor, (7) corrections, and
(8) public safety. Several steps were involved in the preparation of and
conduct of the survey. We obtained the names and e-mail addresses of state
officials in these offices from a list used for our earlier work and
updated names, telephone numbers, and Web addresses using the "Yellow Book
Leadership Directories" provided in our Intranet. Two contractors made
telephone calls to verify the titles and names and to obtain the e-mail
address of each of the entries.

We sent a notification e-mail to each of the department heads of the
selected state agencies informing them about the survey. Within 2 weeks of
the notification, we sent an activation e-mail with the instructions on
how to access and complete the survey, including a survey link, and a
unique username and password to each selected state official.

To increase the response rate, we sent a reminder e-mail after the
activation email to those department heads that had not responded; about 2
weeks later, we sent a second e-mail to nonrespondents. Contractors
followed-up nonrespondents with telephone calls about 2 weeks after the
second reminder e-mail. The survey was available on line from February 23,
2004, to July 31, 2004.

We surveyed 542 officials in the 50 states and the District of Columbia.
We received responses from 338 state agencies out of 542. In 12 states, we
received responses from half or fewer of the agencies surveyed. For three
of the program areas, we received responses from about half or fewer of
the states with agencies serving those functions. The response rates for
three program areas that we believe are most likely to maintain records
with information about large proportions of state residents (though not
necessarily a majority of residents) are: Courts/Judiciary-61 percent;
human services-69 percent; health services and vital statistics-60
percent. These compare with our overall response rate of 62 percent.

County Level	We administered a questionnaire by mail to the study
population of local government officials in a two-stage probability sample
designed to reflect the population of U.S. counties. This allowed us to
estimate to the entire

Appendix I: Objectives, Scope, and Methodology

population of U.S. counties and to develop population-based estimates. The
program areas were: (1) courts, (2) law enforcement, (3) public health,
(4) recorders, (5) social services, (6) tax assessment, and (7) voter
registration. We developed a list of contact information with addresses
for local government officials using address lists obtained from the
National Association of Counties (NACO) and BRB Publications, Inc., as
well as the Yellowbook leadership directory and information obtained from
state and local government websites. Address collection was done between
November 2003 and February 2004. To identify incumbent government
officials in a sample of counties, we used address lists of county
government officials purchased from BRB Publications and NACO and
supplemented them with the name and address list used in our prior work
and by searching Web sites and making telephone calls.

We sent out packets of questionnaires to 1996 officials in 200 counties
(including minor civil divisions in 24 counties). The number or type of
records mailed to each official depended on the research team's judgment
of the type of records each official would be likely to maintain given his
or her function. For example, we sent immunization and communicable
disease questionnaires to public health directors. We provided for an
"Other" type of record that respondents could fill out for records they
maintained and for which we did not supply a questionnaire.

A few weeks after the initial survey was mailed, we sent a reminder letter
without replacement questionnaires. A week after the first reminder
letter, we began sending a second wave of reminder letters with
replacement questionnaires. While we received a completed survey from at
least one program area in each county, the response rates within each
county varied from 1 program area in a county to all program areas. The
overall response rate for the county survey was 81 percent. Response rates
for each program area were courts (79 percent), health departments (79
percent), law enforcement (80 percent), recording officials (88 percent),
social services (79 percent), tax assessors (85 percent), and voter
registrars (86 percent).

Local Government We developed a U.S. county sample that would reflect the
U.S. population

Sample Design 	and allow making estimates related to persons. The
probability sample of 200 counties included 35 counties with the largest
populations with certainty and the remaining counties selected using
probability proportional to size of the population. The measure of size
used for sampling was the square root of the 2002 estimated population;
use of the square root function dampens some of the variability in
county-level

Appendix I: Objectives, Scope, and Methodology

population sizes (from ~100 to ~ 10,000,000). To avoid having a sparsely
populated county having large influence on population-related estimates,
two counties with 2002 estimated populations less than 150 are combined
with neighboring counties, using geographic information from the U.S.
Bureau of the Census's TIGER system; this is the one situation where
sampling units are not individual counties.

We determined that for the sampled counties in some states (24 total:
Connecticut (2), Maine (2), Massachusetts (2), Michigan (9), New Hampshire
(1), New Jersey (3), Wisconsin (5)), it was appropriate to survey local
government officials within subcounty units called "Minor Civil Divisions"
(MCD) because either county governments do not exist (e.g., Connecticut
and Massachusetts) or the MCD governments perform many functions that
usually are performed by county governments in other areas. This second
stage probability sample consisted of 59 MCDs from the specified set of
counties, consisting of the 11 MCDs that have 2002 estimated populations
of 100,000 or more, and 48 MCDs (2 from each of the 24 counties), selected
using probability proportional to the size of the population.

During the implementation of the survey, we identified respondents who
were not in the target population. Table 6 provides a summary of the
reasons for these out of sample respondents.

  Table 6: Out of Sample Respondents and Reasons for County Government Survey

                          Reason out of sample Number

Duplicate address

Office closed

Duplicate because 1 official performs 2 functions

Total out of sample

Source: GAO survey of local governments.

In implementing our survey, we also had many respondents who completed
surveys on behalf of several offices. For instance, in some counties and
states where courts are centrally administered, we received just one
completed survey on behalf of all courts in a county or in a state. In
addition, in some states certain functions, such as social services, are
state government programs, but are administered by local or regional
offices. In some of these cases, we received one completed survey from a
state official on behalf of some or all local or regional program offices.

Appendix I: Objectives, Scope, and Methodology

                                 Estimation and
                                 Sampling Error

The results of the county survey were weighted to make the results
generalizable to the entire population of U.S. counties. For each stratum,
we formed estimates by weighting the data by the reciprocal of the
selection probability. The margins of error for the county survey results
varied because we made estimates for different subpopulations. For all the
estimates shown here, we are 95 percent confident that when sampling error
is considered, the results are within +/- 7 percentage points unless
otherwise indicated. All population estimates based on the survey of local
government officials are for the target population defined as local
government officials in 7 program areas and courts within a sample of 200
U.S. counties.

The survey of local government officials is subject to sampling error.
There was no sampling error for the census survey of state officials. The
effects of sampling errors, due to the selection of a sample from a larger
population, can be expressed as confidence intervals based on statistical
theory. Sampling errors occur because we use a sample to draw conclusions
about a larger population. As a result, the sample was only one of a large
number of samples of counties that might have been drawn. If different
samples had been taken, the results might have been different. To
recognize the possibility that other samples might have yielded other
results, we express our confidence in the precision of our particular
sample's results as a 95 percent confidence interval.

The 95 percent confidence intervals are expected to include the actual
results for 95 percent of samples of this type. We calculated confidence
intervals for this sample using methods that are appropriate for the
sample design used. For local government survey estimates in this report,
we are 95 percent confident that when sampling error is considered, the
results we obtained are within +/- 7 percentage points of what we would
have obtained if we had surveyed officials in all of the entire study
population, unless otherwise noted.

                               Nonsampling Error

In addition to sampling error, other potential sources of errors
associated with surveys, such as question misinterpretation, may be
present. Nonresponse may also be a source of nonsampling error. We took
several steps to reduce these other sources of error. We conducted
pretests of the questionnaire using a paper version with 11 incumbents of
the functions/roles selected for our review in four different counties in
three states to account for differing local government structures and to
ensure the questionnaire: (1) was clear and unambiguous, (2) did not place
undue burden on individuals completing it, and (3) was independent and

Appendix I: Objectives, Scope, and Methodology

unbiased. In addition, we conducted seven pretests with state officials in
2 states. The first six were conducted using a paper version of the
questionnaire and the final test was conducted using the Web version to
test for functionality.

After pre-testing we modified the questionnaire as needed for clarity,
respondent comprehension, and objectivity. Most of the items in the
questionnaire were closed-ended but provided for multiple responses to
each question as well as possibility for respondent comments regarding
public access to records with SSNs.

We performed our work in Washington, D.C., from March 2003 through
September 2004 in accordance with generally accepted government auditing
standards.

Appendix II: State and Local Government Survey Questions

Appendix II: State and Local Government Survey Questions

Appendix II: State and Local Government Survey Questions

Appendix II: State and Local Government Survey Questions

Appendix II: State and Local Government Survey Questions

The survey of state agencies asked the same questions with one addition:
"How does your office transfer  with full SSNs to third
parties." As discussed in appendix I, it was administered over the Web.
Unlike the county survey, we did not make any determinations about the
specific record types each agency might be responsible for collecting and
storing. The survey instrument included forms for each record type
included in our study. Respondents were first asked to check the record
types applicable to their agency then scroll down through the instrument
to complete the forms for those record types.

Appendix III: State Survey Response Rates by Function and State

The overall response rate for the state survey was 62 percent. We received
responses from at least one agency in every state. In 37 states and D.C.,
we received responses from more than half of the agencies surveyed. With
regard to the specific functions we surveyed, we received responses from
about half or fewer of the states in three functions: law enforcement,
cosmetology licensing, and notary public licensing. For 8 of the 12
functions, we received responses from 60 percent or more of the states.

              Table 7: Response Rates for State Functions Surveyed

                                             Total number of    
                                             states             
                                             where function was Response rate 
                                    Function           surveyed     (percent) 
                            Courts/judiciary                 51 
                             Law enforcement                 44 
                              Human services                 51 
                   Health services and vital                 47 
                                  statistics                    
                                       Labor                 50 
                                 Corrections                 48 
                               Public safety                 30 
              Medical and health professions                 45 
                                   licensing                    
                       Cosmetology licensing                 41 
                     Notary public licensing                 48 
             Securities profession licensing                 45 
                       Real estate licensing                 42 

                     Source: GAO survey of state agencies.

Appendix III: State Survey Response Rates by Function and State

Table 8: State Response Rates

                   Page 48 GAO-05-59 Social Security Numbers
Number Response       surveyed                                                                                                                    District                                                                                                                                                                                                                                                                                          New          New         New        New                      
       of     rate State in state (percent) Alabama 11  Alaska 11  Arizona 11  Arkansas 11  California 11  Colorado 12  Connecticut 10  Delaware 10        of 10  Florida 9  Georgia 12  Hawaii 10  Idaho 11  Illinois 9  Indiana 10  Iowa 12  Kansas 11 64 Kentucky 11 36 Louisiana 11 45 Maine 12 50 Maryland 11 55 Massachusetts 11 55 Michigan 9 44 Minnesota 8 75 Mississippi 10 50 Missouri 12 58 Montana 11 36 Nebraska 9 67 Nevada 12 50 Hampshire 12 25 Jersey 9 67 Mexico 12 58 York 11 36    North    
 agencies                                                                                                                                            Columbia                                                                                                                                                                                                                                                                                                                                        Carolina 10 60

Appendix III: State Survey Response Rates by Function and State

                                      Number of agencies        Response rate 
                         State         surveyed in state            (percent) 
                  North Dakota                        11                   55 
                          Ohio                        11 
                      Oklahoma                        11 
                        Oregon                        11 
                  Pennsylvania                        11 
                  Rhode Island                         8 
                South Carolina                        10 
                  South Dakota                        11 
                     Tennessee                        10 
                         Texas                        12 
                          Utah                        11 
                       Vermont                        11 
                      Virginia                        12 
                    Washington                        10 
                 West Virginia                        11 
                     Wisconsin                         8 
                       Wyoming                        11 

                     Source: GAO survey of state agencies.

Appendix IV: Extent of SSN Availability in State Public Records

                             Number of states where

                   Page 50 GAO-05-59 Social Security Numbers
 Records            the                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                
 are                public                     shown                                                                                         Mortgage     Records                                                                                                                                                                                                                                                                     Social                                                                                                        
 available          and                        shown        Records of      Litigation              Estate and                  Records      and real       of         Property        Tax         Uniform                                    Child       Child       Child                                   Marriage          Name         Concealed        Hunting      Military       Military      Business or       Public      service       Vehicle or         Voter           Notary        Records of                                     
 to        Records  SSNs    available Record      on public  criminal   19  and civil  19  Jury  2  inheritance 8  Traffic 15     of     15  property 5  property  10  ownership 3  assessment 3  Commercial 15     Birth     1  Adoption 1  custody 8  paternity 6  support 5  Divorce 11 12  Death  16 18 licenses or  3 13  change   6 9   weapons    2 10    or    1 0 discharge 2 19 induction 1 6 professional 11 2 utility 1 1  case   2 32    vessel    1 6 registration 2 3 commission 5 3 communicable 1 15 Immunization 1 20 Records     
 Records   are not  are        to the  type   public        proceedings 17  case files 17  lists 5    records   3  records 11  judgments 12  transfer 3  liens and  3   records  5   records   4  Code (UCC)  3  certificates 8  records  2  records 4   records  6  records 6  records  6    records  7    applications 9    petitions 7   applications 4    fishing  0    records  8     records  1     licenses   38    usage  1    files  5    registration 2     records    2    records   7     diseases   2      records    1       of       
 are                public,                  version                                                                                         records       other                                   filings                                                                                                                                                    licenses                                                    records       or           records                                                                            criminal    
 available          but SSN                                                                                                                              judgments                                                                                                                                                                                                                                                                    records                                                                                            arrest   8 
 to the             is not                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              warrants 12 23

Appendix IV: Extent of SSN Availability in State Public Records

                             Number of states where

                            Records are available to Records  Records are not 
                                        are available to the 
                             the public and SSNs are public, available to the 
                                              but SSN is not 
        Record type            shown shown on public version           public 
       Prison records                                   6 20 
Other records or files                              16 20 

Source: GAO survey of state agencies.

Note: Based on responses from 338 of 542 state agencies surveyed.

Appendix V: Types of Public Records Held by Local Government Offices

Because of variation in local governments, each type of record is not
always maintained by the same type of office across all counties.
Furthermore, program areas that are separate in some counties are combined
in others. For instance, in many counties the clerk or recorder performs
functions such as voter registration or tax assessment, which operate
independently in other counties. Due to these variations, it is not always
possible to pinpoint which office within a county maintains a particular
type of record.

Unless we had specific information indicating what records are maintained
in a specific office within a specific county, in administering our survey
to local government officials, we sent the same set of forms (each with
the same set of questions, but for a specific type of record) to officials
within each program area or function. For example, we sent immunization
and communicable disease questionnaires to public health directors. We
also provided an "Other" record form that all respondents could fill out
for records they maintained and for which we did not supply a
questionnaire. Table 9 shows the types of forms that were sent to each
program area.

Appendix V: Types of Public Records Held by Local Government Offices

  Table 9: Record Type Forms Sent to Local Government Officials, by Functional
                                      Area

                          Health Law     Recording                  Voter     
                                          Social                 
Function Court clerks  department     officials   Tax         registrars   
                          enforcement    services    assessor    
                             Birth     Business or                            
                         certificates  Social            Tax        Voter
Type of    Adoption     Concealed   service                   
records    records                  professional  assessment  registration 
                               weapons case files or             
                          applications   licenses      records     records    
                                          records                
                         Death records                           
               Child     Prison                                  
              custody    records        Hunting or               
              records                     fishing                
                                         licenses                
            Child        Immunization                            
            paternity     Records of     Marriage                
                            records                              
              records      criminal     licenses or              
                            arrest                               
                              warrants applications              
               Child      Records of                             
              support                    Military                
              records    communicable    discharge               
                           diseases       records                
                 Divorce                 Military                
                 records                 induction               
                                          records                
             Estate and                Mortgage and              
            inheritance                real property             
              records                    transfer                
                                          records                
             Jury lists                   Notary                 
                                        commission               
                                          records                
             Litigation                                          
                and                      Property                
            civil case                   ownership               
            files                                                
                                          records                
                                          Public                 
            Name change                   utility                
             petitions                 usage records             
             Records of                 Records of               
              criminal                   property                
                                           liens                 
            proceedings                  and other               
                                         judgments               
             Records of                   Uniform                
             judgments                  Commercial               
                                        Code (UCC)               
                                          filings                

Traffic records Vehicle or vessel registration records

Source: GAO.

Due to the variations mentioned above, we received responses about some
types of records from more than one program area. Survey responses
concerning the following types of records were most often returned by
recording officials, but not infrequently by courts: mortgage and real

Appendix V: Types of Public Records Held by Local Government Offices

property transfer records, property ownership records, records of property
liens and other judgments, Uniform Commercial Code (UCC) filings, divorce
records, marriage licenses or applications, hunting and fishing licenses,
military discharge and induction records, business or professional
licenses, public utility usage records, notary commissions, and vehicle or
vessel registrations.

Appendix VI: Comments from the Department of Defense

Appendix VII: Comments from the Office of Personnel Management

Appendix VII: Comments from the Office of Personnel Management

Appendix VIII: Comments from the Social Security Administration

A ndix IX: GAO C d Staff

Appendix IX: GAO Contacts and Staff Acknowledgments

GAO Contacts
Alicia Puente Cackley (202) 512-7022 Melinda F. Bowman (202) 512-3542

  Staff Acknowledgments

(130249)

The following team members contributed to all aspects of this report:
Dennis Gehley, Ron La Due Lake, Joel Marus, Nila Garces Osorio, and John
Trubey. In addition, Margaret Armen, Susan Bernstein, Carolyn Boyce,
Richard Burkard, Stefanie Bzdusek, Melissa Hinton, Catherine Hurley, Chris
Moriarity, and Caroline Sallee made contributions to this report.

GAO's Mission	The Government Accountability Office, the audit, evaluation
and investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of The fastest and easiest way to obtain copies of GAO
documents at no cost

is through GAO's Web site (www.gao.gov). Each weekday, GAO postsGAO
Reports and newly released reports, testimony, and correspondence on its
Web site. To Testimony have GAO e-mail you a list of newly posted products
every afternoon, go to

www.gao.gov and select "Subscribe to Updates."

Order by Mail or Phone	The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out
to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone:	Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

    To Report Fraud, Contact:
    Waste, and Abuse in Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: [email protected] Programs Automated answering system: (800)
424-5454 or (202) 512-7470

Congressional	Gloria Jarmon, Managing Director, [email protected] (202)
512-4400 U.S. Government Accountability Office, 441 G Street NW, Room 7125

Relations Washington, D.C. 20548

Public Affairs	Susan Becker, Acting Manager, [email protected] (202)
512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548
*** End of document. ***