Prison Work Programs: Inmates' Access to Personal Information (Letter
Report, 08/18/1999, GAO/GGD-99-146).

Pursuant to a congressional request, GAO provided information on: (1)
the extent to which inmates in the Bureau of Prisons (BOP) and state
prison systems had access to personal information through correctional
industry work programs; (2) prison safeguards and procedures, statutes
and regulations, and proposed legislation that addressed correctional
industry work programs involving personal information; (3) the extent to
which contracts that provided inmates access to personal information
contributed to BOP's and states' correctional industry income; (4) the
extent to which BOP and state prison inmates had access to only names
and addresses or telephone numbers through correctional industry work
programs; and (5) incidents of inmates misusing information obtained
through correctional industry work programs, including how safeguards
failed and what, if any, changes were made as a result of the incidents.

GAO noted that: (1) on September 30, 1998, of approximately 1.2 million
inmates, about 1,400 in BOP and 19 state prison systems had access to
personal information through correctional industry work programs, based
on the questionnaire responses from correctional industry officials; (2)
of these 1,400 inmates, about 1,100 had access to names and dates of
birth or Social Security numbers; (3) these inmates were performing
work, such as data entry, for the federal, state, or local governments;
(4) BOP and all the 19 states reported using a variety of safeguards to
prevent inmates from misusing the information; (5) the safeguards cited
by the largest number of states were close supervision, selective hiring
(e.g., excluding inmates convicted of sex offenses or fraud),
confidentiality agreements, and security checks at the exits from the
work areas; (6) the federal government and seven states in which inmates
had access to personal information were identified as having either
enacted statutes or had bills pending that related to limiting which
inmates could perform work involving personal information; (7) less than
one-hundredth of 1 percent of BOP's and no more than 22 percent of any
state's fiscal year 1998 gross correctional industry income was
generated from contracts that resulted in inmates having access to
personal information; (8) six states reported that less than 1 percent
of their gross correctional industry income was earned from these
contracts; (9) about 5,500 inmates in BOP and 31 state prison systems
had access to only names and addresses or telephone numbers through
correctional industry work program contracts or support work; (10) the
three safeguards that the largest number of states and BOP reported
using were similar to those used when inmates had access to personal
information--close supervision, security checks at the exits from the
work areas, and selective hiring; (11) questionnaire respondents
described nine incidents in which inmates misused personal information
or names and addresses or telephone numbers obtained from correctional
industry work programs; (12) in four of the nine incidents, inmates
removed information from the work areas, either physically or by
memorization; and (13) in five of the incidents, the work programs were
discontinued.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  GGD-99-146
     TITLE:  Prison Work Programs: Inmates' Access to Personal
	     Information
      DATE:  08/18/1999
   SUBJECT:  Correctional facilities
	     Offender rehabilitation
	     Confidential communication
	     Surveys
	     Internal controls
	     Prisoners

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  This text was extracted from a PDF file.        **
** Delineations within the text indicating chapter titles,      **
** headings, and bullets have not been preserved, and in some   **
** cases heading text has been incorrectly merged into          **
** body text in the adjacent column.  Graphic images have       **
** not been reproduced, but figure captions are included.       **
** Tables are included, but column deliniations have not been   **
** preserved.                                                   **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************

    United States General Accounting Office GAO               Report
    to the Honorable Charles F. Bass House of Representatives August
    1999       PRISON WORK PROGRAMS Inmates' Access to Personal
    Information GAO/GGD-99-146 United States General Accounting Office
    General Government Division Washington, D.C.  20548 B-280467
    August 18, 1999 The Honorable Charles F. Bass House of
    Representatives Dear Mr. Bass: This report responds to your
    request that we obtain information on correctional industry work
    programs1 under the federal Bureau of Prisons (BOP) and in state
    prison systems2 that allow inmates access to personal information.
    For this assignment, we defined personal information as
    information that can be used to threaten an individual's physical,
    psychological, or financial well-being. This information would
    include (1) credit card numbers (personal or business); (2) Social
    Security numbers; or (3) names in combination with physical
    descriptions or financial, medical, or motor vehicle information.
    You also were interested in information on inmates who had access
    to only names and addresses or telephone numbers.3 This type of
    information tends to be more readily available to the public, such
    as through telephone books, than personal information. More
    specifically, you asked for information on *  the extent to which
    inmates in the BOP and state prison systems had access to personal
    information through correctional industry work programs; *  prison
    safeguards and procedures, statutes and regulations, and proposed
    legislation that addressed correctional industry work programs
    involving personal information; *  the extent to which contracts
    that provided inmates access to personal information contributed
    to BOP's and states' correctional industry income; *  the extent
    to which BOP and state prison inmates had access to only names and
    addresses or telephone numbers through correctional industry work
    programs; and 1For our study, we defined correctional industry
    work programs as work programs that produce products and services
    for sale to government agencies and/or to the private sector. 2For
    this report, when we refer to state or states, we are including
    the District of Columbia. 3When we use the phrase "names and
    addresses or telephone numbers" we are referring to names and one
    or more of the following: work or home addresses or telephone
    numbers, names of employers, or job titles but no other item that
    we defined as personal information. Page 1
    GAO/GGD-99-146 Inmates' Access to Personal Information B-280467 *
    incidents of inmates misusing information obtained through
    correctional industry work programs, including how safeguards
    failed and what, if any, changes were made as a result of the
    incidents. To answer these questions, we surveyed BOP and state
    correctional industry officials by mail.4 Although questionnaire
    respondents provided us with data on the number of inmates with
    access to personal information or only names and addresses or
    telephone numbers, it should be noted that some officials told us
    that these data were estimates. We also contacted states'
    attorneys general and the special counsel for the District of
    Columbia, interviewed officials from federal investigative
    agencies, and conducted literature and database searches. On
    September 30, 1998, of approximately 1.2 million5 inmates, about
    1,4006 Results in Brief      in BOP and 19 state prison systems
    had access to personal information through correctional industry
    work programs, based on the questionnaire responses from
    correctional industry officials. *   Of these 1,400 inmates, about
    1,100 had access to names and dates of birth or Social Security
    numbers. These inmates were performing work, such as data entry,
    for the federal, state, or local governments. *  BOP and all of
    the 19 states reported using a variety of safeguards to prevent
    inmates from misusing the information. The safeguards cited by the
    largest number of states were close supervision; selective hiring
    (e.g., excluding inmates convicted of sex offenses or fraud);
    confidentiality agreements;7 and security checks at the exits from
    the work areas. The federal government and seven states in which
    inmates had access to personal information were identified as
    having either enacted statutes or had bills pending that related
    to limiting which inmates could perform work involving personal
    information. 4Representatives from Arizona's state-run facilities,
    Ohio, and Tennessee declined to respond to our questionnaire. The
    representatives from Arizona and Ohio told us that they would not
    respond due to limited staffing. The Ohio representative informed
    us that inmates involved in data entry work programs did not have
    access to credit card numbers or Social Security numbers. Arizona
    provided information on work programs in privately run facilities,
    which we included in our analyses. 5The latest date for which data
    were available from the Bureau of Justice Statistics on the number
    of inmates in custody in federal and state correctional facilities
    was June 30, 1998. See Prison and Jail Inmates at Midyear 1998,
    Bureau of Justice Statistics, March 1999, NCJ 173414. 6This number
    is an estimate because, as noted previously, state-run facilities
    in Arizona, Ohio, and Tennessee declined to respond to our survey.
    7Confidentiality agreements are agreements signed by the inmates
    not to release information obtained through a work program. Page 2
    GAO/GGD-99-146 Inmates' Access to Personal Information B-280467 *
    Less than one-hundredth of 1 percent of BOP's and no more than 22
    percent of any state's fiscal year 1998 gross correctional
    industry income was generated from contracts that resulted in
    inmates having access to personal information. Six states reported
    that less than 1 percent of their gross correctional industry
    income was earned from these contracts. In addition, about 5,500
    inmates in BOP and 31 state prison systems had access to only
    names and addresses or telephone numbers through correctional
    industry work program contracts or support work.8 The three
    safeguards that the largest number of states and BOP reported
    using were similar to those used when inmates had access to
    personal information- close supervision, security checks at the
    exits from the work areas, and selective hiring. Questionnaire
    respondents described nine incidents in which inmates misused
    personal information or names and addresses or telephone numbers
    obtained from correctional industry work programs. In four of the
    nine incidents, inmates removed information from the work areas,
    either physically or by memorization. In five of the incidents,
    the work programs were discontinued. In 1995, the latest year for
    which complete data were available, about 65 Background
    percent (or about 647,000) of the inmates in custody in federal
    and state places of confinement9 participated in 1 or more types
    of work programs.10 These work programs included prison industries
    (e.g., involving the manufacture of license plates, wood products,
    and textiles); facility support services (e.g., doing office and
    administrative work, food service, laundry, and building
    maintenance); farming/agriculture; and public works assignments
    (i.e., inmates working outside the facility on road, park, or
    other public maintenance work). Data entry was the type of work
    that most often allowed inmates access to personal information.
    8We defined a contract as a formal or informal agreement
    (including purchase orders) to produce a specific product or
    perform a specific service. By support work, we mean inmates who
    were not associated with a specific correctional industry work
    program contract but who had access to personal information by
    performing tasks, such as order taking, order fulfillment,
    manufacturing or customer support, complaint resolution, or
    shipping, that supported the industry work program operations.
    9Places of confinement included prisons; prison hospitals; prison
    farms; boot camps; and centers for reception, classification, or
    alcohol/drug treatment. 10The latest date for which these data
    were available from the Bureau of Justice Statistics was June 30,
    1995. See Census of State and Federal Correctional Facilities,
    1995, Bureau of Justice Statistics, August 1997, NCJ-164266. Page
    3                                                    GAO/GGD-99-
    146 Inmates' Access to Personal Information B-280467 One mission
    of the Federal Prison Industries (FPI), a BOP component, is to
    employ and provide skills training to the greatest practicable
    number of inmates and to produce market priced quality goods in a
    self-sustaining manner that minimizes potential impact on private
    business and labor. FPI markets about 150 types of products and
    services to federal agencies. Some states had similar programs and
    provisions. For example, Alabama generally requires state
    departments, institutions, and political subdivisions to purchase
    their products and services from Alabama Correctional Industries,
    to the extent to which they can be supplied. In addition, only
    those entities can purchase Correctional Industries products.
    According to the Alabama Correctional Industries purpose
    statement, it exists primarily for the purpose of providing a
    work-training program for inmates of the Department of
    Corrections. Another important purpose is to assist all state
    departments, institutions, and political sub- divisions of the
    State to secure their requirements to the greatest possible
    extent. To obtain information on the assignment objectives, we
    surveyed BOP and Scope and        state correctional industry
    officials by mail. We asked the officials to Methodology
    answer questions on correctional industry work programs in
    federal, state, and privately run facilities for which the federal
    or state government or state-appointed organizations had
    oversight. We limited the questionnaire to work programs
    associated with secure, confined facilities, including youth
    authorities but excluding programs associated with prerelease
    facilities and city and county jails. We asked *  if on September
    30, 1998, they had inmates who, through performing (1) work on
    correctional industry work program contracts that were either in
    progress or were agreed to but the work had not been started or
    (2) support work for the industry work program operations, had
    access to personal information or only names and addresses or
    telephone numbers; *  what prison procedures, statutes,
    regulations, pending legislation, or other guidelines provided
    guidance on (1) limiting which inmates perform work involving
    access to personal information and (2) preventing personal
    information from being retained by inmates or being transferred to
    unauthorized inmates or other persons; *  what the total gross
    income was for the correctional industry work program and the
    income generated by those contracts that resulted in inmates
    having access to personal information in the most recently
    completed fiscal year; and *  what incidents of misuse occurred as
    a result of inmates having access to the information through
    correctional industry work programs. Page 4
    GAO/GGD-99-146 Inmates' Access to Personal Information B-280467 We
    received responses from BOP, 47 states, and the District of
    Columbia. We did not independently verify the information provided
    by questionnaire respondents. We did, however, compare the
    questionnaire responses to the results of our current literature
    and legal database searches. After we consolidated the data
    received from the questionnaire respondents in the tables included
    in this report, we faxed the compiled information to all of the
    questionnaire respondents for confirmation of the accuracy of the
    data displayed and made corrections as necessary. We interviewed
    BOP and state officials. We also contacted states' attorneys
    general to obtain information on (1) incidents of misuse of which
    they were aware and (2) state statutes or regulations, pending
    legislation, or other guidelines that provided guidance on work
    programs involving personal information. We requested comments on
    a draft of this report from BOP and the Correctional Industries
    Association, Inc. They provided written comments that are
    summarized at the end of this report and are reprinted in
    appendixes X and XI. We performed our work from June 1998 to June
    1999 in accordance with generally accepted government auditing
    standards. Appendix I provides more details on our objectives,
    scope, and methodology. On September 30, 1998, about 1,400 inmates
    in BOP and 19 state prison Extent to Which                systems
    had access to personal information through correctional industry
    Inmates Had Access to work programs, according to the
    questionnaire respondents. This number accounts for (1) about one-
    tenth of 1 percent of all inmates in custody as Personal
    Information           of June 30, 1998, (or approximately 1.2
    million) and (2) about 2 percent of all inmates participating in
    correctional industry work programs (approximately 61,500). Almost
    all of the inmates who had access to personal information were
    being held in federal or state-run facilities (1,332 inmates) as
    opposed to privately run facilities (25 inmates). The number of
    inmates with access to personal information in each of the 19
    states ranged from 6 in New Jersey to 426 in California. The types
    of information to which the largest number of inmates had access
    were (1) names and dates of birth or (2) Social Security
    numbers.11 About 30 11The numbers of inmates having access to
    specific types of personal information are the maximum number that
    would have had access to the information. Some inmates worked on
    more than one contract. Also, we asked respondents for the number
    of inmates on each contract and the types of information to which
    inmates had access. However, each inmate may not have had access
    to all the types of personal information involved in a contract.
    Page 5                                                    GAO/GGD-
    99-146 Inmates' Access to Personal Information B-280467 percent of
    the inmates had access to names and (1) drivers' license numbers
    or (2) vehicle makes and models. Appendix II shows the number of
    inmates in BOP and individual state prison systems that had access
    to personal information on September 30, 1998, and the types of
    information to which they had access. Most of the inmates who had
    access to personal information were performing work for federal,
    state, or local governments (93 percent) as opposed to private
    sector companies (7 percent). Over half of the inmates with access
    to personal information were involved in data entry work. Another
    about 25 percent of the inmates were duplicating or scanning
    documents. Types of information processed in these work programs
    included *  medical records; *  state, county, or local licenses;
*  automobile registrations; *  unemployment records; *  student
    enrollment data; and *  accident reports. The length of time the
    contracts that resulted in inmates having access to personal
    information had been in effect ranged from less than 1 year to 19
    years. About 1 quarter of the contracts had been in place from 10
    to 19 years; the remainder were more recent. The reasons BOP and
    states most commonly identified for selecting the contracts that
    resulted in inmates having access to personal information were the
    contracts *  provided valuable job skills training, *  satisfied a
    need or demand for a service, *  were needed to provide work for
    more inmates, *  were profitable, and *  provided work that was
    relatively easy for training inmates. Questionnaire respondents
    from 11 states said they planned to add and/or expand existing
    correctional industry work programs that allow inmates access to
    personal information. Respondents from 29 states said they did not
    plan to add or expand existing work programs that would allow
    inmates access to personal information, and respondents from 8
    states said they did not know whether their states had plans to
    add and/or expand existing correctional industry work programs
    that would allow inmates access to personal information. Page 6
    GAO/GGD-99-146 Inmates' Access to Personal Information B-280467 In
    response to our survey, 29 states indicated that inmates did not
    have access to personal information on September 30, 1998. The
    more commonly stated reasons were that the opportunity had not
    presented itself, the prisons prohibited such work programs, and
    public opinion limited the feasibility of implementing such work
    programs. BOP and each state that had work programs in which
    inmates had access Safeguards Used When to personal information
    reported that they had in place a variety of Inmates Had Access to
    safeguards to prevent inmates from misusing personal information.
    In addition, BOP and most of the states in which inmates had
    access to Personal Information            personal information
    reported that they had prison procedures that limited which
    inmates could perform work that would give them access to personal
    information. The federal government and seven states in which
    inmates had access to personal information were identified as
    having either enacted statutes or had bills pending that related
    to limiting which inmates could perform work involving personal
    information. The safeguards most frequently reported as being used
    when inmates had access to personal information were close
    supervision; selective hiring (e.g., excluding inmates convicted
    of sex offenses or fraud); confidentiality agreements; and
    security checks at the work area exits. Other commonly used
    safeguards included security checks at the work area entrances, no
    photocopy machines in the work area, and monitored telephone
    calls. Appendix III provides additional information on the
    safeguards cited by questionnaire respondents. BOP and most of the
    19 states in which inmates had access to personal information
    reported that they had prison procedures that placed limitations
    on which inmates could perform work that would give them access to
    personal information. Questionnaire respondents from BOP and 18
    states said that they screened inmates before hiring them for work
    programs involving personal information. For example, one state
    respondent said that inmates who were convicted of rape or who
    have life sentences were ineligible to work on contracts where
    they would have access to personal information. In addition, in
    the course of our work, statutes or proposed legislation related
    to this issue were identified in seven of the states as well as
    the federal government in which inmates had access to personal
    information. A brief summary of these provisions is provided in
    appendix IV, table IV.1. Further, six states were identified in
    which inmates did not have access to personal information that had
    enacted statutes or introduced legislation Page 7
    GAO/GGD-99-146 Inmates' Access to Personal Information B-280467
    that related to this issue. For more information on these statutes
    and pending bills, see appendix IV, table IV.2. Less than one-
    hundredth of 1 percent of the BOP's annual gross Income Generated
    correctional industry income of $568 million was generated from
    its From Contracts That              contract that allowed inmates
    access to personal information. For those states in which inmates
    had access to personal information, no more than Allowed Inmates
    22 percent of any state's gross fiscal year 1998 correctional
    industry Access to Personal               income was generated
    from these contracts; six states reported that less Information
    than 1 percent of their gross correctional industry income was
    earned from these contracts. In total, these states grossed about
    $18 million in 1998 from correctional industry work program
    contracts that allowed inmates access to personal information,
    compared to an annual gross correctional industry income of about
    $515 million. Appendix V provides information on the income
    generated from these contracts. About 5,500 inmates, in BOP and 31
    state prison systems, had access to Extent to Which
    only names and addresses or telephone numbers through correctional
    Inmates Had Access to industry work programs. Over half of these
    inmates were in the custody of BOP. Appendix VI presents these
    data by BOP and state. The types of work Only Names and
    inmates were performing in the largest number of states in which
    they had Addresses or                     this access were order
    fulfillment, data entry, shipping, and printing. For Telephone
    Numbers                additional information on the types of work
    performed by inmates with access to only names and addresses or
    telephone numbers, see appendix VII. The safeguards that BOP and
    most states reported using when inmates had access to only names
    and addresses or telephone numbers were similar to those reported
    being used when inmates had access to personal information. The
    most commonly used safeguards reported by states included close
    supervision while working, security checks at the exits from the
    work areas, selective hiring, and security checks at the entrances
    to the work areas. For additional information on safeguards that
    BOP and states used when inmates had access to only names and
    addresses or telephone numbers, see appendix VIII. Questionnaire
    respondents from eight states reported a total of nine Incidents
    of Inmates             incidents in which inmates misused personal
    information or names and Misusing Personal
    addresses or telephone numbers that they obtained from a
    correctional industry work program. We defined misuse of
    information as any action Information or Names that threatened or
    caused injury to the physical, psychological, or financial and
    Addresses or                 well-being of any member of the
    public. Each of these incidents was Telephone Numbers
    associated with a different contract. Six of the incidents
    involved inmates Page 8                      GAO/GGD-99-146
    Inmates' Access to Personal Information B-280467 contacting
    individuals identified through a work program by telephone or by
    mail (in one of these instances, the inmate in the work program
    passed information on an individual to another inmate, who then
    contacted the individual). Two incidents involved inmates using
    credit card numbers that they obtained through participating in a
    work program. The other incident involved two inmates' attempts to
    smuggle copies of documents out of the prison through the U.S.
    mail. Five of the contracts related to these incidents were
    terminated after the incident occurred. In three of the four other
    incidents, the prison responded by either adding new safeguards or
    reinforcing existing safeguards used on the contract. In the
    remaining incident, the prison's procedures remained the same. For
    more information on these incidents, see appendix IX.
    Questionnaire respondents also provided information on four
    additional incidents that did not meet the previously described
    criteria for misuse of personal information. On the basis of one
    or more of the following reasons, these four incidents were not
    included in appendix IX: no reported injury, a court finding of no
    wrongdoing, or termination of the inmate from the work program on
    the basis of an allegation or suspected wrongdoing. These
    incidents, however, resulted in some type of program change. The
    types of program changes ranged from adding or reinforcing
    policies and safeguards to program termination. Briefly, these
    incidents, as reported by the respondents, consisted of the
    following: *  An inmate was processing accident reports in a data
    entry work program. He told another inmate, not in the work
    program, about an individual involved in one of the accident
    reports he processed. The other inmate contacted the individual
    involved in the accident. The questionnaire respondent reported
    that nobody was harmed, safeguards did not fail, and no sanctions
    were taken. After this incident, the state reportedly reinforced
    its policies and safeguards associated with this contract. *  An
    inmate working in a data entry work program saw, reportedly by
    accident, a state document that had information about one of his
    family members. He spoke with another member of his family about
    the information he saw. A member of his family filed a lawsuit
    claiming that the inmate should not have had access to this
    information. The questionnaire respondent reported that the case
    was dismissed because the information was covered by an open
    record regulation whereby birth records are considered to be
    public records. The state, however, canceled the contract for
    processing this type of information. Page 9
    GAO/GGD-99-146 Inmates' Access to Personal Information B-280467 *
    An inmate working in a telemarketing work program was accused of
    harassing a customer. The inmate was terminated and transferred to
    maximum security on the basis of the allegation alone. The state
    reportedly implemented additional safeguards after the alleged
    incident was reported. *  An inmate wrote a letter to an
    individual, and it was suspected that the inmate obtained the
    individual's name and address through the work program. According
    to the survey response, the inmate was disciplined and terminated
    from the work program, and a measure providing for the closer
    monitoring of inmates was instituted. In commenting on our report,
    BOP concurred with our report with one Agency Comments and
    exception. BOP noted that since our survey, it changed its
    procedures, and Our Evaluation                  no inmates in the
    BOP prison system have access to personal information. Since our
    methodology was to report on the number of inmates who had access
    to personal information on September 30, 1998, we did not
    eliminate the 25 BOP inmates who we reported as having access to
    personal information. (See app. X.) The Correctional Industries
    Association, Inc., in its comments said that our report was fair
    and thorough and presented the facts objectively. However, it took
    two exceptions with the report. First, the Association said that
    the information on inmates' access to personal information is
    presented largely out of context. We disagree. Our draft report
    said that of approximately 1.2 million inmates, about 1,400 in BOP
    and 19 state prison systems had access to personal information
    through correctional industry work programs. We noted that less
    than one-hundredth of 1 percent of BOP's and no more than 22
    percent of any state's fiscal year 1998 gross correctional
    industry income was generated from contracts that resulted in
    inmates having access to personal information. Further, we pointed
    out that about a quarter of the contracts that resulted in inmates
    having access to personal information had been in place from 10 to
    19 years. Second, the Association said that a benchmark is needed
    against which the success or failure of correctional industries to
    control access issues can be measured. We did not judge whether
    the correctional industries have succeeded or failed in their
    attempt to prevent the misuse of personal information to which
    inmates had access as the result of work programs because we are
    not aware of criteria by which to make such a judgment. Page 10
    GAO/GGD-99-146 Inmates' Access to Personal Information B-280467
    However, given that the inmates with access to personal
    information are individuals who have been incarcerated for crimes,
    and given that the institutional settings permit work program
    officials to exercise close scrutiny over the inmates and work
    places, breaches of security and misuses of personal information
    are a cause for concern. (See app. XI.) As agreed, unless you
    announce the contents of this report earlier, we plan no further
    distribution until 30 days from the date of this letter.  At that
    time, we will send copies of this report to the Honorable Janet
    Reno, Attorney General; the Honorable Kathleen Hawk Sawyer,
    Director, BOP; Ms. Gwyn Smith Ingley, Executive Director,
    Correctional Industries Association, Inc.; the states that
    responded to our survey; and other interested parties. Copies will
    also be made available to others upon request. The major
    contributors to this report are acknowledged in appendix XII. If
    you or your staff have any questions about the information in this
    report, please contact me or Brenda Bridges on (202) 512-8777.
    Sincerely yours, Richard M. Stana Associate Director,
    Administration of Justice Issues Page 11
    GAO/GGD-99-146 Inmates' Access to Personal Information Contents 1
    Letter Appendix I: Objectives, Scope, and Methodology
    14 Appendixes    Appendix II: Number of Inmates With Access to
    Personal                        18 Information Through Work
    Programs Appendix III: Safeguards Used in Work Programs in
    26 Which Inmates Had Access to Personal Information Appendix IV:
    Procedures, Statutes, and Pending Bills
    31 Appendix V: Income From Work Programs That Allowed
    35 Inmates Access to Personal Information, Fiscal Year 1998
    Appendix VI: Number of Inmates With Access to Only
    38 Names and Addresses Through Work Programs Appendix VII: Type of
    Work Performed in Work                                  40
    Programs in Which Inmates Had Access to Only Names and Addresses
    Appendix VIII: Safeguards Used in Work Programs in
    44 Which Inmates Had Access to Only Names and Addresses Appendix
    IX: Incidents of Misuse of Personal Information
    48 by Inmates Appendix X: Comments From the Bureau of Prisons
    52 Appendix XI: Comments From the Correctional
    53 Industries Association, Inc. Appendix XII: GAO Contacts and
    Staff Acknowledgments                          54 Table IV.1:
    Federal and State Prison Procedures,
    31 Tables          Statutes, and Pending Bills That Address
    Limitations on Inmates Who Perform Work Involving Personal
    Information Where Inmates Had Access to Personal Information on
    September 30, 1998 Table IV.2:  Statutes and Pending Bills That
    Address Work                     34 Programs Involving Access to
    Personal Information in States Where Questionnaire Respondents
    Reported That Inmates Did Not Have Access to Personal Information
    on September 30, 1998 Page 12                    GAO/GGD-99-146
    Inmates' Access to Personal Information Contents Abbreviations BOP
    Bureau of Prisons FPI         Federal Prison Industries Page 13
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix I
    Objectives, Scope, and Methodology The objectives of our study
    were to *  determine the extent to which inmates in the BOP and
    state prison systems had access to personal information through
    correctional industry work programs; *  identify prison safeguards
    and procedures, statutes and regulations, and proposed legislation
    that addressed correctional industry work programs involving
    personal information; *  determine the extent to which contracts
    that provided inmates access to personal information contributed
    to BOP's and states' correctional industry income; *  determine
    the extent to which inmates in the BOP and state prison systems
    had access to only names and addresses or telephone numbers
    through correctional industry work programs; and *  identify
    incidents of inmates misusing information obtained through a
    correctional industry work program, including how safeguards
    failed and what, if any, changes were made as a result of the
    incidents. For our study, we defined correctional industry work
    programs as programs that produced products and services for sale
    to government agencies and/or to the private sector. We excluded
    institutional work programs, i.e., programs that would involve
    activities such as housekeeping, food services, day-to-day
    maintenance, and community service, as well as support programs in
    which an inmate may have inadvertently seen personal information.
    The scope of our study included work programs that were (1)
    overseen by BOP, a state government, or a state-appointed
    commission; (2) associated with federal, state, or privately run
    facilities; and (3) associated with secure, confined facilities-
    including youth authorities-but not programs associated with
    prerelease facilities or city or county jails. We defined
    "personal information" as information that could be used to
    threaten an individual's physical, psychological, or financial
    well-being. This information would include (1) credit card numbers
    (personal or business); (2) Social Security numbers; or (3) names
    in combination with physical descriptions or financial, medical,
    or motor vehicle information. We also collected data on inmates'
    access to "names and addresses or telephone numbers," which
    included a name and one or more of the following: work or home
    address or telephone number, name of employer, or job title but no
    other item that we defined as personal information. Page 14
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix I
    Objectives, Scope, and Methodology To meet the assignment
    objectives, we surveyed, by mail, correctional industry officials
    in BOP, all 50 states, and the District of Columbia. The
    questionnaire asked for information on the following: *
    correctional industry work program contracts that involved
    personal information that were either orders-in-progress or that
    had been agreed to but had not yet been started on September 30,
    1998;1 *  the number of inmates who had access to personal
    information or to names and addresses or telephone numbers through
    correctional industry work program contracts or support work; *
    safeguards that were in place to prevent inmates from misusing the
    information; *  statutes, regulations, procedures, other
    guidelines, and proposed legislation that dealt with correctional
    industry work programs involving personal information; *  the
    gross income in the most recently completed fiscal year for the
    correctional industry work program overall and for those contracts
    that involved personal information; and *  incidents of misuse of
    information that occurred at any time as a result of inmate access
    to the information through a correctional industry work program.
    We asked questionnaire respondents for information on inmates who
    had access to (1) personal information or (2) names and addresses
    or telephone numbers, either through working on a correctional
    industry work program contract or through performing support work
    for the industry work program operations. We defined a contract as
    a formal or informal agreement to produce a specific product or
    perform a specific service. We defined inmates who were performing
    support work as inmates who were not associated with a specific
    correctional industry work program contract but who performed
    tasks-such as order taking, order fulfillment, manufacturing or
    customer support, complaint resolution, or shipping-that supported
    the industry work program operations. In designing our
    questionnaire, we received input from the Correctional Industries
    Association, Inc. (a nonprofit professional organization
    representing individuals and agencies engaged in and concerned
    with correctional industries) and federal and state correctional
    industry 1We chose September 30, 1998, because it coincided with
    the last day of the federal and some states' fiscal years. We
    anticipated that quarterly or annual data would be collected and
    compiled at that time and that this would facilitate the
    questionnaire recipients' ability to provide us with information.
    Page 15                                                   GAO/GGD-
    99-146 Inmates' Access to Personal Information Appendix I
    Objectives, Scope, and Methodology officials. We revised the
    questionnaire based on the feedback these officials provided. We
    made further changes based on input from correctional industry
    officials as a result of pilot testing the survey instrument in
    Maryland and Virginia. To identify questionnaire recipients, we
    called the contact point for each state's correctional industry
    program as identified in the 1998 Correctional Industries
    Association, Inc., Directory. We informed them of our assignment
    and asked whether they would be the proper recipients for the
    questionnaire. We asked these officials if their state had any
    privately run prisons that housed inmates from their state prison
    system or from other states' prison systems. If they had such
    facilities, we asked them to identify the individual who had
    oversight responsibilities for work programs in these facilities.
    To further ensure that we had a respondent for each privately run
    facility that met our criteria (i.e., the facility was a secure,
    confined facility- including youth authorities-but not a
    prerelease facility or city or county jail, and any work programs
    in the facility would be overseen by BOP, a state government, or a
    state-appointed commission), we obtained a list of privately run
    correctional facilities from the Private Corrections Project
    Internet web site.2 We then contacted the individuals whom we had
    identified as overseeing work programs at privately run facilities
    to ensure that they had responsibility for each facility that met
    our criteria. If they stated that they did not have
    responsibility, we asked them who did and repeated this procedure
    until we reached the appropriate party. We mailed a total of 63
    questionnaires: 1 to BOP, 1 to each state and the District of
    Columbia, 1 to a youth authority, 1 to a joint venture program,
    and 1 each to 9 privately run facilities that had been identified
    by the method described above. Representatives from two states,
    Arizona and Tennessee, informed us that they would not be
    participating in our survey. Ohio's representative also indicated
    that he would not be completing the questionnaire but told us that
    Ohio does not permit inmates involved in data entry to have access
    to credit card numbers or Social Security numbers. When we
    received the questionnaires, we followed-up by telephone on
    missing or incomplete data, consolidated the data into the tables
    displayed in this report, faxed the completed tables to all
    questionnaire respondents for confirmation of the accuracy of the
    data displayed, and made corrections as necessary. Questionnaire
    respondents were provided only with compiled data concerning their
    individual states. 2 The address for this web site is
    http://web.crim.ufl.edu/pcp. Page 16
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix I
    Objectives, Scope, and Methodology We also conducted literature
    and legal database searches to identify published articles,
    reports, studies, statutes, proposed bills, and other documents
    dealing with the assignment objectives. We contacted
    representatives from various organizations to determine what
    information they may have that related to our assignment
    objectives. These organizations included the American Correctional
    Association; Correctional Industries Association, Inc.; American
    Jail Association; American Federation of Labor and Congress of
    Industrial Organizations; and Union of Needletraders, Industrial
    and Textile Employees. We contacted each state's attorney
    general's office and the District of Columbia's Corporation
    Counsel to identify any additional (1) incidents of inmates
    misusing information obtained through correctional industry work
    programs and (2) state statutes or regulations, proposed
    legislation, or other guidance that dealt with correctional
    industry work programs involving personal information. We did not
    verify the completeness of the information provided. We contacted
    various federal agencies with investigatory responsibilities to
    determine if they were aware of instances of inmates misusing
    personal information that they obtained through correctional
    industry work programs. Within the Department of the Treasury, we
    contacted the Internal Revenue Service's Criminal Investigation
    Division and the U.S. Secret Service. Within the Department of
    Justice, we contacted the Federal Bureau of Investigation.
    Finally, we contacted the U.S. Postal Service and the Social
    Security Administration. We performed our work between June 1998
    and June 1999 in accordance with generally accepted government
    auditing standards. Page 17                         GAO/GGD-99-146
    Inmates' Access to Personal Information Appendix II Number of
    Inmates With Access to Personal Information Through Work Programs
    Totals in bold Jurisdiction/
    Social security      Credit card Contractor             Number of
    inmates        number              number Federal Bureau of
    Prisons              25                   25 Federal agency
    25                   25 State Alabama                         0
    Alaska                          0 Arizona
    NR                   NR                 NR Arkansas
    13 State agency                 13 California
    426                 426 State agency                 426
    426 Colorado                        0 Connecticut
    0 Delaware                        0 District of Columbia
    0 Florida                        55                   20 State
    agency 1               10                   10 State agency 2
    10                   10 State agency 3                5 State
    agency 4                5 State agency 5               25 Georgia
    0 Hawaii                          0 Idaho
    31                   31 State agency                 31
    31 Illinois                       86 State agency 1
    38 State agency 2               48 Indiana
    0 Iowa                           20                   20 State
    agency                 20                   20 Kansas
    15                   15 State agency                 15
    15 Kentucky                       56                   56 State
    agency                 56                   56 Louisiana
    0 Maine                           0 Maryland
    0 Massachusetts                   0 Michigan
    0 Minnesota                      15 Private company 1
    10 Private company 2             5 Page 18
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix II
    Number of Inmates With Access to Personal Information Through Work
    Programs Name and Driver's    Home           Make and
    Employee Date of Home    license telephone Name of model of Income
    or Place of Medical Prescription identification birth address
    number number employer            vehicle      salarya    birth
    diagnosis information    number       Other NR     NR        NR
    NR      NR            NR           NR       NR          NR
    NR           NR          NR 13        13
    13 13        13
    13 b 426
    426 426
    426c 45     50        30         20      10           30
    5                                              55 10
    10      10
    10d 10     10                   10
    10e 5
    5f 5      5         5                                5
    5                                               5g 25     25
    25                              25
    25h 31     31        31                 31           31
    31 31     31        31                 31           31
    31 d 86     86        86                              86 38     38
    38                              38 48     48        48
    48 20
    20                                             20 20
    20                                             20 f 15     15
    15         15                   15 15     15        15         15
    15 56                                  56
    56                                                       56 56
    56                        56
    56 d 15                   15                     5          10
    5 10                   10                                10a 5
    5                      5
    5i Page 19                             GAO/GGD-99-146 Inmates'
    Access to Personal Information Appendix II Number of Inmates With
    Access to Personal Information Through Work Programs Totals in
    bold Jurisdiction/                                   Social
    security       Credit card Contractor              Number of
    inmates          number             number Mississippi
    0 Missouri                         48                   48 State
    agency 1                 9                    9 State agency 2
    15                   15 State agency 3                 15
    15 State agency 4                 9                    9 Montana
    0 Nebraska                         0 Nevada
    0 New Hampshire                    25 State agency
    25 New Jersey                       6                    3 State
    agency 1                 2 State agency 2                 3
    3 State agency 3                 1 New Mexico
    26                   26 State agency 1                 1
    1 State agency 2                 25                   25 New York
    23 State agency 1                 13 State agency 2
    10 North Carolina                   0 North Dakota
    0 Ohio                            NR                    0
    0 Oklahoma                        254                  221
    84 State agency 1                 2                    2 State
    agency 2                 4                    4 State agency 3
    3                    3 State agency 4                 3
    3 State agency 5                 3                    3 State
    agency 6                 3                    3 State agency 7
    5                    5 State agency 8                 33 State
    agency 9                 27                   27 State agency 10
    41                   41 State agency 11                41
    41 State agency 12                27                   27 State
    agency 13                41                   41 State agency 14
    41                   41 State agency 15                46
    46 State agency 16                46 State agency 17
    84                   84 State agency 18                84
    84 State agency 19                84                   84 Page 20
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix II
    Number of Inmates With Access to Personal Information Through Work
    Programs Name and Driver's    Home               Make and
    Employee Date of    Home    license telephone Name of model of
    Income or Place of Medical Prescription identification birth
    address number      number employer vehicle          salarya
    birth diagnosis information      number       Other 30         30
    15         15       9                        15
    15                                   24 9
    9d 15         15      15         15
    15 15         15
    15                                   15j 25         25 25
    25 1          3                   1
    3                                             2 2
    2k 3 1          1                   1 25         25
    26                        1                  25          25
    25          25 1                        1 25         25
    25                                           25          25
    25         25d 13         10                          13
    13                       23 13
    13                                                       13
    13l 10
    10m NR         NR       NR         NR       NR           NR
    NR        NR       NR          NR            NR         NR 207
    246      174        207      208          204        132
    166      117         117           49         254 2          2
    2        2                                  2        2           2
    2d 4          4                   4
    4         4        4           4                        4n 3
    3                   3                                           3
    3o 3p 3        3
    3q 3                            3                        3
    3          3d 5
    5          5d 33                                       33
    33r 27         27                  27      27
    27        27          27                      27s 41
    41                                           41          41t 41
    41 27                          27 41         41      41
    41      41           41 41         41 46         46
    46      46                                 46
    46s 46      46                               46
    46u 84         84                  84      84
    84        84        84          84                      84s 84
    84                  84      84                       84        84
    84          84                      84s 84         84      84
    84      84           84          84        84        84
    84                      84d Page 21
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix II
    Number of Inmates With Access to Personal Information Through Work
    Programs Totals in bold Jurisdiction/
    Social security       Credit card Contractor             Number of
    inmates          number             number Oklahoma (cont.) State
    agency 20              84                  84                  84
    Oregon                         75 State agency 1               35
    State agency 2               40 Pennsylvania                     0
    Rhode Island                     0 South Carolina
    0 South Dakota                     18                  18 State
    agency                   18                  18 Tennessee
    NR                   NR                  NR Texas
    0 Utah                             60                  60 State
    agency                   60                  60 Vermont
    0 Virginia                         0 Washington
    0 West Virginia                    0 Wisconsin
    80                  80 Private company                80
    80 Wyoming                          0 Total
    1,357                1,049                84 Page 22
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix II
    Number of Inmates With Access to Personal Information Through Work
    Programs Name and Driver's    Home                Make and
    Employee Date of     Home        license telephone Name of model
    of Income or Place of Medical Prescription identification birth
    address number           number employer vehicle
    salarya     birth diagnosis information             number
    Other 84                   84       84                         84
    84d 75             35        40                                40
    35
    40 35             35
    35 40                       40                                40
    40v 18             18                   18
    18 18             18                   18
    18d NR       NR             NR         NR        NR           NR
    NR          NR            NR          NR               NR
    NR 60             60       60          60       60
    60 60             60       60          60       60
    60f 80                   80
    80 80                   80
    80d 1,133            742      464        431      413
    411          249         194           157         155
    74             1,132 Note 1:  Personal information means
    information that can be used to threaten an individual's physical,
    psychological, or financial well-being.  This information would
    include (1) credit card numbers (personal or business);  (2)
    Social Security numbers; or (3) names in combination with physical
    descriptions or financial, medical, or motor vehicle information.
    This table does not include inmates who had access to only names
    and one or more of the following:  work or home address or
    telephone number, name of employer, or job title.  For that
    information, see appendix VI. Note 2:  States with "NR" in each
    category did not return a questionnaire.  We received a
    questionnaire from Arizona's privately run facilities. These
    facilities did not have any inmates who had access to names,
    addresses, telephone numbers, or other types of personal
    information.   A representative from Ohio's state-run facilities
    informed us that inmates involved in data entry work programs did
    not have access to credit card numbers or Social Security numbers.
    We did not receive any information from respondents in state-run
    correctional facilities in Arizona or Tennessee. Note 3:  The
    numbers shown above represent the maximum numbers of inmates who
    would have had access to each type of personal information.  Some
    inmates worked on more than one contract. Consequently, as in
    Oklahoma, totals are not the sum of the number of inmates shown
    for each contract.  Also, we asked respondents for the types of
    personal information to which inmates had access.  However, each
    inmate may not have had access to all of the types of personal
    information involved in a contract. Note 4:  According to the
    questionnaire respondents, the data from Idaho represent the
    combined information from two contracts, and the data from New
    Hampshire were combined from five contracts. Illinois' data
    represent one contract situated in two geographic locations.
    aIncome or salary may refer to a range rather than a discreet
    number.  In Minnesota, customers are prompted to refuse to respond
    at their discretion. bPhysical description. cOptical prescription
    and gender. Page 23                               GAO/GGD-99-146
    Inmates' Access to Personal Information Appendix II Number of
    Inmates With Access to Personal Information Through Work Programs
    dWork address and work telephone number. ePhysician's name and
    date of incident. fMother's maiden name. gVehicle identification
    number. hBoat description. iWork telephone number, vehicle
    identification number, and license plate number. jMedical
    treatment information. kWork address, federal identification
    number of business, or Social Security number. lWork address, work
    telephone number, Medicaid recipient number, and Medicaid provider
    number. mDriver's license plate number. nMedical information. oMug
    shot. pName of payee, address, claim number, and amount of check.
    qAmount of check. rLien information. sWork address, work telephone
    number, and mother's maiden name. tWork address. uLien holder.
    vLicense plate number, driver's license suspension, and motor
    vehicle-related conviction. Source: GAO survey of correctional
    industry officials. Page 24                               GAO/GGD-
    99-146 Inmates' Access to Personal Information Appendix II Number
    of Inmates With Access to Personal Information Through Work
    Programs Page 25                        GAO/GGD-99-146 Inmates'
    Access to Personal Information Appendix III Safeguards Used in
    Work Programs in Which Inmates Had Access to Personal Information
    Jurisdiction/             Close           Selective
    Confidentiality          Security check       Security check at
    contractor            supervision        hiring       agreementa
    at exit              entrance Federal Bureau of Prisons Federal
    agency           *                    *           * State Arkansas
    State agency              *                    *
* California State agency              *                    *
*                     * Florida State agency 1            *
*           *                        *                     * State
    agency 2            *                    *           *
*                     * State agency 3            *
*           *                        *                     * State
    agency 4            *                    *           *
*                     * State agency 5
* Idaho State agency              *
*                        *                     * Illinois State
    agency 1            *                    *
*                     * State agency 2            *
*           *                        *                     * Iowa
    State agency              *                    *           *
*                     * Kansas State agency              *
*                                    *                     *
    Kentucky State agency              *                    *
*                        * Minnesota Private company 1         *
*           *                        *                     *
    Private company 2         *                    *           *
*                     * Missouri State agency 1            *
* State agency 2            *                                *
    State agency 3            *                                * State
    agency 4            *                                * New
    Hampshire State agency              *                    *
*                        *                     * New Jersey State
    agency 1            *                    *           *
*                     * State agency 2            *
*                                    *                     * State
    agency 3            *                    *           *
*                     * New Mexico State agency 1            *
*           *                        *                     * State
    agency 2            *                    *           *
*                     * Page 26                     GAO/GGD-99-146
    Inmates' Access to Personal Information Appendix III Safeguards
    Used in Work Programs in Which Inmates Had Access to Personal
    Information Computer                              Personal program
    with                         information        No paper or No
    photocopy      Monitored          privacy           Incoming
    segmented            writing machines       telephone calls
    safeguards           calls only    among inmates
    instruments           Other *
*b * *                                                     *
*c *                                  * *
*d *                                  * *
* *                *                  *
*e *                 *
*                  *f *                 *
*                  *f *                 *                *
*                 *d *                * * *                 * *
* *                                  *
*                                    *g *                 *
*                  * *                                  *
*h *
*i *                                  * * Page 27
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix
    III Safeguards Used in Work Programs in Which Inmates Had Access
    to Personal Information Jurisdiction/             Close
    Selective          Confidentiality       Security check
    Security check contractor           supervision          hiring
    agreementa              at exit             at entrance New York
    State agency 1         *                    * State agency 2
*                    * Oklahoma State agency 1           *
*                   * State agency 2           *
*                   * State agency 3           *
*                   * State agency 4           *
*                   * State agency 5           *
*                   * State agency 6           *
*                   * State agency 7           *
*                   * State agency 8           *
*                   * State agency 9           *
*                   *                     *                     *
    State agency 10          *                    *
*                     *                     * State agency 11
*                    *                   *                     *
* State agency 12          *                    *
*                     *                     * State agency 13
*                    *                   *                     *
* State agency 14          *                    *
*                     *                     * State agency 15
*                    *                   *                     *
* State agency 16          *                    *
*                     *                     * State agency 17
*                    *                   *                     *
    State agency 18          *                    *
*                     * State agency 19          *
*                   *                     * State agency 20
*                    *                   *                     *
    Oregon State agency 1            *                    *
*                     *                     * State agency 2
*                    *                                         *
* South Dakota State agency              *                    *
*                     *                     * Utah State agency
*                    *                   *                     *
* Wisconsin Private company           *                    *
*                     * Page 28                         GAO/GGD-
    99-146 Inmates' Access to Personal Information Appendix III
    Safeguards Used in Work Programs in Which Inmates Had Access to
    Personal Information Computer
    Personal program with                                 information
    No paper or No photocopy      Monitored          privacy
    Incoming              segmented                   writing machines
    telephone calls    safeguards              calls only        among
    inmates            instruments               Other *j * *
* *                                        * *
* *                                        * *
* *                                        * *
* *                 *                                            *
*                 *                                            * *
*                                            * *                 *
* *                 *                                            *
*                 *                                            * *
*                                            * *                 *
* *                                                          * *
* *                                                          * *
* *                 *                 *                      *
*k *                 *                 *                      *
*k *                 *                 *
* *                 *
* *
*l Note 1:  Personal information means information that can be
    used to threaten an individual's physical, psychological, or
    financial well-being.  This information would include  (1) credit
    card numbers (personal or business); (2) Social Security numbers;
    or (3) names in combination with physical descriptions or
    financial, medical, or motor vehicle information. Note 2:  A blank
    means that the questionnaire respondent did not report using the
    safeguard in the work program. Note 3:  According to the
    questionnaire respondents, the data from Idaho represent the
    combined information from two contracts, and the data from New
    Hampshire were combined from five contracts. Illinois' data
    represent one contract situated in two geographic locations.
    aConfidentiality agreements were agreements signed by the inmates
    not to release information obtained through a work program.
    bPrison staff conducted random inspections of work and housing
    areas. Page 29                               GAO/GGD-99-146
    Inmates' Access to Personal Information Appendix III Safeguards
    Used in Work Programs in Which Inmates Had Access to Personal
    Information cSecurity cameras were located in the work area.
    dInmates were not allowed to make telephone calls in the work
    area. eTelephones located in the work area were auto-dialed.
    fRecords could not enter or leave secure area at work site except
    in custody of civilian state employee or bonded courier. gInmates
    signed shop rules and procedures. hNo telephones were located in
    the work area. iNo telephones or computers were located in the
    work area. jInmates could not take paper or writing instruments
    into or out of the work area. kPrison staff searched inmates'
    desks. lPrison staff prescreened documents to ensure that they did
    not contain certain types of information. Inmates were subject to
    pat searches. Source:  GAO survey of correctional industry
    officials. Page 30                               GAO/GGD-99-146
    Inmates' Access to Personal Information Appendix IV Procedures,
    Statutes, and Pending Bills Table IV.1:  Federal and State Prison
    Procedures, Statutes, and Pending Bills That Address Limitations
    on Inmates Who Perform Work Involving Personal Information Where
    Inmates Had Access to Personal Information on September 30, 1998
    Jurisdiction        Prison procedures
    Statutes and pending bills Federal Bureau of Prisons Inmates who
    were convicted of counterfeiting or              Pending Bill H.R.
    369 (1999):  would prohibit the use of computer fraud offenses or
    had extensive computer           prison inmate labor for, among
    other tasks, data knowledge were excluded
    processing of personal information about children State Arkansas
    Inmates must meet requirements for minimum security; inmates
    convicted of rape or who had life sentences were excluded
    California         Inmates are screened by type of offense as per
    California California Penal Code, Section 5071:  in general, Penal
    Code, Section 5071                                    prohibits
    prison inmates convicted of offenses involving, for example,
    misuse of a computer, misuse of personal/financial information of
    another person, or a sex offense from performing prison employment
    functions that provide such inmates with access to certain types
    of personal informationa See also California Welfare Institutions
    Code, Section 219.5:  (language similar to above code section--
    applicable to juveniles) a Florida            Inmates were
    screened for disciplinary actions and appropriate education level
    Illinois           Inmates were referred to the program by an
    institutional    Pending House Bill 70 (1999): would, in general,
    prohibit committee and must have had a good institutional record
    the use of inmates to enter any personally identifiable
    information in a computer processible medium or any other medium
    Iowa               Selective hiringb
    Iowa Code, Section 904.801:  a statement of intent that outlines
    various objectives to be met through the provision of meaningful
    work opportunities to inmatesc Iowa Code, Section 904.809(1)(g):
    with respect to private industry employment of inmates of
    correctional institutions, various conditions shall apply to all
    agreements for such employment, including that the state director
    shall implement a system for screening and security of inmates to
    protect the safety of the public Kansas             Inmates must
    have had a good work record and no disciplinary reports Page 31
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix IV
    Procedures, Statutes, and Pending Bills Jurisdiction      Prison
    procedures
    Statutes and pending bills Kentucky         Inmates who had
    violated the correctional institutions'           Kentucky revised
    statutes, Section 97.120:  in general, rules were excluded
    prohibits certain state agencies from entering into any contract
    for the use or employment of prisoners in any capacity that allows
    prisoners access to certain types of information, including, but
    not limited to, taxpayer information, Social Security numbers,
    telephone numbers, and addresses Minnesota        Program review
    committee identified high-risk inmates and prevented their
    employment Mississippi      All inmates were screened by the Dept.
    of Corrections Internal Audit Division for security clearance.  No
    one was hired with a forgery, counterfeit, or document fraud
    conviction. New Hampshire    Selective hiringb New Jersey
    Institutional classification
    New Jersey Pending Assembly Bill 603 (1998):  would prohibit
    inmates at the Adult Diagnostic and Treatment Center from being
    employed in a data entry position or any other capacity that would
    provide the inmate access to certain types of personal information
    New Mexico       Inmates' conduct while incarcerated was
    considered; inmates with a history of sex crimes, hate crimes, or
    violent behavior were excluded New York         Depending on
    contract, inmates who committed                      New York
    Pending Assembly Bill 4753 (1999):  in insurance, motor vehicle,
    credit card fraud, or extortion         general, inmates involved
    in correctional institution work were excluded
    would be prohibited from accessing, collecting, or processing
    certain types of personal information See also New York Pending
    Assembly Bill 4842 (1999): (language similar to the above bill)
    Oklahoma         Inmates must have had at least 8th grade math and
    reading skills; other factors, such as attitude, were considered
    also Oregon           Security screening, including conviction
    type, was employed. Inmates convicted of computer fraud, crimes
    with a high degree of violence, and some sex crimes, or inmates
    that were considered to be high security risks by the institution
    or Department of Corrections were not employed South Dakota
    Selective hiringb Page 32                          GAO/GGD-99-146
    Inmates' Access to Personal Information Appendix IV Procedures,
    Statutes, and Pending Bills Jurisdiction    Prison procedures
    Statutes and pending bills Utah           Inmates were screened
    for suitability for employment based on factors such as previous
    employment and prison record Wisconsin
    Wisconsin Pending Assembly Bill 31 (1999):  would prohibit the
    Department of Corrections from entering into any contract or other
    agreement if, in the performance of the contract or agreement, a
    prisoner would have access to any personal information of
    individuals who are not prisoners Note:  We did not independently
    verify the completeness of the data provided by the questionnaire
    respondents. aThis section also was identified by the state as
    requiring that such persons in prison work programs disclose that
    fact before taking any personal information from anyone. bThe
    criterion by which inmates were selected was not specified. cThis
    statute also was identified by the state as containing provisions
    that related to preventing inmates from retaining personal
    information or transferring it to unauthorized inmates or other
    persons. Source:  GAO survey of correctional industry officials,
    state attorneys general, and legal database searches. Page 33
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix IV
    Procedures, Statutes, and Pending Bills Table IV.2:  Statutes and
    Pending Bills That Address Work Programs Involving Access to
    Personal Information in States Where Questionnaire Respondents
    Reported That Inmates Did Not Have Access to Personal Information
    on September 30, 1998 State         Statutes and pending bills
    Colorado      Colorado Revised Statutes, Section 17-24-104:  the
    Correctional Industries Advisory Board, among other things, is to
    consider the feasibility of proposed prison industries that would
    utilize the services of prisoners Maryland      Annotated Code of
    Maryland, Article 27, Section 681C(3)(ii):  authorizes the Board
    of Public Works to suspend certain requirements that state
    agencies utilize correctional industry services when data entry
    services would involve certain types of protected information
    Michigan      Michigan Statutes Annotated, Section
    28.1540(7a)(1)(a):  prohibits inmates assigned to work in a
    private manufacturing or service enterprise from being granted
    access to certain types of employee; customer; or client
    information; including, but not limited to, personal addresses,
    telephone numbers, E-mail addresses, credit card information,
    other financial information, and health records Texas
    Texas Government Code, Section 497.098:  in general, prohibits
    inmates who have previously misused information gained through a
    work program from participating in work programs that provide
    inmates with access to personal information about persons who are
    not confined in the institutional division Texas Pending House
    Bill 812 (1999):  in general, would prohibit the Department of
    Criminal Justice from entering into contracts that would require
    or permit certain sex offenders to have access to personal
    information about persons who are not confined in facilities
    operated by or for the departmenta Texas Pending Senate Bill 420
    (1999):  in general, would prohibit the Department of Criminal
    Justice from entering into contracts that would require or permit
    an inmate confined in a correctional facility operated by or for
    the department to have access to personal information about
    persons who are not confined in facilities operated by or for the
    department Vermont       Vermont Pending Bill H.88 (1999):  would
    require offenders engaged in a work activity involving the
    solicitation of confidential information from the general public
    to disclose such offender status and to obtain the consent of the
    members of public concerned before proceeding Washington
    Revised Code of Washington, Section 72.09:  in general, requires
    work program administrators to ensure that no inmate convicted of
    certain sex offenses obtains access to names, addresses, or
    telephone numbers of private individuals while performing his or
    her duties in an inmate work program Note:  We did not
    independently verify the completeness of the data provided by the
    questionnaire respondents. aThis bill also was identified as
    containing provisions that related to preventing inmates from
    physically retaining personal information or transferring it to
    unauthorized inmates or other persons, i.e., inmates having access
    to certain personal information would be personally searched upon
    entering or leaving the work area. Source:  GAO survey of
    correctional industry officials, state attorneys general, and
    legal database searches. Page 34
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix V
    Income From Work Programs That Allowed Inmates Access to Personal
    Information, Fiscal Year 1998 Income from      Total income
    Percentage of FY 1998 individual            from
    correctional industry gross contracts for    contracts for     FY
    1998 correctional           income from personal
    Jurisdiction/Contractor        FY 1998           FY 1998
    industry gross income           information contracts Federal
    Bureau of Prisons Federal agency                $6,000 Total
    $6,000              $568,000,000                             <0.1
    State Arkansas State agency                 135,000 Total
    135,000                 5,600,000                              2.4
    California State agency              11,962,000 Total
    11,962,000              150,865,000
    7.9 Florida State agency 1                  N/Aa State agency 2
    N/Aa State agency 3                  N/Aa State agency 4
    N/Aa State agency 5                  N/Aa Total
    N/Aa               81,000,000 Idaho State agency
    144,000 Total                                     144,000
    652, 000b                            22.1 Illinois State agency 1
    15,000 State agency 2               278,000 Total
    293,000                47,435,000                              0.6
    Iowa State agency                     N/A Total
    N/A                   120,000 Kansas State agency
    70,000 Total                                       70,000
    10,600,000                              0.7 Kentucky State agency
    294,000 Total                                      294,000
    12,400,000                              2.4 Minnesota Private
    company 1             73,000 Private company 2              3,000
    Total                                     76,000
    17,820,000                              0.4 Page 35
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix V
    Income From Work Programs That Allowed Inmates Access to Personal
    Information, Fiscal Year 1998 Income from      Total income
    Percentage of FY 1998 individual             from
    correctional industry gross contracts for    contracts for
    FY 1998 correctional           income from personal Jurisdiction/
    Contractor        FY 1998            FY 1998        Industry gross
    income             information contracts Missouri State agency 1
    23,000 State agency 2                 13,000 State agency 3
    15,000 State agency 4                       c Total
    51,000                    36,268,000
    0.1 New Hampshire State agency                  130,000 Total
    130,000                     2,500,000
    5.2 New Jersey State agency 1                  3,000 State agency
    2                  3,000 State agency 3                  1,000
    Total                                          8,000
    17,199,000                               <.1 New Mexico State
    agency 1                       d State agency 2
    d Total                                        698,000
    4,400,000                              15.9 New York State agency
    1              2,300,000 State agency 2                500,000
    Total                                       2,800,000
    60,800,000                               4.6 Oklahoma State agency
    1                      c State agency 2                       c
    State agency 3                  6,000 State agency 4
    9,000 State agency 5                 20,000 State agency 6
    2,000 State agency 7               28,000 State agency 8
    220,000 State agency 9                  8,000 State agency 10
    200,000 State agency 11                 1,000 State agency 12
    47,000 State agency 13                13,000 State agency 14
    1,000 State agency 15                 2,000 State agency 16
    150,000 State agency 17                 7,000 State agency 18
    17,000 State agency 19                84,000 State agency 20
    2,000 Total                                        817,000
    16,754,000                               4.9 Page 36
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix V
    Income From Work Programs That Allowed Inmates Access to Personal
    Information, Fiscal Year 1998 Income from      Total income
    Percentage of FY 1998 individual              from
    correctional industry gross contracts for    contracts for
    FY 1998 correctional                    income from personal
    Jurisdiction/Contractor        FY 1998            FY 1998
    industry gross income                      information contracts
    Oregon State agency 1               320,000 State agency 2
    250,000 Total                                       570,000
    15,000,000                                         3.8 South
    Dakota State agency                       0e Total
    0e                              261,000 Utah State agency
    360,000 Total                                       360,000
    12,000,000                                         3.0 Wisconsin
    Private company              170,000 Total
    170,000                              22,844,000
    0.7 Note 1:    Personal information means information that can be
    used to threaten an individual's physical, psychological, or
    financial well-being.  This information would include  (1) credit
    card numbers (personal or business); (2) Social Security numbers;
    or (3) names in combination with physical descriptions or
    financial, medical, or motor vehicle information. Note 2:  Dollar
    amounts were rounded to the nearest  thousand.  Totals may not add
    due to rounding. Percentages were rounded to the nearest tenth.
    aPRIDE Enterprises, a private, not-for-profit corporation that
    operates industries in correctional institutions throughout
    Florida, stated that it contributes over $1 million annually
    toward incarceration costs to the state of Florida and 15 percent
    of total inmate wages to victim restitution. bNet income was
    provided. cLess than $1,000. dState does not have a breakdown by
    individual contract. eContract started in June 1998. Source:  GAO
    survey of correctional industry officials. Page 37
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix VI
    Number of Inmates With Access to Only Names and Addresses Through
    Work Programs Number of inmates Through contracts with    Through
    general support government agencies or       work for correctional
    Jurisdiction                  private companies         industry
    programs                              Total Federal Bureau of
    Prisons                          80                       3,109
    3,189 State Alabama                                     0
    0                              0 Alaska
    0                              3                              3
    Arizona                                    NR
    NR                               NR Arkansas
    7                              1                              8
    California                                  0
    75                             75 Colorado
    11                             21                             32
    Connecticut                                 0
    0                              0 Delaware
    0                             20                             20
    District of Columbia                        0
    0                              0 Florida
    41                         465                               506
    Georgia                                     0
    0                              0 Hawaii
    0                              0                              0
    Idaho                                      31
    30                             61 Illinois
    8                              0                              8
    Indiana                                     0
    0                              0 Iowa
    0                              0                              0
    Kansas                                     10
    0                             10 Kentucky
    0                              0                              0
    Louisiana                                   0
    0                              0 Maine
    0                              0                              0
    Maryland                                   30
    30                            30a Massachusetts
    80                              0                             80
    Michigan                                    0
    26                             26 Minnesota
    33                             30                             63
    Mississippi                                19
    0                             19 Missouri
    15                             60                             75
    Montana                                     8
    4                              8a Nebraska
    112                             43                           112a
    Nevada                                     26
    12                             38 New Hampshire
    0                              0                              0
    New Jersey                                 58
    0                             58 New Mexico
    90                             36                            126
    New York                                    6
    0                              6 North Carolina
    0                              0                              0
    North Dakota                                0
    0                              0 Ohio
    NR                          NR                               NR
    Oklahoma                                  255
    116                               371 Oregon
    145                              8                            153
    Pennsylvania                                0
    0                              0 Rhode Island
    0                              0                              0
    South Carolina                             10
    0                             10 South Dakota
    8                              6                             14
    Tennessee                                  NR
    NR                               NR Page 38
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix VI
    Number of Inmates With Access to Only Names and Addresses Through
    Work Programs Number of inmates Through contracts with
    Through general support government agencies or
    work for correctional Jurisdiction           private companies
    industry programs                                         Total
    Texas                                      0
    0                                           0 Utah
    100                                       0
    100 Vermont                                    0
    0                                           0 Virginia
    0                                     45
    45 Washington                               42
    109                                     151b West Virginia
    28                                       6
    34 Wisconsin                               105
    0                                     105 Wyoming
    3                                      0
    3 Total                                 1,361
    4,255                                  5,539a Note 1: Names and
    addresses mean names and one or more of the following: work or
    home addresses or telephone numbers, names of employer, or job
    titles but no other item that we defined as personal information.
    Note 2: States with "NR" in each category did not return a
    questionnaire. We received a questionnaire from Arizona's
    privately run facilities. These facilities did not have any
    inmates who had access to names, addresses, telephone numbers, or
    other types of personal information.  A representative from Ohio's
    state-run facilities informed us that inmates involved in data
    entry work programs did not have access to credit card numbers or
    Social Security numbers.  We did not receive any information from
    respondents in state-run correctional facilities in Arizona or
    Tennessee. aColumns do not add across to the total column because
    the same inmate may have had access to names and addresses or
    telephone numbers through both contracts and support work. Totals
    indicate the maximum number of inmates with access. b Inmates had
    access to names, work addresses, and work telephone numbers only;
    they did not have access to home addresses or home telephone
    numbers. Source: GAO survey of correctional industry officials.
    Page 39                               GAO/GGD-99-146 Inmates'
    Access to Personal Information Appendix VII Type of Work Performed
    in Work Programs in Which Inmates Had Access to Only Names and
    Addresses Manufacturing Order
    or customer Jurisdiction          fulfillment    Data entry
    Shipping    Printing          support       Order taking
    Telemarketing Federal Bureau of Prisons       C/S             C
    S                              S              S State Alaska
    S                                 S                              S
    S Arkansas
    C California               S
    S              S Colorado                 S Delaware
    S Florida                  S              C                  S
    C                  S              S Idaho                    S
    C/S                 S                              S
    S Illinois                 C
    C Kansas Maryland                               C/S
    C/S Massachusetts            C              C
    C                                 C Michigan Minnesota
    C                                                 S
    C Mississippi              C
    C Missouri                 S              C                  S
    S              S Montana                  S
    S           C                  S              S               C
    Nebraska                C/S             C                  S
    C                                 S               C Nevada
    S                                 S                              S
    S               C New Jersey                              C New
    Mexico              C/S             C                  S
    C                  S                              C New York
    C Oklahoma                C/S             C                  S
    C                  S              S              C/S Oregon
    C              C                  S           C                  S
    S               C South Carolina South Dakota            C/S
    S           C Utah                                    C
    C Virginia                                                   S
    Washingtonr              C              C                 C/S
    C                 C West Virginia
    S           C Wisconsin                               C Wyomings
    Page 40                        GAO/GGD-99-146 Inmates' Access to
    Personal Information Appendix VII Type of Work Performed in Work
    Programs in Which Inmates Had Access to Only Names and Addresses
    Geographic Complaint     Document           Computer-aided
    Document             information Bulk mailing    resolution
    duplication            design               scanning
    system                  Other C              S
    Sa S
    Sb Sc Sd Ce/Sf Sg C              S             C
    C                     C                      C
    Sd S             C C
    Ch C/S Si Cj C                      C C
    Sf S C
    Ck C              S             C
    Cl S                                    C                     C
    Cm C                            C                      C
    C                      C                     Sn Co C
    Sd C
    Cp Sq S                                    C Legend C = Type of
    work performed by inmates who had access to information through
    work program contracts, which is a formal or informal agreement to
    produce a specific product or perform a specific service. S = Type
    of work performed by inmates who had access to information through
    support work, which is not associated with a specific contract,
    but tasks such as order taking or shipping that supported overall
    industry work program operations. C/S = Inmates performed this
    type of work both on contracts and through support work. Note:
    Names and addresses mean names and one or more of the following:
    work or home addresses or telephone numbers, names of employer, or
    job titles but no other item that we defined as personal
    information. Page 41                               GAO/GGD-99-146
    Inmates' Access to Personal Information Appendix VII Type of Work
    Performed in Work Programs in Which Inmates Had Access to Only
    Names and Addresses aCustomer billing. bInstallation. cSending
    invoices to agencies. dClerical work. eResponse to public inquiry
    regarding corporate information from Secretary of State database
    via telephone. fDelivery. gFurniture refurbishing and auto
    maintenance. hTelephone answering. iPurchasing regulations.
    jCoding. kTelephone (incoming calls only). lProviding information
    via telephone. mProduction of various signs. nCalling for quotes,
    prices, and availability. oTravel reservations. pSales and
    purchasing. qTruck loading. rInmates working in Washington's
    correctional facilities have access to names, work addresses, and
    work telephone numbers only. sWyoming failed to designate type of
    work performed by inmates. Source:  GAO survey of correctional
    industry officials. Page 42
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix
    VII Type of Work Performed in Work Programs in Which Inmates Had
    Access to Only Names and Addresses Page 43
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix
    VIII Safeguards Used in Work Programs in Which Inmates Had Access
    to Only Names and Addresses Security check    Selective
    Security check at Monitored telephone Jurisdiction          Close
    supervision         at exit       hiring                 entrance
    calls Federal Bureau of Prisons          C/S
    C/S                                             S State Alaska
    S Arkansas                    S                   C/S
    S California                  S                        S         S
    Colorado                   C/S                  C/S           C/S
    C/S                    C Delaware                    S
    S         S                        S Florida
    C/S                  C/S           C/S                      C/S
    C/S Idaho                      C/S                  C/S
    C/S                   C/S Illinois                    C
    C         C                        C                     C Kansas
    C                                  C
    C Maryland                   C/S                  C/S
    C/S                      C/S                   C/S Massachusetts
    C                        C         C                        C
    C Michigan                    S                        S
    S Minnesota                  C/S                  C/S
    C/S                      C/S                   C/S Mississippi
    C                        C         C                        C
    C Missouri                   C/S                       S         S
    S Montana                    C/S                  C/S
    C/S                      C/S                   C/S Nebraska
    C/S                  C/S           C/S                      C/S
    C/S Nevada                     C/S                  C/S
    C/S                       S                    C/S New Jersey
    C                        C         C                        C
    C New Mexico                 C/S                  C/S
    C/S                      C/S                   C/S New York
    C                                  C
    C Oklahoma                   C/S                  C/S
    C/S                      C/S                   C/S Oregon
    C/S                  C/S           C/S                      C/S
    C/S South Carolina              C                        C
    C                        C                     C South Dakota
    C/S                  C/S           C/S                      C/S
    C/S Utah                        C                        C
    C                        C                     C Virginia
    S                                  S Washingtonn
    C/S                  C/S           C/S                      C/S
    C/S West Virginia              C/S                  C/S
    C/S                   C/S Wisconsin                   C
    C         C                        C Wyoming
    C         C                        C                     C Page 44
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix
    VIII Safeguards Used in Work Programs in Which Inmates Had Access
    to Only Names and Addresses Computer
    Personal program with
    information given         No paper or privacy       Incoming
    No photocopy         Confidentiality           only to
    writing safeguards       calls only     machines
    agreementa            noninmates             instruments
    Other C                      C
    Cb/Sc S               S
    Sd S              S
    S C              C               C
    C S
    Se C/S            C/S              C
    C/S                   C                      Cf C C
    C                                            C C              C
    C/S             C/S                                            C/S
    C/S C              C               C
    C S
    Sg C                              C                      C
    S                                            Sh C
    C                                            Ci S
    C C/S             S                                     C/S
    C                      Sj S               C C              C
    C                      C C/S            C/S              S
    C/S                                           S C
    C C/S             C                                     C/S
    C/S                                        Ck/Sk C/S
    C/S             C/S                     C                      S
    Cl C              C               C
    C S C                                                     C
    C                     C                     Cm C/S             S
    C                      C
    Cl C/S
    Co/So C                              C
    C                      Cp C                              C Legend
    C = Safeguard applied to inmates who had access to types of
    information through a contract, which is a formal or informal
    agreement to produce a specific product or perform a specific
    service. S = Safeguard applied to inmates who had access to types
    of information through performing support work, which is not
    associated with a specific contract, but tasks such as order
    taking or shipping that supported overall industry work program
    operations. C/S = Safeguard applied to inmates who had access to
    types of information as a result of employment on both contracts
    and through support work. Page 45
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix
    VIII Safeguards Used in Work Programs in Which Inmates Had Access
    to Only Names and Addresses Note 1:  Names and addresses mean
    names and one or more of the following:  work or home addresses or
    telephone numbers, names of employer, or job titles but no other
    item that we defined as personal information. Note 2:  A blank
    means that the questionnaire respondent did not report using the
    safeguard. Note 3:  This table does not include inmates who had
    access to names and addresses or telephone numbers and any other
    item(s) that we defined as personal information.  See appendix III
    for a list of safeguards that respondents reported using for
    inmates who had access to personal information. aConfidentiality
    agreements were agreements signed by the inmates not to release
    information obtained through a work program. bPrison staff
    conducted random inspections of work and housing areas. cPrison
    staff conducted random inspections of work and housing areas.
    Prison staff screened outgoing business documents.  Telephones in
    work area were auto-dialed. dNo telephones or computers were used
    by inmates in work area. eInmates were required to make uniform
    changes in work area. fInmates had access to telephones,
    computers, and fax machines connected to network only under direct
    supervision.  Personal information was segmented among inmates.
    All documents in and out are monitored. gInformation was screened
    by prison staff before being accessed by inmates.  Inmates were
    subject to body and cell searches. hInmates did not have access to
    telephones in work area. IPersonal information was segmented among
    inmates.  Surveillance mirrors, security cameras, restricted work
    area, raw materials/supplies control, and random strip searches
    were employed. jPrison staff conducted area shakedowns. Personal
    information was segmented among inmates. kPersonal information was
    segmented among inmates. lTelephones in work area were auto-
    dialed. mTelephones located in the work area were auto-dialed.
    Telephone calls were monitored and taped. nInmates working in
    Washington's correctional facilities had access to names, work
    addresses, and work telephone numbers only. oInmates were not
    allowed to take anything except tobacco into or out of the work
    area. pPrison staff prescreened documents, and inmates were
    subject to pat searches. Source:  GAO survey of correctional
    industry officials. Page 46                               GAO/GGD-
    99-146 Inmates' Access to Personal Information Appendix VIII
    Safeguards Used in Work Programs in Which Inmates Had Access to
    Only Names and Addresses Page 47                        GAO/GGD-
    99-146 Inmates' Access to Personal Information Appendix IX
    Incidents of Misuse of Personal Information by Inmates State
    Date and description of incident                     Safeguards
    reported California (Youth Authority)    In 1991, while on parole
    an inmate used credit       *Selective hiring card numbers
    previously obtained from a prison *Security check at entrance to
    work area telemarketing work program.
*Security check at exit from work area *Monitored telephone calls
*Incoming calls only to work area *No photocopy machines in work
    area *Close supervision while working New Mexico
    In 1995, an inmate wrote a letter to a Medicare      *Selective
    hiring patient identified from information obtained in a
*Computer programs with privacy safeguards data entry work
    program.                             *Close supervision while
    working *Confidentiality agreement signed by inmates New York
    In the mid-90s, an inmate participating in a work *Selective
    hiring program provided another inmate with a name
*Monitored telephone calls and address obtained through the work
*Incoming calls only to work area program. The second inmate wrote
    a letter to         *Close supervision while working the
    individual whose name and address were           *Personal
    information given only to non- provided.
    inmates Oklahoma                        In about 1990, an inmate
    obtained information,       *Selective hiring through
    participating in a data entry work           *Security check at
    entrance to work area program, about an individual's medical
*Security check at exit from work area expenses and wrote the
    individual a letter.          *Computer programs with privacy
    safeguards *Monitored telephone calls *Close supervision while
    working *Confidentiality agreement signed by inmates *Personal
    information segmented among different inmates Oklahoma
    In 1995, two inmates attempted to smuggle            *Selective
    hiring-no misconduct for 6 copies of birth certificates obtained
    through a      months work program out of prison through the U.S.
*Security check at exit from work area mail system.  The birth
    certificates were sent       *Computer programs with privacy
    safeguards back to the prison via return mail.
*Incoming calls only to work area *No photocopy machines in work
    area *Close supervision while working *Confidentiality agreement
    signed by inmates *Personal information segmented among different
    inmates South Carolina                  In 1995, an inmate
    continued to call a particular *Selective hiring-interviews and
    previous individual identified through a work program that work
    history telemarketed local newspaper subscriptions.
*Computer programs with privacy safeguards *Monitored telephone
    calls *Close supervision while working *Personal information given
    only to non- inmates Page 48                              GAO/GGD-
    99-146 Inmates' Access to Personal Information Appendix IX
    Incidents of Misuse of Personal Information by Inmates Program
    continued after incident How safeguards failed           Sanctions
    against inmate                 Yes                 No    Changes
    to safeguards Unknown                         Inmate charged and
    convicted               *a Inmate was not searched when Inmate was
    given disciplinary                                   *     N/A
    leaving work area               segregation time and was not
    allowed to work for Correctional Industries Inmate left the
    premises with the Inmate was removed from the              *
    Existing securities were reviewed information
    work program
    and reinforced Inmate memorized the address Inmate was given a
    written                    * reprimand, placed in restrictive
    housing, and barred from future employment in industry work
    programs Despite the fence around the    Both inmates were given
    written            *                       Monitors were placed on
    the gate to work area and pat down          reprimands, fired from
    the work                                    watch the area
    procedures, these papers were program, and transferred from
    removed                         this particular area of the prison
    Inmate was not monitored while Inmate was given a written
*     N/A making telephone calls          reprimand for disobeying
    orders Page 49                            GAO/GGD-99-146 Inmates'
    Access to Personal Information Appendix IX Incidents of Misuse of
    Personal Information by Inmates State           Date and
    description of incident                    Safeguards reported
    South Dakota    In 1990 or 1991, an inmate used a credit card
*Unknown to questionnaire respondent number, obtained from a work
    program making motel reservations, for personal purchases. Texas
    In the early 1990's, an inmate wrote a letter to    Unknown to
    questionnaire respondent an individual identified through a data
    entry work program and included personal information also obtained
    through the work program. Washington      In 1997, an inmate sent
    a Christmas card to an *Selective hiring-offense history
    individual identified through a 1-800               *Security
    check at entrance to work area information line.  The individual
    had called for    *Security check at exit from work area
    information on state parks.                         *No photocopy
    machines in work area * Monitored telephone calls Page 50
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix IX
    Incidents of Misuse of Personal Information by Inmates Program
    continued after incident How safeguards failed
    Sanctions against inmate                          Yes
    No     Changes to safeguards Unknown
    Inmate was prosecuted
*      N/A Unknown                           Case is in litigation
*      N/A Lack of supervision; failed to use Inmate was
    disciplined and                                          *b
    N/A available technology              terminated from work
    program; manager was demoted and subsequently reassigned Note:
    Incidents of misuse of personal information means any action that
    had threatened or caused injury to the physical, psychological, or
    financial well-being of any member of the public.  Some of these
    incidents involved only names and addresses or telephone numbers,
    not "personal information" as we defined it for this report. a
    Program was discontinued in 1998. bTelemarketing activities were
    eliminated as a correctional industries business. Source:  GAO
    survey of correctional industry officials. Page 51
    GAO/GGD-99-146 Inmates' Access to Personal Information Appendix X
    Comments From the Bureau of Prisons Page 52    GAO/GGD-99-146
    Inmates' Access to Personal Information Appendix XI Comments From
    the Correctional Industries Association, Inc. Page 53    GAO/GGD-
    99-146 Inmates' Access to Personal Information Appendix XII GAO
    Contacts and Staff Acknowledgments Brenda Bridges, (202) 512-8777
    GAO Contacts Mary Lane Renninger Acknowledgments    Nancy A.
    Briggs Geoffrey R. Hamilton David P. Alexander Stuart M. Kaufman
    Michael H. Little Page 54                   GAO/GGD-99-146
    Inmates' Access to Personal Information Page 55    GAO/GGD-99-146
    Inmates' Access to Personal Information Page 56    GAO/GGD-99-146
    Inmates' Access to Personal Information Ordering Information The
    first copy of each GAO report and testimony is free. Additional
    copies are $2 each. Orders should be sent to the following
    address, accompanied by a check or money order made out to the
    Superintendent of Documents, when necessary. VISA and MasterCard
    credit cards are accepted, also. Orders for 100 or more copies to
    be mailed to a single address are discounted 25 percent. Order by
    mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC
    20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts.
    NW) U.S. General Accounting Office Washington, DC Orders may also
    be placed by calling (202) 512-6000 or by using fax number (202)
    512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of
    newly available reports and testimony. To receive facsimile copies
    of the daily list or any list from the past 30 days, please call
    (202) 512-6000 using a touch-tone phone. A recorded menu will
    provide information on how to obtain these lists. For information
    on how to access GAO reports on the INTERNET, send e-mail message
    with "info" in the body to: [email protected] or visit GAO's World
    Wide Web Home Page at: http://www.gao.gov United States General
    Accounting Office           Bulk Rate Washington, D.C. 20548-0001
    Postage & Fees Paid GAO Permit No. G100 Official Business Penalty
    for Private Use $300 Address Correction Requested (182833)

*** End of document. ***