Preserving the Integrity of Social Security Numbers and Preventing Their Misuse by Terrorists and Identity Thieves

Good afternoon, Chairman Shaw, Chairman Gekas, Ranking Member Matsui, Ranking Member Jackson Lee, and Members of the Subcommittees on Social Security and Immigration, Border Security, and Claims. I welcome the opportunity to be here today to discuss homeland security as it relates to the integrity of the Social Security number (SSN). This is my seventh appearance before a congressional hearing this year to discuss the importance of extending protections for SSN integrity, and I cannot bring this message to Congress too often.

My testimony today follows up my June 25th testimony before Chairman Gekas, Ranking Member Jackson Lee, and Members of the Subcommittee on Immigration, Border Security, and Claims. Today I would like to examine further the role SSN fraud plays in crime and terrorist activity, and some methods by which criminal fraud is executed utilizing stolen or fraudently-obtained SSNs.

The problem of SSN fraud as it applies to terrorist activities can be very different from using the SSN for illicit gain. Let me focus on the challenge of homeland security, because while the financial crimes involving SSN misuse are also serious, they are perhaps less deadly and yet better known to Congress. Both aspects are part of the growing phenomenon of false identity, and both call for protecting the integrity of the SSN.

Let me say at the outset that the Social Security Administration (SSA) has worked very hard in recent years and made significant progress in strengthening the defenses of the SSN, implementing important suggestions our office has made and working with us to find solutions. There is more to be done, and it includes legislative action.

Our audit and investigative work identifies three distinct approaches to SSN integrity for which legislation is critically needed. The first area is limiting the use and display of the SSN already in circulation in the public and private sectors. Second, the present arsenal of criminal, civil, and administrative penalties is clearly insufficient to deter and/or punish identity thieves. The third approach is requiring the cross-verification of SSNs through both governmental and private sector systems of records to identify and address anomalies in SSA’s files, and in data bases at various levels of government and the financial sector. I will discuss these further below.

The Risk to Homeland Security

In calendar year 2000 alone, SSA issued approximately 1.2 million SSNs to non-citizens, out of some 5.5 million SSNs issued in all. A recently conducted Office of Inspector General (OIG) study indicates that 8 percent (about 96,000) of those 1.2 million SSNs were based on invalid immigration documents, which SSA processes did not detect. We have no way of determining how many SSNs have been improperly assigned to non-citizens.

The issuance of SSNs based on invalid documentation creates a homeland security risk. My office has participated in 24 airport security operations across the country with the Department of Justice (DOJ) and its Joint Terrorism Task Forces and other Federal agencies since the 9/11 terrorist attacks a year ago. The aim is to ensure that no airport employee who has misrepresented his or her SSN and identity has access to secure areas of the Nation’s airports. OIG’s focus in airport security operations has been SSN misuse and false statements. Hundreds of people have been arrested to date, and more importantly, have been denied access to the secure areas that represent a significant vulnerability to terrorism.

Immediately after the terrorist attack of September 11, 2001, we sought to determine if and how the hijackers might have obtained SSN’s. We may never know with absolute certainty how many of the 19 hijackers of September 11th used improperly obtained SSNs, or how they obtained them. The investigation into the events of that day, and related work, revealed the importance of the SSN in any attempt at assimilation into American society. Today, it is unrealistic to believe that the SSN is simply a number for tracking workers’ earnings and the payment of social insurance benefits. The SSN has become the de facto national identifier. Protecting the integrity of that identifier is as important to our homeland security as any border patrol or airport screening.

Let me give you an example of this threat from a case that is just completing the sentencing phase. The Anti-Terrorist Task Force arrested a naturalized American citizen who had trained with Palestinian guerrilla groups in Lebanon since he was 12 years old. He was carrying a loaded semi-automatic pistol and an assault rifle in the back seat of his car, along with four loaded 30-round magazines for the rifle and hundreds of rounds of additional ammunition. In his home were a calendar with September 11th circled in red, three different Social Security cards in his name, a false Alien Registration Card, evidence of credit card fraud and $20,000 in cash, as well as a wood carved plaque with the name of the terrorist group “Hamas” on it. We determined he had obtained the three different SSNs from SSA by falsifying two of his three SSN applications. He had used them to get jobs as a security guard and as an employee with the multi-billion-dollar Intel Corporation, when a criminal history check would have kept him from getting either job under his true identity.

Failure to protect the integrity of the SSN has enormous financial consequences for the Government, the people, and the business community. We must protect the number that has become our national identifier and the key to social, legal, and financial assimilation in our country.

It is becoming more and more apparent that those connected with terrorism will at some point obtain SSNs. They may buy them, they may create them, or they may obtain them from SSA directly through the use of falsified immigration records. But to operate in the United States, they need those numbers, and we must take those steps necessary to ensure that those numbers do not come from SSA.

While SSA alone cannot solve the complicated problem of homeland security, no government agency, system or policy should be ignored. Congress and SSA, as public stewards, must continue their efforts to strengthen the systems and processes that minimize the use of SSNs for illegal purposes. SSN integrity is a link in our homeland security that must be strengthened and sustained.

Federal Interagency Coordination and Cooperation

You have asked that I comment on Federal interagency coordination and cooperation to verify identification documents and to detect and prevent fraud. We recently issued a Management Advisory Report entitled Social Security Number Integrity: An Important Link in Homeland Security. This report said it is critical that SSA independently verify the authenticity of the birth records with States, immigration records with Immigration and Naturalization Service (INS), as well as other identification documents presented by an applicant for an SSN.

Additionally, in other reports, we have urged full and expedited implementation of a joint Enumeration at Entry program in which the Agency would issue SSNs to non-citizens upon their entry into the United States, based on information obtained from INS and the Department of State. Until September 11th, SSA had limited success encouraging INS to move quickly on these planned initiatives.

We continue to work with other Federal officials to ensure that we are doing all that we can to assist the DOJ and others to use SSN information in the homeland security context. We are in constant contact with these Federal officials and agencies and with other committees of both houses of Congress to provide expertise and assistance in the analysis of data and the creation of legislation aimed at protecting the SSN and preventing it from being used improperly. We appreciate your interest in these issues, and your support of increasing cooperation, coordination, and information sharing between SSA and the Departments of Justice, State, and Treasury.

Legislative Proposals to Combat SSN Misuse and Protect Privacy

Let me take this opportunity to recommend some legislative proposals aimed at combating SSN misuse and protecting privacy. While no legislation can eradicate SSN misuse and identity theft altogether, the criminal penalties that exist today are clearly insufficient to either deter or punish identity thieves. Members of both houses of Congress have introduced legislation over the past several years to deal with the national dilemma presented by SSN misuse and identity theft.

The felony provisions of the Social Security Act have no civil or administrative counterparts. Federal prosecutors cannot pursue every SSN violation criminally, or even civilly. We have found the Civil Monetary Penalty program to be an effective tool in the similar area of program fraud, and could have a useful impact in the area of SSN misuse if Congress would grant us such authority. We have asked before, and I ask again-vest in us the authority to impose penalties against those who misuse SSNs.

We also believe it is time to consider enhancing the penalties for identity theft violations. Congress should also move beyond the penalties for the improper use of another person’s identity to address the problem of selling SSNs and other Social Security information. We should strengthen the laws on sales and enhance the sentencing guidelines to allow us to better address this aspect of identity theft today. Congress might consider something on the order of escalating penalties, perhaps parallel to the treatment of drug cases.

Controlling SSNs in Circulation

Another area in which legislation is sorely needed is in limiting the use and display of the SSN in the public and private sectors. Although we cannot return the SSN to its simple status of a half-century ago, we must take steps to limit its use and to limit the expansion of its use. First and foremost, it is time to make the difficult determinations as to those uses that are appropriate and necessary, and those that are merely convenient.

One easy decision can be made now. The public display of SSNs-on identification cards, motor vehicle records, court documents, and the like-must be curtailed immediately. Those who use the SSN must share the responsibility for ensuring its integrity. We can prevent identity thieves and other criminals from walking out of a municipal courthouse with the means of committing state-facilitated identity theft. The cost to the victims of identity theft, and to all of us, is too great. And the potential for using SSNs to support acts of violence and terrorism is unthinkable.

Congress should consider requiring the cross-verification of SSNs through both governmental and private sector systems of records to identify and address anomalies in SSA's files, and in data bases at various levels of government and the financial sector. Only in such a way can we combat and limit the spread of false of identification and SSN misuse. In this way can we correct errors on a timely basis that might otherwise keep workers from receiving full credit for years of labor, credit that can be nullified by simple typographical errors in submitting their data. Similarly, all law enforcement agencies should be provided the same SSN cross-verification capabilities currently granted to employers. The rewards of cross-verification can be great, and it does not require major expenditures of money or the creation of new offices or agencies. It would use data the Federal, State and local governments and the financial sector already have.

I have come before you today not only to report on what has been done so far, but also to ask that Congress instruct us on the path to follow in resolving conflicts of law and policy. We face contradictions among serious and legitimate interests regarding the sharing of information between agencies-and, indeed, often within a single agency-and privacy, and between Federal laws pertaining to immigration and our Nation's economic interests.

In this vein, I would urge Congress to examine whether sufficient authority-and, indeed, requirement-for data-sharing exists in current law. In recent months, SSA has sent about 800,000 letters to employers and some 7 million letters to workers in an attempt to clean up discrepancies created when employers submit employee names and SSNs which do not match information in SSA files. SSA provides the Internal Revenue Service (IRS) with information on the employers with the highest volume of discrepancies, because only the IRS can levy penalties. SSA has no authority to levy penalties when employers submit invalid name and SSN combinations. SSA does not have a similar process in place to share this mismatched data with the INS. As we have learned since September 11 of last year, agencies must be able to share information that can make linkages that will help head off threats and enforce our laws. That authority must be made clear in statute.

We still need legislation that regulates the use of the SSN and provides enforcement tools to punish its misuse. If we are to head off the many crimes identity theft breeds-the fraud against public and private institutions, the ruin of people's security, possibly even the disguising of terrorists as ordinary people-we need legislation with provisions such as:

SSNs, Immigrants, and the Earnings Suspense File

SSA's Earnings Suspense File (ESF) is an indicator of the problem. The ESF is the Agency's record of annual wage reports submitted by employers for which employee names and SSNs fail to match SSA's records.

Most immigrants-about 75 percent-come to the United States legally, many to join close family members. However, INS estimated the illegal immigrant population reached about 5 million in 1996, not including the 3 million who were given amnesty under the Immigration Reform and Control Act of 1986. INS estimates the number of undocumented (i.e., illegal) immigrants continues to grow by about 275,000 each year.

To acquire an SSN improperly, undocumented immigrants either apply for a "legitimate" SSN using false documents, or they create or purchase a counterfeit Social Security card. Since an undocumented immigrant is not required to show a Social Security card prior to hiring, he or she may simply invent a nine-digit number. These are all criminal acts. This SSN may be one the Agency has already assigned to another individual (stolen SSN) or one never assigned (fake SSN).

SSA acknowledges that illegal immigrants account for a significant portion of items in the ESF. Three industries-agriculture, food and beverage, and services-account for almost half the wage items in the ESF. Agriculture is the largest contributor, representing about 17 percent of all ESF items. In one study of 20 agriculture employers, we determined that 6 of every 10 wage reports submitted by these employers had incorrect names or SSNs. From 1996 through 1998, these 20 employers submitted over 150,000 wage items for which the employee's name and/or SSN did not match SSA records, representing almost $250 million in suspended wages over the 3-year period.

A moment ago, I discussed SSA's letters to employers and workers aimed at clearing up discrepancies in the ESF. As I noted, SSA has no legal authority to levy fines and penalties against employers or employees who submit incorrect SSN information on wage reports. As provided by law, SSA must rely on the IRS to enforce penalties for inaccurate wage reporting and upon the INS to enforce immigration laws. IRS has been reluctant to apply penalties, and SSA and the INS have had limited collaboration on the issue.

Applying penalties would have a ripple effect on employers who consistently submit wage reports for employees whose names and SSNs do not match SSA's records. Although SSA is primarily interested in penalizing the most egregious employers, IRS staff expressed concern with the application of even these penalties. IRS senior staff members believe they and SSA would have a difficult time determining whether an employer exercised appropriate diligence in obtaining the necessary information from employees. We believe SSA could provide the IRS with sufficient evidence to show an employer knew or should have known its employees' SSNs were incorrect. Despite the concerns of IRS, the two agencies held discussions to explore the enforcement of an existing penalty provision ($50 per incorrect wage report) for employers who repeatedly submit erroneous name and/or SSN information.

In calendar year 2000, based on this agreement, SSA provided a list of 100 of the most egregious employers to the IRS. These employers submitted the largest number of name/SSN match failures in consecutive years. The IRS expressed interest in the listing but, to date, has not assessed penalties.

SSA's coordination with the INS has been minimal. For example, SSA does not provide the INS a list of employers who repeatedly submit erroneous name and/or SSN information. In a previous audit report, we recommended that SSA:

(1) collaborate with INS to develop a better understanding of the extent that immigration issues contribute to SSN misuse and growth of the ESF, and

(2) re-evaluate its application of existing disclosure laws or seek legislative authority to remove barriers and allow SSA to share with the INS information regarding employers who chronically submitted incorrect wage reports. SSA disagreed with our recommendations and stated that its interpretation of the privacy and disclosure issues is accurately applied and continues to provide appropriate disclosure guidance within existing authority.

The intent of our recommendations was to suggest that the Agency look for avenues under current law and regulations first before seeking legislative authority. We acknowledge SSA's efforts to combat SSN misuse and reduce the ESF's growth. However, given the magnitude of SSN misuse by unauthorized non-citizens, we continue to believe SSA should take preemptive and preventive measures to ensure the SSN's integrity. We continue to believe that the sharing of such information in certain situations would stem the growth of SSN misuse for employment purposes.

The Fruits of Illegal Labors

SSA allows an individual to present evidence of a work history on a non-work SSN or as an illegal alien, and to receive credit for the work towards Old-Age, Survivors and Disability Insurance (OASDI) benefits. SSA provides these benefits to people based upon their lifetime earnings reported under a valid SSN. The number of quarters of earnings maintained on the ESF determines whether an individual has enough credits for insured status. SSA creates a work history for all individuals with a valid SSN, even when:

As long as an individual can prove that earnings belong to him or her, SSA will provide earnings credits to that individual. Once these earnings are recorded, these individuals are essentially treated as any other individual applying for OASDI benefits.

One problem is the widespread use of non-work SSNs by people who work in the economy illegally. The earnings from illegal work from these people is recorded directly in the SSA claims systems for their future credit. In our September 1999 report, Review of Controls Over Non-work Social Security Numbers (A-08-97-1002), we estimated that unauthorized earnings associated with non-work SSNs may have already cost SSA's trust funds $287 million, and could cost the trust funds as much as $63 million annually. In our report, we recommended that SSA propose legislation to prohibit the crediting of non-work earnings and related quarters of coverage for purposes of benefit entitlement.

In addition, people who are in the country illegally and working under a created SSN, or misusing someone else's SSN, can later rebuild their earnings record from wage items posted to the ESF. In such a case, an individual could work illegally in the United States for 25 years, later request and receive a valid SSN, and then ask SSA to locate those suspended earnings that SSA could not post due to an invalid name/SSN combination. Once found, SSA can reinstate these earnings to this individual's earnings record. The individual claiming the wages would only need to provide corroborating documents, such as relevant wage reports, for the period of claimed earnings. These newly posted earnings can then be used to make the individual eligible for OASDI benefits.

Our reviews of the suspended wages in the ESF suggest that illegal work is the primary cause of suspended wages. These claims represent a future obligation to the SSA that is growing at a rapid rate. Under current SSA procedures, workers who are subsequently issued a legal residency card under an amnesty or other INS procedures can subsequently recover most of these wage claims.

In addition, we do not have a good number for illegal aliens receiving work credits. We routinely identify some of them through our audits and investigations, but these are not all-encompassing. For example, in a recent report, we projected that almost 100,000 non-citizens obtained SSNs in calendar year 2000 with false documents. Approximately 42 percent of those had earnings posted to their accounts, thereby receiving work credits. Nonetheless, this figure does not take into account any future wages these 100,000 may earn. Furthermore, the 100,000 figure does not include illegal aliens using other people's SSNs for work purposes and whose earnings either end up in the ESF or incorrectly posted to the legitimate number-holders' accounts.

SSA has recently changed its policies governing the issuance of non-work SSNs so that it is likely that fewer than 30,000 non-work SSNs will be issued in 2002. However, many non-work SSNs remain in circulation. Prior to the recent curtailment, SSA had issued roughly 7.3 million non-work SSNs since 1974.

Viewed another way, although such aliens may be residing and working illegally in our country, they are doing work for pay, they are paying taxes, and they are accumulating earnings records with SSA in the same manner as legal workers. SSA's policy of allowing such workers who subsequently obtain bona fide SSNs to recreate their files so as to capture the fruits of their labors are drawn from the agency's mission, history, and understanding of the Social Security Act, rather than from a lack of concern for immigration law.

Here, once again, I submit that we are in need of this body's guidance to resolve a dilemma of legitimate interests. We find ourselves stuck in a quagmire of contradictory interests that has resulted in the absense of clear, controlling laws and regulations, or in the ignoring of those laws and regulations that do exist.

Conclusion

We believe SSA has a clear and important role in homeland security. We appreciate your interest in these issues, and your support of increasing cooperation, coordination, and information sharing between SSA and the Departments of Justice, State, and Treasury. We believe our earlier recommendations and legislative proposals should be considered in any future discussion on homeland security. It is also important that we be able to reduce the growth of the ESF, and I commend SSA for the efforts it has made. More needs to be done, even though the ESF problem is more a symptom of the undermining of SSN integrity rather than a cause of it. Finally, we need to change the current laws which allow illegal work to be used in obtaining Federal benefits. Ours is a Nation of laws, and those laws originate here. I ask for your help in clarifying and strengthening the laws, and toughening the penalties that are designed to improve the integrity of the SSN, which is a key component of homeland security.

Thank you.

Date: September 19, 2002

OIG Official: James G. Huse, Jr., Inspector General

Committee/Subcommittee: U.S. House of Representatives Committee on Ways and Means, Subcommittee on Social Security & U.S. House Committee on the Judiciary, Subcommittee on Immigration, Border Security, and Claims

Link: /assets/uploads/2002-09-19_preserving-the-integrity-of-social-security-numbers-and-preventing-their-misuse-by-terrorists-and-identity-thieves_james-g-huse-jr.pdf