Hearing of the Commerce, Trade, and Consumer Protection Subcommittee of the House Energy and Commerce Committee

Federal News Service September 28, 2004 Tuesday

HEADLINE: HEARING OF THE COMMERCE, TRADE, AND CONSUMER PROTECTION SUBCOMMITTEE OF THE HOUSE ENERGY AND COMMERCE COMMITTEE SUBJECT: PROTECTING THE PRIVACY OF CONSUMERS' SOCIAL SECURITY NUMBERS

CHAIRED BY: REPRESENTATIVE CLIFF STEARNS (R-FL)

WITNESSES:

THOMAS B. LEARY, COMMISSIONER, FEDERAL TRADE COMMISSION; BARBARA BOVBJERG, DIRECTOR, EDUCATION, WORKFORCE AND INCOME SECURITY, GOVERNMENT ACCOUNTABILITY OFFICE;

CHRIS JAY HOOFNAGLE, ASSOCIATE DIRECTOR, ELECTRONIC PRIVACY INFORMATION CENTER

BODY:

BREAK IN TRANSCRIPT

REP. JAN SCHAKOWSKY (D-IL): Thank you, Chairman Stearns and thank you for holding today's hearing on H.R. 2971, the Social Security Number Privacy and Identity Theft Protection Act. This bill which would restrict what both the public and private sectors can do with Social Security numbers is an important tool in the fight against identity theft.

Identity theft, as you mentioned, Mr. Chairman, is one of the fastest growing financial crimes in the United States with the number of victims doubling each year over the past three years. As the Federal Trade Commission reports, in 2003, there were nearly 10 million Americans victimized by this crime. Over the past five years, there have been 27 million victims. Both of our states, Chairman Stearns, rank in the top 10 for identity theft occurrences. Florida is fifth, Illinois is ninth.

Although half of the victims do not know how their personal information was stolen, we do know that Social Security numbers are one of the most important means that identity thieves use to financially establish themselves as someone else. When we consider the financial door Social Security numbers can unlock and the pervasiveness of the use of these numbers, then the rise in the number of occurrences of identity theft should come as no surprise really.

As we have all personally experienced, everyone wants our Social Security number.

It's not just when we open a bank account or apply for a credit card, even when we accept a new job. Our Social Security number is requested when we get an insurance policy, open a new phone account, sign a lease, you name it. So many times, when we establish a business relationship, the other party wants our number whether there is a legitimate need for it or not. Most times, consumers provide it. We feel we have to do so.

But we are so used to being asked for our number that we may not give enough thought to what the other party might do with our Social Security number. That company may sell them. The numbers may be transmitted over the Internet for legitimate purposes but may not be protected in those transmissions. Our new accounts may be linked to our Social Security numbers. The numbers may be displayed on forms or files that are not adequately protected. These possibilities should give everyone pause.

If we can limit how other parties, public and private use our numbers, then we can establish a good framework to prevent the misuse of the key to our personal financial information. We know that identity theft is financially and emotionally devastating. It can take years to discover that one has been victimized or even longer to repair that damage. That is why I'm very pleased that we are considering H.R. 2971 today.

Again, it is truly an important start. However, I also believe we can and need to do more. We, as government officials, need to make sure there are adequate resources for consumers both to prevent them from becoming victims or to help them if they are victimized. We need to make sure we are also helping consumers protect themselves by giving them the information they need to do so.

We need to make sure everyone knows how to check their credit reports regularly. This is how most find out they were victimized. We need to make sure that there is help available for victims to recover their losses and to clean up their credit reports with as little hassle and frustration as possible.

We need to be as proactive and responsive as we can. I look forward to considering the conversation about what we need to do and although we have an unusually small panel of witnesses for our subcommittee, I am pleased that you could join us today. I look forward to hearing from you.

Thank you, Chairman Stearns.

BREAK IN TRANSCRIPT

REP. SCHAKOWSKY: Mr. Hoofnagle, I bank online and my password is my Social Security number. Are you saying that there is danger in that and also that there is not any particular good reason for that to be my pin number to log in? Actually, they give you a pin number. My first identifier though is my Social Security number.

MR. HOOFNAGLE: It is not a good idea to use a Social Security number as the main identifier for your account. It's not necessary for the company to do so. And the general problem is that your Social Security number might be available on other contacts. It might be on public records. It might be in the business records of the companies without good security and access to the number could provide someone an opportunity to interfere with your accounts.

REP. SCHAKOWSKY: Does that mean that each time that I call for help, the help line, that the individual who is looking at my account is also looking at that screen that has my Social Security number and has complete access to that?

MR. HOOFNAGLE: It depends on the company representative. Some companies have layered access to personal information and essentially condition access on the need for it. Some companies do not. So it's entirely up to whether or not the company has good internal security protocols. But the risk that you are articulating here, I think, is the primary identity theft risk and I think, in reality, there is very little that consumers can do about identity theft because so much of the crime occurs as a result of insider access.

REP. SCHAKOWSKY: This is a major financial institution. This isn't some small bank either that does that. That's interesting to me. What is the indication of encryption or other security? How do I know that as a consumer, if that number that I give is encrypted? What does that mean?

MR. HOOFNAGLE: Consumers have very little insight into security practices and one of the core ideas behind privacy, the so-called fair information practices. The idea that you have access to your personal information, that you can audit access to your information and that there is real security safeguards.

REP. SCHAKOWSKY: But is there an icon, is there anything that tells me normally? I have never looked for that and I have never noticed it. Is there something that says it's encrypted in some way?

MR. HOOFNAGLE: In a standard browser, a little lock icon should appear at the bottom of the browser. But the consumer, in addition to seeing that little lock, should click on the lock to make sure that the certificate that is being issued by the website matches the bank's web address. And you see, that step, that extra step of actually matching the certificate is beyond most consumers.

REP. SCHAKOWSKY: The issue of restitution for consumers seems to be one that has not been particularly addressed.

I know that, in looking through your testimony, Mr. Leary, that you get a lot of complaints and those are shared, I guess, with law enforcement. But what we hear in terms of constituent complaints is that it is just a hassle beyond tolerance to try and get any restitution or get any relief or just even getting it corrected, much less even getting-I'm wondering if any of you can comment on that and what kinds of things we can be doing to help once the theft has already occurred.

MR. LEARY: Well, there's an irony here too, as well, because as you know, the Federal Trade Commission does administer some restitution programs in a very limited way. And by that I don't mean that our remedies are limited but I mean that our resources are limited. And so our efforts are necessarily selective, exemplary and usually aimed at covering as large a group of consumers as we can in a particular complaint against a particular company. In other words, we are not equipped to deal with the individual constituent complaints which you have and which I know are a very serious problem.

One of the great ironies here is that in the world we live in today, Social Security numbers are a very quick and ready way to find people who might otherwise not be able to be located for the purpose of administering redress programs to wide numbers of people who have been injured.

So I don't have-I wish I could tell you that there's some way that we, the Federal Trade Commission, can help you with these individual consumer complaints, but I'm afraid that we have to deal with only things that have a much larger impact. I get consumer complaints mailed into me as well, and one of the very sad and frustrating things is that we simply don't have the resources to deal with these individual things. We can give people advice. We have advice in the booklets as to whom you can go to, steps you can take to repair your credit, at least to cut off the damage. But when it comes to actually getting redress against the wrongdoers, that's a real tough job.

MS. BOVBJERG: I don't have a lot to say about redress but I did want to say that I think things have been getting a little better with regard to law enforcement coordination, and that that does help people. But it is very frustrating and disheartening for individuals where the crime doesn't meet a threshold that a federal law enforcement agency will investigate. They have to go to state and local enforcement and the coordination may or may not be there, depending on where the crime occurred, where the person lives. It's terribly frustrating for them and you can understand why they would like restitution. But even then I don't know that it can really compensate for the time and the damage that is done to this person's life.

MR. HOOFNAGLE: A number of victims have attempted to sue companies that have improperly granted credit to imposters, and those lawsuits have generally failed, unfortunately, from our view. We think a great protection, moving forward, would be the ability of a victim to actually pursue a credit issuing bank or a credit issuing retailer that negligently extends credit to an imposter. And there are amazing examples of this behavior where someone, an imposter, applies for credit and only the Social Security number matches, nothing else matches, and the creditor still issues an account. And we think that behavior really needs to be reined in.

REP. SCHAKOWSKY: And that there are no legal-there are legal impediments to pursuing that in the courts?

MR. HOOFNAGLE: There are four cases that have been litigated in the federal courts on that issue and all four have failed. The most recent was before the Supreme Court of South Carolina, where that court said that there was no duty between the credit issuer and the victim. So even though the credit was granted in the victim's name to an imposter, the court still would not recognize a right of action.

REP. SCHAKOWSKY: All right. Thank you.

BREAK IN TRANSCRIPT