Local Matters
Lawmakers have been scrambling since last week's announcement that a security breach at ChoicePoint, a Georgia-based credit reporting agency, compromised the files of 144,000 consumers nationwide. Congress has schelduled hearings and begun drafting legislation, while in Vermont, the Attorney General's office told ChoicePoint it must notify the 111 consumers in the state whose files may have been affected.
Nonetheless, it appears the Vermont Legislature will wait another year before tackling a major aspect of the problem: the widespread and pervasive use of Social Security numbers by state government.
Social Security numbers are one of the unique identifiers used by governments and businesses to distinguish citizens. Once an identity thief steals a victim's Social Security number, it's relatively easy to perpetrate a crime. According to the Federal Trade Commission, identity theft costs the economy about $50 billion annually. In Vermont, identity theft is most commonly used for credit card fraud, utilities theft and bank fraud.
Last June, Governor Jim Douglas signed into law Act 155, which makes identity theft a crime and lets victims freeze their credit reports. Act 155 also requires state agencies to redact Social Security numbers from government documents before they are publicly posted.
However, eight months after the law went into effect, state officials acknowledge that the bill was only a stopgap measure, and that the easy accessibility of Social Security numbers remains a serious concern. A report prepared for the Legislature by the "Identity Theft Study Committee" found "approximately forty examples" of state government uses of Social Security numbers. The report also warned that "we are concerned that this list is only the tip of the iceberg."
Fixing the problem is daunting since state and federal laws mandate the use of Social Security numbers under so many different circumstances, from child-support services to unemployment insurance. State officials admit that revamping all the state's databases would be both costly and time-consuming. What's more, as the committee report points out, coming up with new identifiers to replace Social Security numbers could simply shift the problem.
This predicament isn't restricted to state agencies. As Secretary of State Deb Markowitz points out, Social Security numbers are widely available in town offices on public filings such as transfer tax documents, which clerks are prohibited by law from altering. In fact, town clerks are specifically exempt from the provisions of Act 155.
As if to highlight the pervasiveness of the problem, when Markowitz was interviewed last week, she wasn't even aware that a database on her state website still includes hundreds, if not thousands, of Vermonters' names, addresses, signatures and Social Security numbers. The searchable database includes thousands of UCCs, or Uniform Commercial Code liens, which are claims filed by banks and other lending agencies against individuals and businesses that owe them money. According to Markowitz, the state's online UCC database receives hundreds of hits each day and saves the business community thousands of dollars in research costs.
"Having them online is one of the things we get the most thanks for," Markowitz says of the UCCs. But after she was informed of the accessibility of Social Security numbers online, Markowitz said she would immediately consult with her information technology people.
The Identity Theft Study Committee has recommended that the Legislature enact legislation similar to what was recently adopted in Illinois. Such a bill would prohibit the public posting or display of an individual's Social Security number, its transmission over the Internet without encryption, and the use of SSNs on ID cards or in materials mailed to consumers.
The proposed statute would apply to both the public and private sectors, though implementation by state government would be delayed pending further study by the committee.