Social Security Administration
Actions Taken to Strengthen Procedures for Issuing Social Security Numbers to Noncitizens, but Some Weaknesses Remain
Gao ID: GAO-04-12 October 15, 2003
In 2002, the Social Security Administration (SSA) issued nearly 6 million new Social Security numbers (SSNs), of which 1.3 million were issued to noncitizens. Despite its narrowly intended purpose, the SSN has in practice become the national identifier. SSNs are key pieces of information in creating false identities, underscoring the importance of issuing SSNs only to those eligible for them and of protecting those already assigned to individuals. The flow of noncitizens into the United States and the accompanying number of SSNs issued to them over the last several years add to the importance of having sound practices to avoid issuing SSNs to those who do not qualify for them. Congress asked GAO to describe and assess SSA's key initiatives to ensure the appropriate issuance of SSNs to noncitizens and identify vulnerabilities to error or fraud SSA has not yet addressed.
SSA Has Increased Noncitizen Verifications and Begun New Initiatives: SSA has taken steps to prevent the inappropriate assignment of SSNs to noncitizens. SSA now requires field staff to verify noncitizens' identity documents with the Department of Homeland Security (DHS), in addition to continuing to require visual inspection of these documents, prior to issuing an SSN. However, many field staff GAO interviewed are relying heavily on DHS's verification while neglecting SSA's standard inspection practices, even though both approaches are necessary. SSA has also undertaken new initiatives to shift the burden of processing noncitizen SSN applications and verifying documents from its field offices. In 2002, SSA started implementation of a process called "Enumeration at Entry" (EAE), which relies on State Department and DHS expertise to authenticate information provided by SSN applicants. SSA is in the early stages of planning to evaluate EAE with the State Department and DHS. Also, SSA recently piloted a specialized center in Brooklyn, New York, which focuses on enumeration and uses the expertise of DHS staff and SSA's Office of the Inspector General investigators. Some Areas Affecting Issuance of SSNs Not Yet Addressed: While SSA has embarked on these new initiatives, it has not tightened controls in two key areas of its enumeration process that could be exploited by individuals--citizens and noncitizens alike--seeking fraudulent SSNs: the assignment of SSNs to children under age 1 and replacement Social Security cards. SSA changed its policy to require independent verification of birth records for U.S.-born children age 1 and over but still only relies on visual inspection of birth documents of children under age 1. This lack of independent verification remains an area vulnerable to fraud. In fact, by posing as parents of newborns, GAO investigators obtained two SSNs using counterfeit documents. SSA's policy for replacing Social Security cards, which allows individuals to obtain up to 52 replacement cards per year, and its documentation requirements for U.S. citizens to obtain such cards also increase the potential for misuse of SSNs. Of the 18 million cards issued by SSA in 2002, 12.4 million, or 69 percent, were replacements. While SSA requires noncitizens applying for replacement cards to provide the same identity and immigration information as if they were applying for a new SSN, its evidence requirements for citizens are much less stringent. The ability to obtain many replacement cards with relatively weak documentation may allow individuals to impersonate others by using counterfeit documents to obtain SSNs for a range of illicit uses, including selling them to noncitizens.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director:
Team:
Phone:
GAO-04-12, Social Security Administration: Actions Taken to Strengthen Procedures for Issuing Social Security Numbers to Noncitizens, but Some Weaknesses Remain
This is the accessible text file for GAO report number GAO-04-12
entitled 'Social Security Administration: Actions Taken to Strengthen
Procedures for Issuing Social Security Numbers to Noncitizens, but Some
Weaknesses Remain' which was released on October 15, 2003.
This text file was formatted by the U.S. General Accounting Office
(GAO) to be accessible to users with visual impairments, as part of a
longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to the Chairman, Subcommittee on Social Security, Committee on
Ways and Means, House of Representatives:
United States General Accounting Office:
GAO:
October 2003:
SOCIAL SECURITY ADMINISTRATION:
Actions Taken to Strengthen Procedures for Issuing Social Security
Numbers to Noncitizens, but Some Weaknesses Remain:
GAO-04-12:
GAO Highlights:
Highlights of GAO-04-12, a report to the Chairman, Subcommittee on
Social Security, Committee on Ways and Means, House of Representatives
Why GAO Did This Study:
In 2002, the Social Security Administration (SSA) issued nearly 6
million new Social Security numbers (SSNs), of which 1.3 million were
issued to noncitizens. Despite its narrowly intended purpose, the SSN
has in practice become the national identifier. SSNs are key pieces of
information in creating false identities, underscoring the importance
of issuing SSNs only to those eligible for them and of protecting
those already assigned to individuals. The flow of noncitizens into
the United States and the accompanying number of SSNs issued to them
over the last several years add to the importance of having sound
practices to avoid issuing SSNs to those who do not qualify for them.
The Subcommittee Chairman asked GAO to describe and assess SSA‘s key
initiatives to ensure the appropriate issuance of SSNs to noncitizens
and identify vulnerabilities to error or fraud SSA has not yet
addressed.
What GAO Found:
SSA Has Increased Noncitizen Verifications and Begun New Initiatives:
SSA has taken steps to prevent the inappropriate assignment of SSNs to
noncitizens. SSA now requires field staff to verify noncitizens'
identity documents with the Department of Homeland Security (DHS), in
addition to continuing to require visual inspection of these
documents, prior to issuing an SSN. However, many field staff GAO
interviewed are relying heavily on DHS's verification while neglecting
SSA's standard inspection practices, even though both approaches are
necessary. SSA has also undertaken new initiatives to shift the burden
of processing noncitizen SSN applications and verifying documents from
its field offices. In 2002, SSA started implementation of a process
called ’Enumeration at Entry“ (EAE), which relies on State Department
and DHS expertise to authenticate information provided by SSN
applicants. SSA is in the early stages of planning to evaluate EAE
with the State Department and DHS. Also, SSA recently piloted a
specialized center in Brooklyn, New York, which focuses on enumeration
and uses the expertise of DHS staff and SSA‘s Office of the Inspector
General investigators.
Some Areas Affecting Issuance of SSNs Not Yet Addressed:
While SSA has embarked on these new initiatives, it has not tightened
controls in two key areas of its enumeration process that could be
exploited by individuals”citizens and noncitizens alike”seeking
fraudulent SSNs: the assignment of SSNs to children under age 1 and
replacement Social Security cards. SSA changed its policy to require
independent verification of birth records for U.S.-born children age 1
and over but still only relies on visual inspection of birth documents
of children under age 1. This lack of independent verification remains
an area vulnerable to fraud. In fact, by posing as parents of
newborns, GAO investigators obtained two SSNs using counterfeit
documents. SSA‘s policy for replacing Social Security cards, which
allows individuals to obtain up to 52 replacement cards per year, and
its documentation requirements for U.S. citizens to obtain such cards
also increase the potential for misuse of SSNs. Of the 18 million
cards issued by SSA in 2002, 12.4 million, or 69 percent, were
replacements. While SSA requires noncitizens applying for replacement
cards to provide the same identity and immigration information as if
they were applying for a new SSN, its evidence requirements for
citizens are much less stringent. The ability to obtain many
replacement cards with relatively weak documentation may allow
individuals to impersonate others by using counterfeit documents to
obtain SSNs for a range of illicit uses, including selling them to
noncitizens.
What GAO Recommends:
GAO recommends that SSA strengthen the integrity of its enumeration
policies and procedures by taking actions such as reviewing field
compliance with verification requirements for enumerating noncitizens.
In its response to GAO‘s draft report, SSA agreed with GAO‘s
recommendations and provided information on planned and current
actions to address them.
www.gao.gov/cgi-bin/getrpt?GAO-04-12.
To view the full product, including the scope and methodology, click
on the link above. For more information, contact Barbara Bovbjerg at
(202) 512-7215 or bovbjergb@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
SSA Has Increased Verifications and Launched Other Key Initiatives, but
Additional Actions Are Needed:
SSA's Actions to Tighten Controls Leave Some Key Areas Unaddressed:
Conclusions:
Recommendations:
Agency Comments:
Appendix I: Scope and Methodology:
Appendix II: Comments from the Social Security Administration:
Appendix III: GAO Contacts and Staff Acknowledgments:
GAO Contacts:
Staff Acknowledgments:
Tables:
Table 1: Original SSNs and Replacement Social Security Cards SSA Issued
in Fiscal Year 2002:
Table 2: Composition of BSSCC's Staff:
Table 3: Comparison of Identity, Age, and Citizenship Requirements for
U.S. Citizens Applying for Original SSNs and Replacement Cards.
Figures:
Figure 1. Required SSA Field Office Procedures for Noncitizen SSN
Applications:
Figure 2: SSA's EAE Process for Assigning SSNs to Immigrants Age 18 and
Over:
Abbreviations:
ACM: Administrative Confidential Memorandum:
BSSCC: Brooklyn Social Security Card Center:
DHS: Department of Homeland Security:
EAB: Enumeration at Birth:
EAE: Enumeration at Entry:
OIG: Office of the Inspector General:
MES: Modernized Enumeration System:
MOU: Memorandum of Understanding:
POMS: Program Operations Manual System:
SAVE: Systematic Alien Verification for Entitlements:
SEVIS: Student and Exchange Visitor Information System:
SSA: Social Security Administration:
SSN: Social Security number:
United States General Accounting Office:
Washington, DC 20548:
October 15, 2003:
The Honorable E. Clay Shaw, Jr.
Chairman
Subcommittee on Social Security
Committee on Ways and Means
House of Representatives:
Dear Mr. Chairman:
In fiscal year 2002, the Social Security Administration (SSA) issued
nearly 6 million new Social Security numbers (SSNs), of which 1.3
million, or 22 percent, were issued to noncitizens, a proportion that
has increased in recent years. Despite its narrowly intended purpose,
the SSN has in practice become the national identifier and is central
to a range of transactions and services associated with American life,
including obtaining a driver license, opening a bank account, and
receiving health care. For this reason, SSNs are key pieces of
information in creating false identities. The events of September 11th
underscore the importance both of issuing SSNs only to those eligible
for them and protecting those already assigned to individuals. The flow
of noncitizens into the United States and the accompanying number of
SSNs issued to this group over the last several years add to the
importance of having sound practices to avoid issuing SSNs to those who
do not qualify for them and to ensure the identity of those who receive
them. Because of your interest in this issue, you asked us to (1)
describe and assess SSA's key initiatives to ensure the appropriate
issuance of SSNs to noncitizens and (2) identify any vulnerabilities to
error or fraud that SSA has not yet addressed in its procedures for
issuing SSNs.
To answer your questions, we examined SSA's policies and procedures for
issuing SSNs, a process known as enumeration, and we obtained
information on key initiatives planned and undertaken to strengthen and
ensure its integrity. We collected and analyzed information on SSA's
enumeration initiatives, the results of prior internal reviews, and
studies performed by SSA's Office of the Inspector General (OIG) and
Office of Quality Assurance. In addition, we reviewed studies and data
provided by the Department of Homeland Security[Footnote 1] (DHS) and
the Department of State on their specific agency processes that support
SSA's noncitizen enumeration initiatives. We also analyzed audits
performed by the inspectors general at the Departments of State and
Justice. We conducted our review at SSA headquarters in Baltimore,
Maryland, and in 4 of its 10 regional offices--Atlanta, Georgia;
Chicago, Illinois; New York, New York; and San Francisco, California--
and at 16 field offices in those regions. We selected the regional and
field offices based on the following criteria: (1) enumeration
workload--the locations represented about 70 percent of noncitizen
enumerations in fiscal year 2001; (2) geographic distribution--the
various regions across the nation representing border and inland
locations; and (3) best practices--locations trying innovative
approaches to enumeration, such as the Brooklyn, New York, Social
Security Card Center (BSSCC). We also collected and analyzed data and
documents on SSA's enumeration initiatives and workloads. From our in-
depth interviews with more than 100 management and line staff, we
documented officials' perspectives on SSA's enumeration initiatives and
identified areas where vulnerabilities and gaps exist in SSA's
implementation of these policies. Also, our investigators tested SSA's
enumeration practices by posing as parents of newborns and used
counterfeit documents to obtain SSNs from an SSA field office and
through the mail. We performed our work from September 2002 through
July 2003 in accordance with generally accepted government auditing
standards.
Results in Brief:
SSA has increased document verifications and developed new initiatives
to prevent the inappropriate assignment of SSNs to noncitizens. Though
in their early stages, these increased verifications and initiatives
have the potential to strengthen the integrity of SSA's enumeration
process. SSA now requires field staff to verify noncitizens' identity
documents with the DHS, in addition to continuing to require visual
inspection of these documents, prior to issuing an SSN. However, many
field staff we interviewed are relying heavily on DHS's verification
while neglecting SSA's standard inspection practices, even though both
approaches are necessary. We also found that SSA's automated system for
assigning SSNs is not designed to prevent the issuance of an SSN if
field staff bypass required verification steps. SSA has also undertaken
new initiatives to shift the burden of processing noncitizen SSN
applications and verifying documents away from its field offices. In
late 2002, SSA began a phased implementation of a long-term process of
redesigning how it issues SSNs to noncitizens, called "Enumeration at
Entry" (EAE). EAE relies on State Department and DHS expertise to
authenticate information provided by applicants before they enter the
country; this information is transmitted to SSA, which then issues the
SSN. Currently, EAE is limited to immigrants age 18 and older who have
the option of applying for an SSN at 1 of the 127 State Department
posts worldwide that issue immigrant visas. SSA is in the early stages
of planning an evaluation of the first phase of EAE in conjunction with
the State Department and DHS. Also, SSA plans to continue expanding the
program over time to include other noncitizen groups, such as students
and exchange visitors. In addition, SSA recently piloted a specialized
center in Brooklyn, New York, which focuses exclusively on enumeration
and utilizes the expertise of DHS immigration status verifiers and
SSA's OIG investigators.
While SSA has embarked on these new initiatives, it has not tightened
controls in two key areas of its enumeration process that could be
exploited by individuals--citizens and noncitizens alike--seeking
fraudulent SSNs: the assignment of SSNs to children under age 1 and the
replacement of Social Security cards. SSA changed its policy in 2002 to
require that field staff obtain independent, third-party verification
of the birth records for U.S.-born children age 1 and over, but it left
in place its prior policy for children under age 1, which calls only
for a visual inspection of birth documents. In our field work, we found
that this lack of independent verification remains an area vulnerable
to fraud. Working in an undercover capacity by posing as parents of
newborns, our investigators were able to obtain two SSNs using
counterfeit documents. SSA's policy for replacing Social Security cards
also increases the potential for misuse of SSNs. The policy allows
individuals to obtain up to 52 replacement cards per year. Of the 18
million cards issued by SSA in fiscal year 2002, 12.4 million, or 69
percent, were replacement cards, and 1 million of these cards were
issued to noncitizens. While SSA requires noncitizens applying for a
replacement card to provide the same identity and immigration
information as if they were applying for an original SSN, SSA's
evidence requirements for citizens are much less stringent. The ability
to obtain numerous replacement SSN cards with relatively weak
documentation may allow individuals to impersonate others using
counterfeit documents to obtain SSNs for a wide range of illicit uses,
including selling them to noncitizens.
The operational and policy issues that we identified in SSA's
enumeration functions could weaken the integrity of its enumeration
system. Accordingly, we are making several recommendations intended to
strengthen SSA's policies and procedures for issuing SSNs to
noncitizens and citizens and to enhance SSA's coordination and
deployment of new initiatives in this area. In its response to our
draft report, SSA agreed with our recommendations and provided
information on planned and current actions that they believe address
them. (SSA's comments are reproduced in appendix II.) In particular,
SSA discussed its efforts to assess field office staff compliance with
its verification requirements as part of its ongoing enumeration
quality reviews, to assess the accuracy of the EAE process, and to
develop options to improve the integrity of its policies for issuing
replacement Social Security cards.
Background:
The Social Security Act of 1935 authorized the SSA to establish a
record-keeping system to help manage the Social Security program and
resulted in the creation of the SSN. SSA uses the SSN as a means to
track workers' earnings and eligibility for Social Security benefits.
Through a process known as "enumeration," each person receives a unique
number, which is used for the work and retirement benefit record for
the Social Security program. Today, SSNs are issued to most U.S.
citizens, and they are also available to noncitizens[Footnote 2]
lawfully admitted to the United States with permission to work.
Lawfully admitted noncitizens may also qualify for an SSN for nonwork
purposes when a federal, state, or local law requires that they have an
SSN to obtain a particular welfare benefit or service. SSA must obtain
documentary evidence from such applicants regarding their age,
identity, U.S. citizenship, immigration status, and if they were
previously assigned an SSN. SSA's 1,333 field offices' primary
enumeration responsibilities include interviewing such applicants for
both original and replacement Social Security cards, reviewing identity
and immigration documents, verifying immigration and work status with
the DHS and State, and keying information into the agency's automated
enumeration system.
In fiscal year 2002, SSA issued approximately 5.6 million original SSNs
and 12.4 million replacement cards. As shown in table 1, most of the
agency's enumeration workload involves U.S. citizens who generally
receive SSNs at birth via states' and certain jurisdictions' birth
registration process facilitated by hospitals.[Footnote 3] However, the
bulk of original SSNs issued by SSA's field offices are for
noncitizens. These offices also process requests for replacement cards-
-for both citizens and noncitizens.
Table 1: Original SSNs and Replacement Social Security Cards SSA Issued
in Fiscal Year 2002:
Numbers in millions.
Original SSNs issued; U.S. citizens: 4.23[A]; Noncitizens: 1.34; Total:
5.57.
Replacement Social Security cards issued; U.S. citizens: 11.45;
Noncitizens: 1.00; Total: 12.45.
Total; U.S. citizens: 15.68; Noncitizens: 2.34; Total: 18.02.
Source: SSA.
[A] Of the 4.23 million SSNs issued to U.S. citizens in fiscal year
2002, 3.8 million (about 89 percent) were issued under SSA's
Enumeration at Birth (EAB) process, which is not part of the field
office workload.
[End of table]
Following the events of September 11, 2001, SSA began taking steps to
place a greater emphasis on improving the integrity of the enumeration
process. For example, to launch these efforts, the Commissioner
established an in-house response team to identify ways to prevent fraud
and formed a task force with the State Department and DHS to formalize
and expedite collaboration on various initiatives designed to improve
the verification of information furnished by noncitizen SSN applicants.
SSA Has Increased Verifications and Launched Other Key Initiatives, but
Additional Actions Are Needed:
SSA has increased document verifications and begun other new
initiatives to prevent the inappropriate assignment of SSNs to
noncitizens, but additional actions are needed to strengthen the
integrity of the process. SSA now requires third-party verification of
all noncitizen documents with DHS and State prior to issuing an SSN.
This verification is required in addition to existing requirements to
inspect documents in-house. However, many field staff we interviewed
are relying heavily on the third-party verification, while neglecting
SSA's in-house practices for verifying identity documents. SSA has also
undertaken new initiatives to shift the burden of processing noncitizen
applications away from its field offices. In October 2002, SSA began
implementing the first phase of a long-term process to redesign how it
issues SSNs to noncitizens, called "Enumeration at Entry" (EAE). Under
this initiative, State and DHS experts screen SSN applicants before
they enter the United States. SSA is in the early stages of developing
a timetable to evaluate the effectiveness of EAE as well as to assess
the potential for future expansion to other noncitizen groups. SSA also
recently piloted a specialized center in Brooklyn, New York, to focus
exclusively on enumeration and to bring on board expertise from DHS as
well as to utilize SSA's own Inspector General.
SSA Has Stepped Up Document Verification, but Some Weaknesses Exist:
SSA has increased document verifications by requiring independent
third-party verification of documents for all noncitizens with the
issuing agency--namely DHS and State--prior to issuing an SSN. This
process--called "collateral verification"[Footnote 4]--involves field
office staff performing an on-line query to DHS's Systematic Alien
Verification for Entitlements (SAVE)[Footnote 5] database to verify the
immigration and work status of noncitizens. If the information is not
available in SAVE, field staff must mail a request to DHS seeking
verification. In conjunction with this verification, SSA field staff
are required to visually inspect the immigration and identity documents
presented by applicants. SSA has issued several directives and produced
a training video for field offices to reinforce the policy of making
visual inspections of applicant documents with a variety of forensic
tools. These include using an ultraviolet light, called a "black
light," to verify the presence of embedded security features and
comparing documents against sample DHS documents and security
guidelines contained in a binder maintained in each field office.
SSA has also stepped up its verification of documents for foreign
students seeking SSNs, by requiring them to show proof of their full-
time enrollment. However, SSA still does not require its field staff to
verify this information or letters from the school stating that the
student is authorized to work--with the school.[Footnote 6] SSA also
does not require that students actually have a job to qualify for an
SSN, only that they have been authorized by their school to work on
campus.[Footnote 7]
Figure 1: Required SSA Field Office Procedures for Noncitizen
SSN Applications:
[See PDF for image]
[A] SSA's procedures call for its staff to refer these cases to SSA's
Office of Inspector General for further review.
[End of figure]
Despite SSA's actions to strengthen its processes for issuing SSNs to
noncitizens, some weaknesses exist.
* Field staff rely heavily on SAVE verifications, with the result that
many neglect to perform required in-house, visual inspection of
documents in conjunction with the SAVE verification. Although field
office staff can check the immigration and identity status of an
individual through SAVE, that does not ensure that the documents
presented by the applicant are valid. The agency's only way of
detecting whether documents by themselves are counterfeit is through
visual inspections. However, our interviews with front-line field staff
who perform enumeration work in four SSA regions indicated a potential
erosion in the traditional practice of visually inspecting documents
due to an increasing reliance on the SAVE database. Over a third said
they do not routinely use the black light to verify the authenticity of
applicants' immigration documents, and only one in five staffers we
interviewed said they regularly used SSA's confidential manual of
security guidelines and sample documents (known as the Administrative
Confidential Memorandum (ACM)) to check documents submitted by
applicants. Many field staff we interviewed said that the ACM was not
readily accessible; several said they did not know where it was located
in their office. In addition, staff in several offices told us that
their black light did not always work. Since SSA field office staff are
the only persons who actually see the noncitizen's documents, it is
critical that they make use of all available tools to ensure the
authenticity of those documents.[Footnote 8] Nevertheless, more than a
fourth of the field staff we interviewed told us that using the SAVE
database to verify immigration status made visual inspections of
documents unnecessary.
* SSA's automated enumeration system allows field staff to bypass key
verification steps and still issue an SSN. Recent improvements to SSA's
automated computer system for assigning SSNs, known as the Modernized
Enumeration System (MES), have not eliminated several weaknesses that
would allow for a breach of security. MES does not contain separate and
distinct fields for field staff to record their use of each of the
required verification procedures. Furthermore, it is possible for staff
to process an SSN application without keying information into MES on
the evidence they have reviewed and accepted. Under this situation,
there is no consistent means for SSA to verify and review what
verifications field staff actually did perform when they processed an
SSN application. SSA officials told us that they are aware of this
problem, but due to budget reasons, they have yet to develop a formal
plan to address it.
* Another automation-related weakness concerns SSA field staff use of
DHS's SAVE system. When field staff perform a SAVE verification, the
SAVE system generates a unique reference number. However, it is
possible to enter a made-up SAVE reference number without having
actually verified an individual's status. This ability to bypass the
SAVE system represents an internal control weakness in SSA's noncitizen
enumeration process. SSA officials told us that it may be possible to
modify SAVE so that after SSA staff successfully verify an individual's
immigration status, proof of that verification would be automatically
entered into the MES application, creating an audit trail. However, SSA
officials noted that such a modification would require creating an
interface between DHS's SAVE system and SSA's MES, and they have not
yet fully explored this possibility.
* Verification for foreign students attending U.S. schools also remains
problematic. SSA recently revised its rules to require that students
provide evidence of full-time enrollment at an accredited educational
institution. However, field office staff are not required to verify
either the full-time enrollment or the work authorization letters with
the educational institution. Most field staff we interviewed told us
they do not verify work authorization letters unless they appear
questionable. One staffer told us she assumes a letter is authentic if
it is "on high-quality paper." In addition, managers in two SSA field
offices told us they were unclear about SSA's requirements for
enumerating noncitizen students. A recent investigation by SSA's OIG
uncovered a ring of 32 foreign students in four states who used forged
work authorization letters to obtain SSNs. Those students were either
indicted for criminal offenses or taken into DHS custody. However, an
unknown number of other students associated with this ring had already
obtained illegal SSNs with forged work authorization letters. A foreign
student Web site that we found highlights the inconsistencies in SSA's
enumeration practices and advocates that students seeking SSNs "shop
around" for offices that are more likely to grant an application.
"If you are not authorized to work, ask your Foreign Student Advisor
for help. Sometimes they can give you a letter to the SSA stating that
you need a SSN for on-campus employment. Here's a sample letter. If you
can't get this letter at least get a certificate of attendance,
preferably addressed to the Social Security Administration. Sometimes
SSA clerks don't really read these letters, they just look at them.
[Emphasis added]
Go to your local SSA office and ask them if you can get a SSN.
Regulations in different offices are different, so try going to several
different SSA offices (this approach works with many large
bureaucracies, like banks and phone companies). [Emphasis added]
Sometimes it even depends on a clerk you talk to. If they accept your
application it means you'll get the number. If they don't accept it, it
isn't recorded anywhere and you can try as many times as you like."
[Emphasis added]
Source: Withheld.
Forged work authorization letters are not the only avenues for fraud in
the enumeration of noncitizen students. Both managers and field office
staff told us that SSA's policy on enumerating students was open to
fraud because it requires only that the student be "authorized to work
on campus," and not that the student actually be working, or even have
a job offer. One district manager, saying that enumerating noncitizen
students for on-campus jobs is "fraught with the potential for fraud,"
cited schools operating out of storefronts that nevertheless issued
work authorization letters for students, claiming the students were
working "on campus." According to SSA policy, these students are
entitled to receive SSNs. In addition, one regional official even
described schools selling work authorization letters to students who
wished to get SSNs.
SSA headquarters officials said that they were aware of weaknesses
associated with enumerating foreign students and were working on
improving the integrity of these processes. For example, SSA is
exploring gaining access to DHS's foreign student tracking database,
the Student and Exchange Visitor Information System (SEVIS), which
would permit the agency to check if a noncitizen student is enrolled
full-time in an accredited school.[Footnote 9] In addition, SSA
officials told us that the agency is in the process of exploring
options to address these weaknesses, such as requiring foreign students
to prove that they actually have an on-campus job.
SSA Has Begun a Long-Term Initiative to Enumerate Noncitizens before
They Enter the Country:
SSA is in the early stages of a long-term process of redesigning how it
issues SSNs to noncitizens, which it calls the "Enumeration at Entry"
(EAE) project. SSA considers EAE to be an essential component of its
fraud prevention efforts that will curtail its current dependence on
visually inspecting and verifying documents that are easily forged or
misused. Under EAE, SSA entered into Memoranda of Understanding (MOU)
with State and DHS for those agencies to assist SSA by obtaining and
examining, as part of immigration processing, all of the information
SSA needs to assign SSNs to immigrants after they enter the United
States.[Footnote 10] Since its start in 2002, EAE has grown from 3
sites in 3 countries to all 127 State posts worldwide that issue
immigrant visas. Currently, EAE is available only to immigrants age 18
or older who are seeking permanent residence in the United States, and
it is not used for temporary visitors such as students and exchange
visitors. According to SSA, the current phase of EAE will:
* improve integrity of the enumeration process by ending field staff
dependence on immigration documents that can be forged or misused by
noncitizens attempting to fraudulently acquire SSNs;
* improve overall government efficiency by eliminating duplication of
data collection by SSA, State, and DHS;
* create financial savings of approximately $5.13 million
annually;[Footnote 11] and:
* provide a one-stop service for noncitizen SSN applicants, whereby
noncitizens can apply for an immigrant visa and an SSN on the same
application prior to entering the United States.
The EAE process is depicted in figure 2 and begins when an immigrant
applies for a visa at one of State's visa-issuing posts around the
world and continues when the immigrant later arrives at a U.S. port of
entry where DHS performs various immigration and security checks. The
process ends when SSA electronically screens the information provided
by DHS for errors and assigns the individual an SSN.
During the first 7 months that SSA began receiving records under EAE--
November 2002 through May 2003--SSA reported assigning 9,627 original
SSNs and 5,501 replacement cards[Footnote 12] to immigrants who applied
at one of the State Department's worldwide visa-issuing posts. To date,
SSA is having problems with the accuracy and completeness of the
automated EAE records received, resulting in the agency's need to
correct the errors, including contacting the applicant after he or she
enters the country. Problems include the use of abbreviated data (e.g.,
using Ma for Maria); the incorrect use of country codes (e.g., PHI
instead of PHL for the Philippines); and, in some instances, missing
data fields (e.g., the city, state, and zip code of the applicant's
place of birth). SSA officials said that the three agencies have begun
working to correct these problems and anticipate having them resolved
in the near future.
Figure 2: SSA's EAE Process for Assigning SSNs to Immigrants Age 18 and
Over:
[See PDF for image]
[End of figure]
According to SSA officials, the agency intends to evaluate the initial
phase of EAE in conjunction with the State Department and DHS after it
has been in full operation for at least a year or at a mutually agreed
upon time. SSA is also planning to begin discussions with DHS and State
on expanding the process to other noncitizen groups, such as students
and exchange visitors. SSA officials told us that, as additional groups
of noncitizens are phased in, it expects to further reduce its field
office enumeration workload. Currently, SSA officials said that they
are only in the early stages of developing a timetable to estimate
either when the agencies would start to evaluate the first phase of EAE
or when it would begin discussions on EAE expansion. SSA officials
noted that the expansion of EAE to nonimmigrant groups, such as
students or exchange visitors, would probably take longer and be more
challenging because of the diversity of the populations and differences
in State, DHS, and SSA information systems and business processes. For
example, according to SSA and DHS officials, the process for
transmitting information on groups other than legal permanent
residents[Footnote 13] is not fully automated.
SSA Is Piloting a Specialized Enumeration Center:
In November 2002, SSA established a pilot center in Brooklyn, New York,
to specialize in enumeration (now known as the Brooklyn Social Security
Card Center, or BSSCC) wherein its staff is assisted by in-house DHS
staff and focuses full time on enumeration and verification. In
addition, SSA-OIG employees are on call to assist the BSSCC's staff.
The center provides citizens and noncitizens residing in Brooklyn a
one-stop location for applying for SSNs and replacement Social Security
cards and is the only location where residents of Brooklyn can receive
such services. If a Brooklyn resident visits one of SSA's 12 Brooklyn
offices other than the BSSCC to apply for a SSN or a replacement card,
they are referred to the center for assistance. As of April 2003, the
BSSCC had processed a total of 44,000 Social Security cards, with
18,000 of those for noncitizens. SSA officials plan to use this
centralized and specialized location to prevent the inappropriate
issuance of SSNs and to expand the concept to other locations.
According to SSA and DHS officials, a major benefit of the BSSCC is its
specialized personnel and the immediate, on-site verification of
documents submitted by applicants for SSNs and replacement cards. SSA
officials told us that the enumeration center staff would become more
specialized and skilled at identifying fraudulent documents as they
perform only enumeration duties. In addition, on-site DHS staff who
verify documents (called status verifiers) have access to DHS databases
not available to SSA staff, and their presence is expected to improve
DHS response time and accelerate the verification of applicant
documents. (See table 2 for the composition of BSSCC's staff.) Also,
SSA's New York regional officials told us that they have experienced a
reduced enumeration workload for the 12 neighboring SSA field offices.
These officials also told us that the use of one location for
enumeration would increase SSA's control over SSNs and reduce the
issuance of duplicate cards. For example, having only one center where
citizens and noncitizens residing in the service area were required to
apply for SSNs and replacement cards might eliminate the opportunity
for individuals to "shop around" various SSA field offices in the
region, using fraudulent documents in order to obtain an SSN.
Table 2: Composition of BSSCC's Staff:
Providing agency: SSA; Type of staff: Manager; Number of staff: 1.
Type of staff: Providing agency: Operations supervisor; Number of
staff: Providing agency: 1.
Type of staff: Providing agency: Management support specialist; Number
of staff: Providing agency: 1.
Type of staff: Providing agency: Service representative; Number of
staff: Providing agency: 6.
Type of staff: Providing agency: Teleservice representative; Number of
staff: Providing agency: 9.
Type of staff: Providing agencyDHS: Claims representative; Number of
staff: Providing agencyDHS: 15.
Providing agency: DHS; Type of staff: Status verifier[A]; Number of
staff: 1.
Providing agency: Total; Type of staff: [Empty]; Number of staff: 34.
Source: SSA.
Note: SSA-OIG's New York Office agents are on call to support the BSSCC
at the request of BSSCC's manager.
[A] DHS initially provided two status verifiers for the BSSCC; as of
June 2003, DHS reconsidered the need for these staff and had removed
one of them.
[End of table]
SSA and DHS officials have made some revisions to the BSSCC's staffing
plan. SSA's draft design plan for the center included on-site DHS
investigators, who are experts in identifying fraudulent documents, as
well as SSA-OIG investigators. However, after discussions with SSA, DHS
agreed to provide status verifier staff in the BSSCC, who have access
to DHS databases not available to SSA staff but do not have the
technical expertise to authenticate and identify fraudulent documents.
DHS's decision to place status verifiers in the BSSCC, rather than more
specialized investigators, who are skilled at authenticating and
identifying fraudulent documents, may diminish SSA's ability to detect
fraudulent documents. Presently the main function of the one status
verifier co-located with SSA staff, is to check DHS databases that are
unavailable to SSA staff, rather than to authenticate documents.
Furthermore, SSA's OIG employees, at one time physically based at the
center, are now available only on an on call basis to assist the BSSCC
staff.
Thus far, SSA has encountered workload issues involving returned mail
processed through the BSSCC. According to SSA officials, the postal
service returns mailed Social Security cards processed through the
center as undeliverable at a higher than usual rate for other field
offices. SSA officials told us the mailing errors might be occurring
due to problems associated with a high frequency of similar names for
noncitizens who use the center. However, they have not yet evaluated
the returned mail issue and other performance issues associated with
the enumeration center.
According to SSA officials, the BSSCC is operating on a trial basis for
a period of 1 year during which SSA plans to evaluate its
effectiveness. SSA officials told us that they will conduct two studies
to evaluate the center: (1) SSA and DHS are to study if the center is
serving the needs of SSA and if it is cost-effective for DHS to provide
on-site status verifiers and (2) SSA will perform a separate assessment
of the center, which may address issues such as trends in applicants'
submission of fraudulent documents to obtain SSNs.[Footnote 14]
However, SSA officials told us that a consideration of the long-term
feasibility of the enumeration center in relation to SSA's other
initiatives to improve the integrity of issuing SSNs to noncitizens--
for example, EAE, is not part of their analysis. This is a key issue
considering that SSA's progress in implementing and expanding the EAE
initiative, whereby noncitizens apply for SSNs prior to entering the
United States, could influence the number of additional card centers
needed, or mitigate the need for such centers altogether in the long
term.
SSA's Actions to Tighten Controls Leave Some Key Areas Unaddressed:
Although SSA is undertaking a number of initiatives specifically
addressing the enumeration of noncitizens, it has not addressed two
areas that are especially vulnerable to fraud by citizens and
noncitizens alike: the assignment of Social Security numbers to
children under age 1 and the replacement of Social Security cards.
Although SSA changed its policy in 2002 to require third-party
verification of the birth records of U.S.-born citizens over age 1, it
left in place its prior policy for children under age 1 that calls only
for a visual inspection of birth records. SSA's policy for replacing
Social Security cards allows individuals to obtain up to 52
replacements a year with no lifetime limit and allows U.S. citizens to
obtain replacement cards with less documentation than an original SSN.
Of the 18 million cards issued by SSA in fiscal year 2002, 12.4
million, or 69 percent, were replacement cards. Some field staff we
interviewed told us that despite their reservations about individuals
who have sought replacement cards in "excessive" numbers, SSA policy
required them to issue the cards.
Process for Assigning Social Security Numbers to Children under Age 1
Creates Fraud Opportunities:
The implementation of SSA's policy of assigning SSNs to children under
age 1 may create opportunities for individuals with criminal intent to
use false or stolen birth records to obtain an SSN. While the majority
of newborns in fiscal year 2002 received SSNs at birth through a
hospital registration processes that SSA calls Enumeration-at-Birth
(EAB),[Footnote 15] the parents of about 368,000 U.S.-born children
under age 18 applied for an SSN for their children at field offices
using their own birth evidence documents.[Footnote 16] In 2002, SSA
began requiring field offices to verify these birth records for U.S.
citizens age 1 or older with a state or local bureau of vital
statistics. However, SSA exempted records for children under age 1 from
this policy. According to SSA, it excluded children under age 1 from
its third-party verification requirements to limit potential service
disruptions to these applicants due to possible delays in entry of
birth information by some state or local bureaus of vital statistics.
Parents or guardians often need an SSN for their child soon after birth
so they can claim the child as a dependent for tax purposes or because
an SSN is required for such purposes as opening a bank account or
applying for government services.
SSA's decision to verify most birth certificates had been prompted by
an SSA OIG finding that, despite training and guidance, field staff
were unable, by themselves, to detect counterfeit birth
certificates.[Footnote 17] In one case, individuals posing as parents
of infants were able to obtain over 1,000 new SSNs based on fraudulent
birth certificates.[Footnote 18] Also, the OIG reported that, without
means to independently verify the authenticity of out-of-state birth
certificates, field office staff were less likely to question this
documentation.
We found that SSA's policy to exempt birth records for children under
age 1 from third-party verification has left the enumeration process
open to fraud. During our fieldwork, we found an example of a
noncitizen who submitted a counterfeit birth certificate in support of
an SSN application for a fictitious U.S.-born child under age 1. In
this case, the SSA field office employee identified the counterfeit
state birth certificate by comparing it with an authentic one. However,
SSA staff acknowledged that if a counterfeit out-of-state birth
certificate had been used, SSA would likely have issued the SSN because
of staff unfamiliarity with the specific features of the numerous state
birth certificates.
Indeed, we were able to prove the ease with which individuals can
obtain SSNs by exploiting SSA's current processes. Working in an
undercover capacity, our investigators were able to obtain two SSNs for
children under age 1 by using counterfeit documents. By posing as
parents of newborns, they obtained the first SSN by applying in person
at a SSA field office using a counterfeit birth certificate; they
obtained the second SSN by submitting the counterfeit birth record via
the mail. In both cases, SSA staff verified our counterfeit documents
as being valid. SSA officials told us that the agency plans to re-
evaluate its policy for enumerating children under age 1 but has no
specific time frame for doing so. The officials also acknowledged that
a challenge facing the agency is to strike a better balance between
serving the needs of the public and ensuring SSN integrity.
SSA Policy on Replacing Social Security Cards Invites Abuse:
SSA's policy for replacing Social Security cards, which allows
individuals to obtain up to 52 replacement cards per year; as well as
its documentation requirements for U.S. citizens to obtain replacement
cards, whereby U.S. citizens can obtain replacement cards with less
documentation than an original SSN, also increases the potential for
misuse of SSNs. Of the 18 million cards issued by SSA in fiscal year
2002, 12.4 million, or 69 percent, were replacement cards, and 1
million of these cards were issued to noncitizens.
SSA field staff we interviewed told us that despite their reservations
regarding individuals seeking high numbers of replacement cards, they
are required under SSA policy to issue the cards. For example, one
field staffer spoke of replacement card applicants who already have
made numerous requests and continue to make new requests.[Footnote 19]
Furthermore, many of the field office staff and managers we spoke with
acknowledged that the current policy weakens the integrity of SSA's
enumeration process.
In September 2001, SSA's OIG reported numerous cases in which SSA had
issued replacement cards where potential misuse existed, such as
multiple individuals working under a single name and SSN. [Footnote 20]
For example, the OIG found that SSA issued 23 replacement cards to a
19-year-old male who had $113,000 in earnings from 24 employers in 19
states during 1999. In another case, SSA had issued 12 replacement
cards to a 25-year-old male with a suspect work history: $106,000 in
earnings from 12 employers in 8 states and over $10,000 in earnings
under his SSN but under a different name in 1999; $83,000 earnings from
10 employers in 1998; and $60,000 in earnings from 13 employers in
1997. The OIG concluded, "It is highly improbable that in 1 year an
individual could work for multiple employers in numerous states and
earn significant income from traditionally low paying jobs, such as
those in the agriculture and service industries.":
Beyond SSA's policy on providing 52 replacement cards per year, its
identity and document requirements for providing such cards to citizens
could further threaten SSN integrity. While SSA requires noncitizens
applying for a replacement card to provide the same identity and
immigration information as if they were applying for an original SSN,
SSA's evidence requirements for citizens are much less stringent. (See
table 3.) Citizens are not required to prove their U.S. citizenship and
can apply for a replacement card without photograph identification,
using documentation such as a school report card, church membership
record, or a life insurance policy. This represents a vulnerability in
the application process due to the ease with which identity documents,
especially those without photographs, can be forged. Thus, an
individual could easily impersonate a legitimate SSN cardholder to
obtain large numbers of replacement cards for a wide range of illicit
uses, including selling them to noncitizens.
Table 3: Comparison of Identity, Age, and Citizenship Requirements for
U.S. Citizens Applying for Original SSNs and Replacement Cards.
Original SSN requirements: Proof of identity; (Any one or a combination
of the following); * Driver's license; * U.S. passport; * School ID
card; * School record; * School report card; * Marriage or divorce
record; * Adoption record; * Health insurance card (except Medicare
card); * Life insurance policy; * Clinic, hospital, or doctor records;
* Church membership or confirmation record; Replacement card
requirements: Proof of identity; Same as for an original SSN..
Original SSN requirements: Proof of age; (Any one or a combination of
the following); * U.S. birth certificate; * Religious record
established before age 5 showing age; * Notification of birth
registration; Replacement card requirements: Proof of age; Only
required if there is a discrepancy between the date of birth on the
application and the evidence presented with the application..
Original SSN requirements: Proof of U.S. citizenship; (Any one of the
following); * U.S. passport; * U.S. birth certificate; * Religious
record recorded in the U.S. within 3 months after birth; * Certificate
of naturalization; * Certificate of citizenship; * Adoption
finalization papers; * Other document that establishes a U.S. place of
birth or U.S. citizenship; Replacement card requirements: Proof of U.S.
citizenship; Not necessary..
Source: GAO analysis of SSA's enumeration procedures.
Note: The above lists are not all-inclusive and differ for children
under age 1.
[End of table]
In our audit work, we identified Web sites and publications that give
"how-to" guidance and design samples to assist individuals in making
counterfeit documents that can be used in support of an application for
either a new SSN or a replacement card, such as school cards, baptismal
certificates, and hospital records. In addition, one guide offered tips
on getting SSNs through the mail using such counterfeit documents.
"Generally, there are two ways that one can receive a [— ] social
security number. Through the mail or in-person at the local social
security office. I would suggest that you try to do everything through
the mail—In my opinion,—you should never go to the SS office in person.
[Emphasis added] Obviously, if there is a problem with your documents
and you need to walk away from the process, with a mail drop, you
simply close it and walk away. There is no more connection to you, but
to be fair, I have never heard of a problem at the SSN office.":
Source: Withheld.
SSA officials told us the agency is considering limiting the number of
replacement cards to 2 per year and 10 cards over an individual's
lifetime, with certain exceptions for name changes, administrative
errors, and hardship. However, SSA officials cautioned that while
support exists for this change within the agency, some advocacy groups,
such as those representing the homeless and mentally ill, oppose such a
limit. At the completion of our audit work, it was unclear whether SSA
would address the weaknesses in its document requirements for providing
replacement cards to citizens. Until SSA changes its policy in this
area, there will be an increased chance that both citizens and
noncitizens seeking to fraudulently obtain SSNs may target this
vulnerable area.
Conclusions:
SSA has made substantial progress toward strengthening its processes
for issuing SSNs to noncitizens through initiatives that involve
improvements to old procedures as well as broad new approaches. Indeed,
the agency has taken a step it has never before attempted by requiring
that the immigration and work status of every noncitizen applicant be
verified through an independent third-party source before an SSN is
issued. However, without further systems improvements and staff
compliance with all prescribed verification procedures, this initiative
may not sufficiently prevent the issuance of SSNs to individuals
seeking to fraudulently obtain them.
Beyond changes to its verification procedures, SSA's ability to
corroborate the immigration status and identity information of
noncitizen applicants may be further enhanced by newly implemented
initiatives such as EAE and the BSSCC. SSA's collaboration with the
Departments of State and Homeland Security through the EAE initiative
brings additional resources to bear on noncitizen applications.
However, because this program represents a considerable change to the
enumeration process, it merits a thorough evaluation to overcome
operational problems and to identify changes that may be needed before
it is expanded to other noncitizen groups.
Similarly, specialized enumeration centers that combine the expertise
of SSA and DHS examiners have the potential to better deter SSN fraud
and identity theft, as well as improve the timeliness and accuracy of
the service SSA provides. Because EAE will not be fully realized for
many years, the enumeration center concept may also represent a viable
near-term strategy for concentrating expertise in key geographic
regions to process SSNs for applicants already in the country. However,
a comprehensive evaluation of the effectiveness of the BSSCC, as well
as an assessment of the long-term viability of additional centers in
the face of future EAE expansion are needed to help SSA think more
strategically about how it can be best positioned to ensure the
integrity of its enumeration process.
Finally, SSA's substantial efforts may be undercut by other
vulnerabilities that remain unaddressed. As SSA closes off many avenues
of unauthorized access to SSNs, perpetrators of fraud will likely shift
their strategies to less protected areas. In particular, SSA's policies
for enumerating children under age 1 and providing replacement cards
may well invite such activity, unless they, too, are modified.
Recommendations:
To strengthen the integrity of SSA's policies and procedures for
enumerating noncitizens, we recommend that the Commissioner of Social
Security take the following actions:
* Perform systematic reviews of field office compliance with
verification requirements for enumerating noncitizens and identify
corrective actions needed to ensure maximum effectiveness of this
process.
* Enhance the Modernized Enumeration System to prevent staff from
issuing SSNs without following required verification procedures.
* Develop and implement a structured evaluation plan to assess the
initial operation of the EAE initiative and identify SSA, State
Department, and DHS business process changes needed to expand EAE to
additional groups of noncitizens. For the initial phase of EAE, this
evaluation should determine the accuracy of SSN issuance decisions and
causes of operational weaknesses. To assist SSA in moving forward on
EAE expansion, the assessment should identify categories of noncitizens
to which EAE can and should be expanded as well as additional data
collection and changes to automated systems that will be needed by all
three participating agencies.
* Evaluate the BSSCC to assess the feasibility of expansion to other
locations and interaction with SSA's other initiatives to improve the
integrity of SSN issuance to noncitizens. This should include an
assessment of the (1) need and role of possible future centers in
relation to the agency's plans to expand EAE; (2) accuracy of SSN
issuance decisions, its value as a fraud detection and prevention tool,
and its impact on surrounding field office workloads; and (3) the costs
and benefits of how such centers would function without DHS staff on-
site.
* Revise its requirement for verification of the birth records of U.S.
citizens who apply for an SSN to require third-party verification of
the birth records of children under age 1.
* Reassess SSA's policies for issuing replacement Social Security cards
and develop options for deterring abuse in this area.
Agency Comments:
We obtained written comments on a draft of this report from the
Commissioner of SSA. SSA's comments are reproduced in appendix II. SSA
agreed with our recommendations to strengthen its policies and
procedures for issuing SSNs to noncitizens and citizens alike and to
enhance coordination and deployment of new initiatives in this area.
SSA also provided information on planned and current actions that it
believes address our recommendations. In particular, SSA discussed its
efforts to assess field office staff compliance with its verification
requirements as part of its ongoing enumeration quality reviews, to
assess the accuracy of the EAE process, and to develop options to
improve the integrity of its policies for issuing replacement Social
Security cards. SSA also provided technical comments on our draft
report, which we incorporated where appropriate.
We are sending copies of this report to the Commissioner of SSA, the
Secretary of Homeland Security, the Secretary of State, and other
interested parties. Copies will also be made available to others upon
request. In addition, the report will be available at no charge on
GAO's Web site at http://www.gao.gov. If you have any questions
concerning this report, please call me on (202) 512-7215. Key
contributors to this report are listed in appendix III.
Sincerely yours,
Barbara D. Bovbjerg
Director, Education, Workforce, and Income Security Issues:
Signed by Barbara D. Bovbjerg:
[End of section]
Appendix I: Scope and Methodology:
The Chairman, Subcommittee on Social Security, House Committee on Ways
and Means asked us to describe and assess the Social Security
Administration's (SSA) initiatives to ensure the appropriate issuance
of Social Security Numbers (SSNs) to noncitizens and to identify
vulnerabilities to error or fraud SSA has not yet addressed. To address
the Chairman's questions, we examined SSA's enumeration policies and
procedures and obtained information on key initiatives planned and
undertaken to strengthen SSA's processes to ensure the integrity of the
enumeration process. We also reviewed SSA's current noncitizen
enumeration processes to identify areas where existing and recent
changes to its Program Operations Manual System (POMS) were not being
followed or the POMS guidance was not sufficient to ensure the
integrity of the enumeration process. We collected and analyzed
implementing documentation and available performance data on the
timeliness, accuracy, and workload impacts for key noncitizen
enumeration initiatives, including Enumeration at Entry (EAE),
Collateral Verification, and Enumeration Centers. We analyzed the
results of prior reviews and studies performed by SSA's Office of the
Inspector General (OIG) and Office of Quality Assurance. In addition,
we reviewed studies and data provided by the Department of Homeland
Security (DHS) and Department of State on their specific agency
processes that support SSA's noncitizen enumeration initiatives. We
also analyzed our prior reports, related documents, and audits
performed by the Inspectors General at the Departments of State and
Justice. We conducted our review at SSA headquarters in Baltimore,
Maryland, and in 4 of its 10 regional offices--Atlanta, Georgia;
Chicago, Illinois; New York, New York; and San Francisco, California
(and at 17 field offices in those regions). We selected the regional
and field offices based on the following criteria (1) enumeration
workload--the locations represented about 70 percent of noncitizen
enumerations in 2001; (2) geographic distribution--the regions are
dispersed across the nation, representing border and inland locations;
and (3) best practices--locations trying innovative approaches to
enumeration, such as the Brooklyn, New York, Social Security Card
Center (BSSCC). We also collected and analyzed data and documents on
SSA's enumeration initiatives and workloads.
We documented officials' perspectives on SSA's enumeration initiatives
and identified areas where vulnerabilities and gaps exist in SSA's
implementation of these policies from our in-depth interviews with more
than 100 management and line staff. From our analysis of documents and
data obtained during fieldwork, we were able to identify significant
problems and issues associated with implementing these initiatives.
Furthermore, we identified best practices developed at the regional or
local levels that have the potential to improve the integrity of SSN
issuance to noncitizens nationally. Also, our investigators tested
SSA's enumeration practices by posing as parents of newborns and used
counterfeit documents to obtain SSNs from an SSA field office and
though the mail. We performed our work from September 2002 through July
2003 in accordance with generally accepted government auditing
standards.
[End of section]
Appendix II: Comments from the Social Security Administration:
SOCIAL SECURITY:
The Commissioner:
October 3, 2003:
Ms. Barbara D. Bovbjerg
Director,
Education, Workforce, and Income Security Issues
U.S. General Accounting Office Washington, D.C. 20548:
Dear Ms. Bovbjerg:
Thank you for the opportunity to review and comment on the draft report
"Actions Taken to Strengthen Procedures for Issuing Social Security
Numbers to Noncitizens But Some Weaknesses Remain" (GAO-04-12). Our
comments on the report are enclosed.
If you have any questions, please have your staff contact Laura Bell at
(410) 965-2636.
Sincerely,
Signed by:
Jo Anne B. Barnhart:
Enclosure:
SOCIAL. SECURITY ADMINISTRATION BALTIMORE MD 21235-0001:
COMMENTS ON THE GENERAL ACCOUNTING OFFICE (GAO) DRAFT REPORT "ACTIONS
TAKEN TO STRENGTHEN PROCEDURES FOR ISSUING SOCIAL SECURITY NUMBERS
(SSN) TO NONCITIZENS BUT SOME WEAKNESSES REMAIN" (GAO-04-12):
Thank you for the opportunity to review and comment on the draft
report. The Social Security Administration (SSA) has made the integrity
of the SSN a major Agency priority. We have made a number of
significant enhancements in the last two years and are continuing to
improve these safeguards.
In the fall of 2001, SSA formed a high-level Enumeration Response Team
to strengthen our ability to prevent criminals from using SSNs and SSN
cards to advance their activities. We quickly began retraining
employees on the rules for enumerating individuals, with a special
focus on non-citizens. On July 1, 2002, we began verifying with the
Department of Homeland Security (DHS) any documents issued by them
before assigning an SSN.
We implemented an "Enumeration at Entry" process, administered jointly
with the Department of State and DHS, which assigns SSNs and issues
cards to noncitizens who enter the country as permanent residents. We
also revised our verification processes for young children. Although
the vast majority of children receive an SSN through our "Enumeration
at Birth" program, the parents may still apply through the local Social
Security office. In June 2002 we began verifying all birth certificates
for children age one or older.
We opened a Social Security Card Center in Brooklyn, New York, to bring
a tighter overall focus to assigning SSNs. At this center, Social
Security employees work closely with employees from both our Office of
the Inspector General and the DHS. The results have been encouraging,
and we are considering additional card centers. We drafted a regulation
to stop assigning SSNs to non-citizens for the purpose of applying for
a driver's license, which reinstates a policy that was overturned by a
court. Also, SSA is leading a new government project, known as "E-
Vital" to compile and verify death and birth records electronically.
Turning to the subject of SSN verification, we currently provide over
770 million verifications a year, almost 3 verifications for every
active number. Requests continue to grow rapidly. Users include
employers who verify their new hires and a wide range of government
agencies, including law enforcement agencies. It is important to
remember that when SSA receives a request for an SSN verification, all
we can really verify is whether the information included in the
request-name, number, date of birth matches the information in our
records. Our verification is no guarantee that the person presenting
that number is in fact the person to whom it was originally issued.
Since 1997, SSA has worked to provide a verification service tailored
to the needs of State Departments of Motor Vehicles (DMV). The Online
Verification Service enables DMVs to request verification while
processing a driver's license application. Requests are processed in 1
second or less for over 90 percent of these transactions. In 2004, we
expect to process 20 million verification requests-more than triple
this year's number. We now have 34 States signed up of which 22 are
active users.
The online system provides verification information to the DMV while
the driver's license applicant is still at the counter, unlike the
"batch" system currently used by 7 States. Also unlike the online
system the batch system does not provide a death indicator. We are
committed to expanding the online service because we believe it is the
best way to improve the integrity of the licensing system.
We believe that the improvements we have implemented make it more
difficult for individuals to obtain or use SSNs fraudulently. SSA is
fully committed to strengthening the integrity of Social Security's
process and to work with other agencies with the goal of thwarting
identity crimes that burden Americans and threaten the security of the
Nation. Our responses to the specific recommendations are provided
below. We have also included technical comments to enhance the accuracy
of the report.
Recommendation 1:
SSA should perform systematic reviews of field office (FO) compliance
with verification requirements for enumerating noncitizens and identify
corrective actions needed to ensure maximum effectiveness of this
process.
Comment:
We agree. Beginning October 2002, all SSA regional offices had plans in
place to monitor FO compliance with the collateral verification
requirements, such as, reviewing samples of completed SS-5
applications. Other actions we have taken to ensure compliance include:
1) The issuance of Emergency Messages (EMs) to all FOs explaining our
new policy and procedures; 2) broadcasting Interactive Video Training
courses on SSN enumeration policies; 3) the national expansion of the
regionally developed "NY SS-5 Assistant" which supports processing of
SSN applications filed by non-citizens which streamlines the processing
of SS card applications, improves service delivery and aids FOs in
controlling the SS card workload; and 4) the development of an
automated, intranet-based management information application that:
offers more flexibility and information than the existing application;
targets employee compliance with the new enumeration policies;
recognizes potential local weaknesses in the enumeration process;
identifies training needs; provides a mechanism to identify possible
fraud or performance problems; and reinforces the continuing
partnership among the FOs, areas and regional staffs in addressing
these issues. We are including an assessment of FO staff compliance
with verification requirements as part of our ongoing enumeration
quality review. Finally, we continue to monitor compliance with
existing processes through our Comprehensive Integrity Review Process
(CIRP) program and to make improvements when weaknesses or errors are
identified.
Recommendation 2:
SSA should enhance the Modernized Enumeration System (MES) to prevent
staff from issuing SSNs without following required verification
procedures.
Comment:
We agree. We plan to modify the MES to capture more discrete
information about the evidence submitted and we are considering this
MES change as part of our Long Term Enumeration Fraud Initiative.
Specifically, one of the recommendations made by the Long Term
Enumeration Fraud Initiative team is that the MES be revised to collect
evidentiary data in specific fields tailored to the type of evidence;
e.g., immigration evidence, drivers' licenses or birth records.
However, these modifications will have to be considered as part of our
Information Technology prioritization process. In the nearer term, SSA
plans to make programming changes to the MES early next year which
would interrupt the card production process whenever the system
detects: 1) that an individual is the mother or father of an improbably
large number of offspring, or 2) that an unusual number of cards are
being mailed to the same address. In both of the above instances, a
card would not be produced until the FO concluded an investigation.
Recommendation 3:
SSA should develop and implement a structured evaluation plan to assess
the initial operation of the Enumeration at Entry (EAE) initiative and
identify SSA, State Department and Department of Homeland Security
(DHS) business process changes needed to expand EAE to additional
groups of noncitizens.
For the initial phase of EAE, this evaluation should determine the
accuracy of SSN issuance decisions and causes of operational
weaknesses. To assist SSA in moving forward on EAE expansion, the
assessment should identify categories of noncitizens to which EAE can
and should be expanded as well as additional data collection and
changes to automated systems that will be needed by all three
participating agencies.
Comment:
We agree. SSA continues to work with the State Department and DHS to
identify and quickly resolve operational problems. The issue regarding
incorrect country codes cited in the report has already been corrected
and others are in various phases of resolution.
Regarding the evaluation of the EAE, we have developed a sample study
to assess the accuracy of EAE process. Specifically, the study will: 1)
assess the accuracy of the EAE record based on the information in the
State Department's and DHS's records; 2) determine if individuals are
assigned multiple SSNs that were not cross-referred on our records,
either because he/she had previously been assigned a number or was
subsequently assigned a number through contact with us noting the
frequency in which multiple SSNs are being assigned; and 3) collect
management information on the EAE process; e.g., replacement cards
requested on the issued EAE SSN.
We are also arranging a meeting with the State Department and DHS to
discuss an intercomponent evaluation of the EAE process and we have
written to the State Department to explore the feasibility of expanding
the EAE process to certain non-immigrants.
Recommendation 4:
SSA should evaluate the Brooklyn Enumeration Center (BEC) to assess the
feasibility of expansion to other locations and interaction with SSA's
other initiatives to improve the integrity of SSN issuance to
noncitizens. This should include an assessment of the:
1) need and role of possible future centers in relation to the agency's
plans to expand EAE; 2) accuracy of SSN issuance decisions, its value
as a fraud detection and prevention tool, and its impact on surrounding
field office workloads; and 3) the costs and benefits of how such
centers would function without DHS staff on-site.
Comment:
We agree. We have been closely monitoring the impact of the Brooklyn
Social Security Card Center (BSSCC, formerly known as BEC) on both
service delivery and the quality of SSN application processing. Our
interim results show the BSSCC has enhanced service to the public and
enumeration stewardship by processing SSN applications quicker with a
higher degree of quality. We plan to provide a final evaluation on the
center's first year of operation in January 2004. After this evaluation
is completed, we will determine the next steps on any future
enumeration center options.
Recommendation 5:
SSA should revise its requirement for verification of the birth records
of U.S. citizens who apply for an SSN to require third-party
verification of the birth records of children under age 1.
Comment:
We agree. This verification may help to deter fraud. Since April 1,
2003, four enumeration fraud referrals have been made based on our
internal CIRP involving children under one year of age. However, in
considering whether to implement this recommendation, we have to
consider the potential negative impact on our service to the public and
the potential administrative cost.
Currently, nearly 90 percent of U.S. born children (3.8 million in FY
2002) are enumerated through the Enumeration at Birth (EAB) program.
Two to three percent of the parents who have used EAB to request SSNs
for their newborns also visit an SSA office to apply for SSNs. This
happens because State practices for transmitting data to SSA vary
greatly and, as a result, it can take up to 6 months following a birth
for some States to record the birth and be ready to verify a birth
certificate. For FY 1999, the Office of Quality Assurance (OQA)
determined that SSA assigned 374,900 non-EAB SSNs to U.S.-born persons
under age 1 (approximately 79 percent of those non-EAB SSNs issued to
U.S.-born persons under age 18). Considering current State birth
registration policies, a collateral verification policy for those under
age 1 could result in significant delays in assigning SSNs. This could
be perceived negatively, especially at the end of a tax year as the
inability to obtain an SSN in a timely manner may affect the ability of
parents to file their income tax return on time.
Moreover, SSA is currently piloting the Electronic Verification of
Vital Events (EVVE) system in eight pilot States and a number of SSA's
FOs. EVVE allows SSA employees to verify State birth and death
information online. EVVE provides direct government-to-government
transactions that will help reduce fraud within the claims and
enumeration processes.
We intend to conduct a study that will identify a sample of individuals
who were enumerated before age 1, other than through the EAB process,
and attempt to retrieve birth certificates from the appropriate State
Bureau of Vital Statistics (BVS). This study will also verify the
accuracy of our records based on the information on the birth
certificate. Additionally, we, in collaboration with the National
Association for Public Health Statistics and Information Systems
(NAPHSIS), are planning to study the potential for fraud in this group
of SSN applicants and the most effective way to address it. These study
results will determine whether we can support the policy change.
Recommendation 6:
SSA should reassess its policies for issuing replacement Social
Security cards and develop options for deterring abuse in this area.
Comment:
We agree. We have developed some options and plan to obtain additional
information from DHS to determine which options would provide the
greatest measure of deterrence.
For example, the SSN card stub (12/2002 version) currently contains the
remark, "Keep your card in a safe place to prevent loss or theft." This
language appears on the stub immediately above the card and above the
applicant's mailing address. The reverse side of the card contains the
following admonition, "DO NOT carry it with you.":
We are revising the SSN card to further emphasize the importance of the
card holder taking steps to protect the card. On the left-hand side of
this new card, there will be five bullets shown with the first two
bullets stating the following:
* Keep this card in a safe place with your personal records to prevent
loss or theft
* DO NOT CARRY IT WITH YOU:
For additional emphasis, language on the reverse side of the card will
also state, "DO NOT CARRY IT WITH YOU.":
[End of section]
Appendix III: GAO Contacts and Staff Acknowledgments:
GAO Contacts:
Barbara Bovbjerg, (202) 512-7215 Daniel Bertoni, (202) 512-5988 Anthony
J. Wysocki, (202) 512-6016:
Staff Acknowledgments:
In addition to those named above, the following team members made key
contributions to this report throughout all aspects of its development:
Patricia M. Bundy, William E. Hutchinson, Eileen Peguero, and Jill D.
Yost. In addition, Susan C. Bernstein, Andrew O'Connell, and Roger J.
Thomas made contributions to this report.
FOOTNOTES
[1] On March 1, 2003, those functions performed by the Immigration and
Naturalization Service related to monitoring individuals entering the
United States were transferred to the Bureau of Citizenship and
Immigration Services in the DHS.
[2] For our review, we classified noncitizens as (1) immigrants
(individuals who come to the United States to reside permanently, e.g.,
the alien spouse of a U.S. citizen) and (2) nonimmigrants (individuals
who come to the U.S. temporarily, e.g., students and visitors).
[3] Under a process called Enumeration at Birth hospitals send birth
registration data to a state or local bureau of vital statistics, where
it is put into a database. SSA accepts the data captured during the
birth registration process as evidence of age, identity, and
citizenship and assigns the child an SSN without further parental
involvement.
[4] As of September 2002, "collateral verification" is now required for
all noncitizens. Under SSA's prior policy, it was only required for
those who have been in the country more than 30 days.
[5] The SAVE system is the only available data source on the
immigration status of noncitizens. We are aware of limitations in DHS's
SAVE data but have not conducted an independent assessment of the
quality of the records in that system. The Justice Department's Office
of the Inspector General has issued several reports that questioned the
reliability, accuracy, and management controls over nonimmigrant data
in the SAVE system. (See "Immigration and Naturalization Service
Monitoring of Nonimmigrant Overstays," Rept. No. I-97-08, Sept. 1997;
"Follow-Up Report On INS Efforts To Improve The Control Of Nonimmigrant
Overstays," Rept. No. I-2002-006, April 2002; and "Immigration and
Naturalization Service's Ability to Provide Timely and Accurate Alien
Information to the Social Security Administration," Rept. No. I-2003-
001, Nov. 2002.)
[6] Schools accredited by DHS may issue letters authorizing foreign
students to work without notifying DHS or obtaining DHS approval.
[7] As of our report's issuance, SSA was also seeking authority to
require that students already have an on-campus job before an SSN may
be issued.
[8] When SSA field office staff question the authenticity of a
noncitizen's documents, they submit photocopies of those documents to
DHS to be verified.
[9] Presently, DHS's SEVIS database does not track foreign student on-
campus employment or work authorization. DHS has expressed interest in
adding that information to the data gathered on noncitizen students,
but has no immediate plans to do so.
[10] Representatives of the Immigration and Naturalization Service
(INS) [INS was transferred to DHS in 2003] and SSA signed a MOU in
October 2002 and December 2002, respectively. SSA also has a 1996 MOU
with State.
[11] SSA's estimated savings are based on a projection of 400,000
immigrants availing themselves of EAE once the current phase is fully
implemented. SSA calculated the savings by multiplying 400,000 by
$13.48 (the SSA field office unit cost for processing an SSN
application) resulting in $5.39 million from which SSA subtracted
$263,000 of yearly costs SSA pays DHS for processing SSN information
under EAE. This resulted in an annual savings estimate of $5.13
million.
[12] As part of the visa application process, State consulate officials
also ask immigrants who already have an SSN, if they would like SSA to
send them a replacement Social Security card.
[13] Legal permanent residents are immigrants who have been granted
permission to live and work permanently in the United States.
[14] As of the completion of our audit work, SSA has not yet finalized
this evaluation plan.
[15] Of the 4.2 million SSNs issued to U.S. citizens in fiscal year
2002, about 89 percent, or 3.8 million, were issued under SSA's EAB
process. Under EAB, hospitals send birth registration data to a state
or local bureau of vital statistics where it is put into a database.
SSA accepts the data from the birth registration process as evidence of
age, identity, and citizenship and assigns the child an SSN without
further parental involvement.
[16] SSA does not maintain data on the actual number of children
enumerated outside of the EAB process each year.
[17] SSA Office of the Inspector General, Procedures for Verifying
Evidentiary Documents Submitted with Original Social Security Number
Applications, A-08-98-41009 (Sept. 2000).
[18] SSA Office of the Inspector General, Management Advisory Report:
Using Social Security Numbers to Commit Fraud, A-08-99-42002 (May 28,
1999).
[19] SSA's automated system shows field staff how many times an
individual has applied for a replacement card, which office processed
the application, and when it was processed.
[20] SSA Office of the Inspector General, Replacement Social Security
Number Cards: Opportunities to Reduce the Risk of Improper Attainment
and Misuse, A-08-00-10061 (Sept. 2001).
GAO's Mission:
The General Accounting Office, the investigative arm of Congress,
exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains
abstracts and full-text files of current reports and testimony and an
expanding archive of older products. The Web site features a search
engine to help you locate documents using key words and phrases. You
can print these documents in their entirety, including charts and other
graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order
GAO Products" heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. General Accounting Office
441 G Street NW,
Room LM Washington,
D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Public Affairs:
Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S.
General Accounting Office, 441 G Street NW, Room 7149 Washington, D.C.
20548: