This is the accessible text file for GAO report number GAO-04-12 
entitled 'Social Security Administration: Actions Taken to Strengthen 
Procedures for Issuing Social Security Numbers to Noncitizens, but Some 
Weaknesses Remain' which was released on October 15, 2003.

This text file was formatted by the U.S. General Accounting Office 
(GAO) to be accessible to users with visual impairments, as part of a 
longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov.

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately.

Report to the Chairman, Subcommittee on Social Security, Committee on 
Ways and Means, House of Representatives:

United States General Accounting Office:

GAO:

October 2003:

SOCIAL SECURITY ADMINISTRATION:

Actions Taken to Strengthen Procedures for Issuing Social Security 
Numbers to Noncitizens, but Some Weaknesses Remain:

GAO-04-12:

GAO Highlights:

Highlights of GAO-04-12, a report to the Chairman, Subcommittee on 
Social Security, Committee on Ways and Means, House of Representatives

Why GAO Did This Study:

In 2002, the Social Security Administration (SSA) issued nearly 6 
million new Social Security numbers (SSNs), of which 1.3 million were 
issued to noncitizens. Despite its narrowly intended purpose, the SSN 
has in practice become the national identifier. SSNs are key pieces of 
information in creating false identities, underscoring the importance 
of issuing SSNs only to those eligible for them and of protecting 
those already assigned to individuals. The flow of noncitizens into 
the United States and the accompanying number of SSNs issued to them 
over the last several years add to the importance of having sound 
practices to avoid issuing SSNs to those who do not qualify for them. 

The Subcommittee Chairman asked GAO to describe and assess SSA’s key 
initiatives to ensure the appropriate issuance of SSNs to noncitizens 
and identify vulnerabilities to error or fraud SSA has not yet 
addressed. 

What GAO Found:

SSA Has Increased Noncitizen Verifications and Begun New Initiatives: 

SSA has taken steps to prevent the inappropriate assignment of SSNs to 
noncitizens. SSA now requires field staff to verify noncitizens' 
identity documents with the Department of Homeland Security (DHS), in 
addition to continuing to require visual inspection of these 
documents, prior to issuing an SSN. However, many field staff GAO 
interviewed are relying heavily on DHS's verification while neglecting 
SSA's standard inspection practices, even though both approaches are 
necessary. SSA has also undertaken new initiatives to shift the burden 
of processing noncitizen SSN applications and verifying documents from 
its field offices. In 2002, SSA started implementation of a process 
called “Enumeration at Entry” (EAE), which relies on State Department 
and DHS expertise to authenticate information provided by SSN 
applicants. SSA is in the early stages of planning to evaluate EAE 
with the State Department and DHS. Also, SSA recently piloted a 
specialized center in Brooklyn, New York, which focuses on enumeration 
and uses the expertise of DHS staff and SSA’s Office of the Inspector 
General investigators. 

Some Areas Affecting Issuance of SSNs Not Yet Addressed: 

While SSA has embarked on these new initiatives, it has not tightened 
controls in two key areas of its enumeration process that could be 
exploited by individuals—citizens and noncitizens alike—seeking 
fraudulent SSNs: the assignment of SSNs to children under age 1 and 
replacement Social Security cards. SSA changed its policy to require 
independent verification of birth records for U.S.-born children age 1 
and over but still only relies on visual inspection of birth documents 
of children under age 1. This lack of independent verification remains 
an area vulnerable to fraud. In fact, by posing as parents of 
newborns, GAO investigators obtained two SSNs using counterfeit 
documents. SSA’s policy for replacing Social Security cards, which 
allows individuals to obtain up to 52 replacement cards per year, and 
its documentation requirements for U.S. citizens to obtain such cards 
also increase the potential for misuse of SSNs. Of the 18 million 
cards issued by SSA in 2002, 12.4 million, or 69 percent, were 
replacements. While SSA requires noncitizens applying for replacement 
cards to provide the same identity and immigration information as if 
they were applying for a new SSN, its evidence requirements for 
citizens are much less stringent. The ability to obtain many 
replacement cards with relatively weak documentation may allow 
individuals to impersonate others by using counterfeit documents to 
obtain SSNs for a range of illicit uses, including selling them to 
noncitizens.

What GAO Recommends:

GAO recommends that SSA strengthen the integrity of its enumeration 
policies and procedures by taking actions such as reviewing field 
compliance with verification requirements for enumerating noncitizens. 
In its response to GAO’s draft report, SSA agreed with GAO’s 
recommendations and provided information on planned and current 
actions to address them.

www.gao.gov/cgi-bin/getrpt?GAO-04-12.

To view the full product, including the scope and methodology, click 
on the link above. For more information, contact Barbara Bovbjerg at 
(202) 512-7215 or bovbjergb@gao.gov.

[End of section]

Contents:

Letter:

Results in Brief:

Background:

SSA Has Increased Verifications and Launched Other Key Initiatives, but 
Additional Actions Are Needed:

SSA's Actions to Tighten Controls Leave Some Key Areas Unaddressed:

Conclusions:

Recommendations:

Agency Comments:

Appendix I: Scope and Methodology:

Appendix II: Comments from the Social Security Administration:

Appendix III: GAO Contacts and Staff Acknowledgments:

GAO Contacts:

Staff Acknowledgments:

Tables:

Table 1: Original SSNs and Replacement Social Security Cards SSA Issued 
in Fiscal Year 2002:

Table 2: Composition of BSSCC's Staff:

Table 3: Comparison of Identity, Age, and Citizenship Requirements for 
U.S. Citizens Applying for Original SSNs and Replacement Cards.

Figures:

Figure 1. Required SSA Field Office Procedures for Noncitizen SSN 
Applications:

Figure 2: SSA's EAE Process for Assigning SSNs to Immigrants Age 18 and 
Over:

Abbreviations:

ACM: Administrative Confidential Memorandum:  

BSSCC: Brooklyn Social Security Card Center:

DHS: Department of Homeland Security:  

EAB: Enumeration at Birth:  

EAE: Enumeration at Entry:  

OIG: Office of the Inspector General: 
 
MES: Modernized Enumeration System:  

MOU: Memorandum of Understanding:  

POMS: Program Operations Manual System:  

SAVE: Systematic Alien Verification for Entitlements:  

SEVIS: Student and Exchange Visitor Information System:  

SSA: Social Security Administration:  

SSN: Social Security number:

United States General Accounting Office:

Washington, DC 20548:

October 15, 2003:

The Honorable E. Clay Shaw, Jr. 
Chairman 
Subcommittee on Social Security 
Committee on Ways and Means 
House of Representatives:

Dear Mr. Chairman:

In fiscal year 2002, the Social Security Administration (SSA) issued 
nearly 6 million new Social Security numbers (SSNs), of which 1.3 
million, or 22 percent, were issued to noncitizens, a proportion that 
has increased in recent years. Despite its narrowly intended purpose, 
the SSN has in practice become the national identifier and is central 
to a range of transactions and services associated with American life, 
including obtaining a driver license, opening a bank account, and 
receiving health care. For this reason, SSNs are key pieces of 
information in creating false identities. The events of September 11th 
underscore the importance both of issuing SSNs only to those eligible 
for them and protecting those already assigned to individuals. The flow 
of noncitizens into the United States and the accompanying number of 
SSNs issued to this group over the last several years add to the 
importance of having sound practices to avoid issuing SSNs to those who 
do not qualify for them and to ensure the identity of those who receive 
them. Because of your interest in this issue, you asked us to (1) 
describe and assess SSA's key initiatives to ensure the appropriate 
issuance of SSNs to noncitizens and (2) identify any vulnerabilities to 
error or fraud that SSA has not yet addressed in its procedures for 
issuing SSNs.

To answer your questions, we examined SSA's policies and procedures for 
issuing SSNs, a process known as enumeration, and we obtained 
information on key initiatives planned and undertaken to strengthen and 
ensure its integrity. We collected and analyzed information on SSA's 
enumeration initiatives, the results of prior internal reviews, and 
studies performed by SSA's Office of the Inspector General (OIG) and 
Office of Quality Assurance. In addition, we reviewed studies and data 
provided by the Department of Homeland Security[Footnote 1] (DHS) and 
the Department of State on their specific agency processes that support 
SSA's noncitizen enumeration initiatives. We also analyzed audits 
performed by the inspectors general at the Departments of State and 
Justice. We conducted our review at SSA headquarters in Baltimore, 
Maryland, and in 4 of its 10 regional offices--Atlanta, Georgia; 
Chicago, Illinois; New York, New York; and San Francisco, California--
and at 16 field offices in those regions. We selected the regional and 
field offices based on the following criteria: (1) enumeration 
workload--the locations represented about 70 percent of noncitizen 
enumerations in fiscal year 2001; (2) geographic distribution--the 
various regions across the nation representing border and inland 
locations; and (3) best practices--locations trying innovative 
approaches to enumeration, such as the Brooklyn, New York, Social 
Security Card Center (BSSCC). We also collected and analyzed data and 
documents on SSA's enumeration initiatives and workloads. From our in-
depth interviews with more than 100 management and line staff, we 
documented officials' perspectives on SSA's enumeration initiatives and 
identified areas where vulnerabilities and gaps exist in SSA's 
implementation of these policies. Also, our investigators tested SSA's 
enumeration practices by posing as parents of newborns and used 
counterfeit documents to obtain SSNs from an SSA field office and 
through the mail. We performed our work from September 2002 through 
July 2003 in accordance with generally accepted government auditing 
standards.

Results in Brief:

SSA has increased document verifications and developed new initiatives 
to prevent the inappropriate assignment of SSNs to noncitizens. Though 
in their early stages, these increased verifications and initiatives 
have the potential to strengthen the integrity of SSA's enumeration 
process. SSA now requires field staff to verify noncitizens' identity 
documents with the DHS, in addition to continuing to require visual 
inspection of these documents, prior to issuing an SSN. However, many 
field staff we interviewed are relying heavily on DHS's verification 
while neglecting SSA's standard inspection practices, even though both 
approaches are necessary. We also found that SSA's automated system for 
assigning SSNs is not designed to prevent the issuance of an SSN if 
field staff bypass required verification steps. SSA has also undertaken 
new initiatives to shift the burden of processing noncitizen SSN 
applications and verifying documents away from its field offices. In 
late 2002, SSA began a phased implementation of a long-term process of 
redesigning how it issues SSNs to noncitizens, called "Enumeration at 
Entry" (EAE). EAE relies on State Department and DHS expertise to 
authenticate information provided by applicants before they enter the 
country; this information is transmitted to SSA, which then issues the 
SSN. Currently, EAE is limited to immigrants age 18 and older who have 
the option of applying for an SSN at 1 of the 127 State Department 
posts worldwide that issue immigrant visas. SSA is in the early stages 
of planning an evaluation of the first phase of EAE in conjunction with 
the State Department and DHS. Also, SSA plans to continue expanding the 
program over time to include other noncitizen groups, such as students 
and exchange visitors. In addition, SSA recently piloted a specialized 
center in Brooklyn, New York, which focuses exclusively on enumeration 
and utilizes the expertise of DHS immigration status verifiers and 
SSA's OIG investigators.

While SSA has embarked on these new initiatives, it has not tightened 
controls in two key areas of its enumeration process that could be 
exploited by individuals--citizens and noncitizens alike--seeking 
fraudulent SSNs: the assignment of SSNs to children under age 1 and the 
replacement of Social Security cards. SSA changed its policy in 2002 to 
require that field staff obtain independent, third-party verification 
of the birth records for U.S.-born children age 1 and over, but it left 
in place its prior policy for children under age 1, which calls only 
for a visual inspection of birth documents. In our field work, we found 
that this lack of independent verification remains an area vulnerable 
to fraud. Working in an undercover capacity by posing as parents of 
newborns, our investigators were able to obtain two SSNs using 
counterfeit documents. SSA's policy for replacing Social Security cards 
also increases the potential for misuse of SSNs. The policy allows 
individuals to obtain up to 52 replacement cards per year. Of the 18 
million cards issued by SSA in fiscal year 2002, 12.4 million, or 69 
percent, were replacement cards, and 1 million of these cards were 
issued to noncitizens. While SSA requires noncitizens applying for a 
replacement card to provide the same identity and immigration 
information as if they were applying for an original SSN, SSA's 
evidence requirements for citizens are much less stringent. The ability 
to obtain numerous replacement SSN cards with relatively weak 
documentation may allow individuals to impersonate others using 
counterfeit documents to obtain SSNs for a wide range of illicit uses, 
including selling them to noncitizens.

The operational and policy issues that we identified in SSA's 
enumeration functions could weaken the integrity of its enumeration 
system. Accordingly, we are making several recommendations intended to 
strengthen SSA's policies and procedures for issuing SSNs to 
noncitizens and citizens and to enhance SSA's coordination and 
deployment of new initiatives in this area. In its response to our 
draft report, SSA agreed with our recommendations and provided 
information on planned and current actions that they believe address 
them. (SSA's comments are reproduced in appendix II.) In particular, 
SSA discussed its efforts to assess field office staff compliance with 
its verification requirements as part of its ongoing enumeration 
quality reviews, to assess the accuracy of the EAE process, and to 
develop options to improve the integrity of its policies for issuing 
replacement Social Security cards.

Background:

The Social Security Act of 1935 authorized the SSA to establish a 
record-keeping system to help manage the Social Security program and 
resulted in the creation of the SSN. SSA uses the SSN as a means to 
track workers' earnings and eligibility for Social Security benefits. 
Through a process known as "enumeration," each person receives a unique 
number, which is used for the work and retirement benefit record for 
the Social Security program. Today, SSNs are issued to most U.S. 
citizens, and they are also available to noncitizens[Footnote 2] 
lawfully admitted to the United States with permission to work. 
Lawfully admitted noncitizens may also qualify for an SSN for nonwork 
purposes when a federal, state, or local law requires that they have an 
SSN to obtain a particular welfare benefit or service. SSA must obtain 
documentary evidence from such applicants regarding their age, 
identity, U.S. citizenship, immigration status, and if they were 
previously assigned an SSN. SSA's 1,333 field offices' primary 
enumeration responsibilities include interviewing such applicants for 
both original and replacement Social Security cards, reviewing identity 
and immigration documents, verifying immigration and work status with 
the DHS and State, and keying information into the agency's automated 
enumeration system.

In fiscal year 2002, SSA issued approximately 5.6 million original SSNs 
and 12.4 million replacement cards. As shown in table 1, most of the 
agency's enumeration workload involves U.S. citizens who generally 
receive SSNs at birth via states' and certain jurisdictions' birth 
registration process facilitated by hospitals.[Footnote 3] However, the 
bulk of original SSNs issued by SSA's field offices are for 
noncitizens. These offices also process requests for replacement cards-
-for both citizens and noncitizens.

Table 1: Original SSNs and Replacement Social Security Cards SSA Issued 
in Fiscal Year 2002:

Numbers in millions.

Original SSNs issued; U.S. citizens: 4.23[A]; Noncitizens: 1.34; Total: 
5.57.

Replacement Social Security cards issued; U.S. citizens: 11.45; 
Noncitizens: 1.00; Total: 12.45.

Total; U.S. citizens: 15.68; Noncitizens: 2.34; Total: 18.02.

Source: SSA.

[A] Of the 4.23 million SSNs issued to U.S. citizens in fiscal year 
2002, 3.8 million (about 89 percent) were issued under SSA's 
Enumeration at Birth (EAB) process, which is not part of the field 
office workload.

[End of table]


Following the events of September 11, 2001, SSA began taking steps to 
place a greater emphasis on improving the integrity of the enumeration 
process. For example, to launch these efforts, the Commissioner 
established an in-house response team to identify ways to prevent fraud 
and formed a task force with the State Department and DHS to formalize 
and expedite collaboration on various initiatives designed to improve 
the verification of information furnished by noncitizen SSN applicants.

SSA Has Increased Verifications and Launched Other Key Initiatives, but 
Additional Actions Are Needed:

SSA has increased document verifications and begun other new 
initiatives to prevent the inappropriate assignment of SSNs to 
noncitizens, but additional actions are needed to strengthen the 
integrity of the process. SSA now requires third-party verification of 
all noncitizen documents with DHS and State prior to issuing an SSN. 
This verification is required in addition to existing requirements to 
inspect documents in-house. However, many field staff we interviewed 
are relying heavily on the third-party verification, while neglecting 
SSA's in-house practices for verifying identity documents. SSA has also 
undertaken new initiatives to shift the burden of processing noncitizen 
applications away from its field offices. In October 2002, SSA began 
implementing the first phase of a long-term process to redesign how it 
issues SSNs to noncitizens, called "Enumeration at Entry" (EAE). Under 
this initiative, State and DHS experts screen SSN applicants before 
they enter the United States. SSA is in the early stages of developing 
a timetable to evaluate the effectiveness of EAE as well as to assess 
the potential for future expansion to other noncitizen groups. SSA also 
recently piloted a specialized center in Brooklyn, New York, to focus 
exclusively on enumeration and to bring on board expertise from DHS as 
well as to utilize SSA's own Inspector General.

SSA Has Stepped Up Document Verification, but Some Weaknesses Exist:

SSA has increased document verifications by requiring independent 
third-party verification of documents for all noncitizens with the 
issuing agency--namely DHS and State--prior to issuing an SSN. This 
process--called "collateral verification"[Footnote 4]--involves field 
office staff performing an on-line query to DHS's Systematic Alien 
Verification for Entitlements (SAVE)[Footnote 5] database to verify the 
immigration and work status of noncitizens. If the information is not 
available in SAVE, field staff must mail a request to DHS seeking 
verification. In conjunction with this verification, SSA field staff 
are required to visually inspect the immigration and identity documents 
presented by applicants. SSA has issued several directives and produced 
a training video for field offices to reinforce the policy of making 
visual inspections of applicant documents with a variety of forensic 
tools. These include using an ultraviolet light, called a "black 
light," to verify the presence of embedded security features and 
comparing documents against sample DHS documents and security 
guidelines contained in a binder maintained in each field office.

SSA has also stepped up its verification of documents for foreign 
students seeking SSNs, by requiring them to show proof of their full-
time enrollment. However, SSA still does not require its field staff to 
verify this information or letters from the school stating that the 
student is authorized to work--with the school.[Footnote 6] SSA also 
does not require that students actually have a job to qualify for an 
SSN, only that they have been authorized by their school to work on 
campus.[Footnote 7]

Figure 1: Required SSA Field Office Procedures for Noncitizen 
SSN Applications:

[See PDF for image]

[A] SSA's procedures call for its staff to refer these cases to SSA's 
Office of Inspector General for further review.

[End of figure]

Despite SSA's actions to strengthen its processes for issuing SSNs to 
noncitizens, some weaknesses exist.

* Field staff rely heavily on SAVE verifications, with the result that 
many neglect to perform required in-house, visual inspection of 
documents in conjunction with the SAVE verification. Although field 
office staff can check the immigration and identity status of an 
individual through SAVE, that does not ensure that the documents 
presented by the applicant are valid. The agency's only way of 
detecting whether documents by themselves are counterfeit is through 
visual inspections. However, our interviews with front-line field staff 
who perform enumeration work in four SSA regions indicated a potential 
erosion in the traditional practice of visually inspecting documents 
due to an increasing reliance on the SAVE database. Over a third said 
they do not routinely use the black light to verify the authenticity of 
applicants' immigration documents, and only one in five staffers we 
interviewed said they regularly used SSA's confidential manual of 
security guidelines and sample documents (known as the Administrative 
Confidential Memorandum (ACM)) to check documents submitted by 
applicants. Many field staff we interviewed said that the ACM was not 
readily accessible; several said they did not know where it was located 
in their office. In addition, staff in several offices told us that 
their black light did not always work. Since SSA field office staff are 
the only persons who actually see the noncitizen's documents, it is 
critical that they make use of all available tools to ensure the 
authenticity of those documents.[Footnote 8] Nevertheless, more than a 
fourth of the field staff we interviewed told us that using the SAVE 
database to verify immigration status made visual inspections of 
documents unnecessary.

* SSA's automated enumeration system allows field staff to bypass key 
verification steps and still issue an SSN. Recent improvements to SSA's 
automated computer system for assigning SSNs, known as the Modernized 
Enumeration System (MES), have not eliminated several weaknesses that 
would allow for a breach of security. MES does not contain separate and 
distinct fields for field staff to record their use of each of the 
required verification procedures. Furthermore, it is possible for staff 
to process an SSN application without keying information into MES on 
the evidence they have reviewed and accepted. Under this situation, 
there is no consistent means for SSA to verify and review what 
verifications field staff actually did perform when they processed an 
SSN application. SSA officials told us that they are aware of this 
problem, but due to budget reasons, they have yet to develop a formal 
plan to address it.

* Another automation-related weakness concerns SSA field staff use of 
DHS's SAVE system. When field staff perform a SAVE verification, the 
SAVE system generates a unique reference number. However, it is 
possible to enter a made-up SAVE reference number without having 
actually verified an individual's status. This ability to bypass the 
SAVE system represents an internal control weakness in SSA's noncitizen 
enumeration process. SSA officials told us that it may be possible to 
modify SAVE so that after SSA staff successfully verify an individual's 
immigration status, proof of that verification would be automatically 
entered into the MES application, creating an audit trail. However, SSA 
officials noted that such a modification would require creating an 
interface between DHS's SAVE system and SSA's MES, and they have not 
yet fully explored this possibility.

* Verification for foreign students attending U.S. schools also remains 
problematic. SSA recently revised its rules to require that students 
provide evidence of full-time enrollment at an accredited educational 
institution. However, field office staff are not required to verify 
either the full-time enrollment or the work authorization letters with 
the educational institution. Most field staff we interviewed told us 
they do not verify work authorization letters unless they appear 
questionable. One staffer told us she assumes a letter is authentic if 
it is "on high-quality paper." In addition, managers in two SSA field 
offices told us they were unclear about SSA's requirements for 
enumerating noncitizen students. A recent investigation by SSA's OIG 
uncovered a ring of 32 foreign students in four states who used forged 
work authorization letters to obtain SSNs. Those students were either 
indicted for criminal offenses or taken into DHS custody. However, an 
unknown number of other students associated with this ring had already 
obtained illegal SSNs with forged work authorization letters. A foreign 
student Web site that we found highlights the inconsistencies in SSA's 
enumeration practices and advocates that students seeking SSNs "shop 
around" for offices that are more likely to grant an application.

"If you are not authorized to work, ask your Foreign Student Advisor 
for help. Sometimes they can give you a letter to the SSA stating that 
you need a SSN for on-campus employment. Here's a sample letter. If you 
can't get this letter at least get a certificate of attendance, 
preferably addressed to the Social Security Administration. Sometimes 
SSA clerks don't really read these letters, they just look at them. 
[Emphasis added]

Go to your local SSA office and ask them if you can get a SSN. 
Regulations in different offices are different, so try going to several 
different SSA offices (this approach works with many large 
bureaucracies, like banks and phone companies). [Emphasis added] 
Sometimes it even depends on a clerk you talk to. If they accept your 
application it means you'll get the number. If they don't accept it, it 
isn't recorded anywhere and you can try as many times as you like." 
[Emphasis added]

Source: Withheld.

Forged work authorization letters are not the only avenues for fraud in 
the enumeration of noncitizen students. Both managers and field office 
staff told us that SSA's policy on enumerating students was open to 
fraud because it requires only that the student be "authorized to work 
on campus," and not that the student actually be working, or even have 
a job offer. One district manager, saying that enumerating noncitizen 
students for on-campus jobs is "fraught with the potential for fraud," 
cited schools operating out of storefronts that nevertheless issued 
work authorization letters for students, claiming the students were 
working "on campus." According to SSA policy, these students are 
entitled to receive SSNs. In addition, one regional official even 
described schools selling work authorization letters to students who 
wished to get SSNs.

SSA headquarters officials said that they were aware of weaknesses 
associated with enumerating foreign students and were working on 
improving the integrity of these processes. For example, SSA is 
exploring gaining access to DHS's foreign student tracking database, 
the Student and Exchange Visitor Information System (SEVIS), which 
would permit the agency to check if a noncitizen student is enrolled 
full-time in an accredited school.[Footnote 9] In addition, SSA 
officials told us that the agency is in the process of exploring 
options to address these weaknesses, such as requiring foreign students 
to prove that they actually have an on-campus job.

SSA Has Begun a Long-Term Initiative to Enumerate Noncitizens before 
They Enter the Country:

SSA is in the early stages of a long-term process of redesigning how it 
issues SSNs to noncitizens, which it calls the "Enumeration at Entry" 
(EAE) project. SSA considers EAE to be an essential component of its 
fraud prevention efforts that will curtail its current dependence on 
visually inspecting and verifying documents that are easily forged or 
misused. Under EAE, SSA entered into Memoranda of Understanding (MOU) 
with State and DHS for those agencies to assist SSA by obtaining and 
examining, as part of immigration processing, all of the information 
SSA needs to assign SSNs to immigrants after they enter the United 
States.[Footnote 10] Since its start in 2002, EAE has grown from 3 
sites in 3 countries to all 127 State posts worldwide that issue 
immigrant visas. Currently, EAE is available only to immigrants age 18 
or older who are seeking permanent residence in the United States, and 
it is not used for temporary visitors such as students and exchange 
visitors. According to SSA, the current phase of EAE will:

* improve integrity of the enumeration process by ending field staff 
dependence on immigration documents that can be forged or misused by 
noncitizens attempting to fraudulently acquire SSNs;

* improve overall government efficiency by eliminating duplication of 
data collection by SSA, State, and DHS;

* create financial savings of approximately $5.13 million 
annually;[Footnote 11] and:

* provide a one-stop service for noncitizen SSN applicants, whereby 
noncitizens can apply for an immigrant visa and an SSN on the same 
application prior to entering the United States.

The EAE process is depicted in figure 2 and begins when an immigrant 
applies for a visa at one of State's visa-issuing posts around the 
world and continues when the immigrant later arrives at a U.S. port of 
entry where DHS performs various immigration and security checks. The 
process ends when SSA electronically screens the information provided 
by DHS for errors and assigns the individual an SSN.

During the first 7 months that SSA began receiving records under EAE--
November 2002 through May 2003--SSA reported assigning 9,627 original 
SSNs and 5,501 replacement cards[Footnote 12] to immigrants who applied 
at one of the State Department's worldwide visa-issuing posts. To date, 
SSA is having problems with the accuracy and completeness of the 
automated EAE records received, resulting in the agency's need to 
correct the errors, including contacting the applicant after he or she 
enters the country. Problems include the use of abbreviated data (e.g., 
using Ma for Maria); the incorrect use of country codes (e.g., PHI 
instead of PHL for the Philippines); and, in some instances, missing 
data fields (e.g., the city, state, and zip code of the applicant's 
place of birth). SSA officials said that the three agencies have begun 
working to correct these problems and anticipate having them resolved 
in the near future.

Figure 2: SSA's EAE Process for Assigning SSNs to Immigrants Age 18 and 
Over:

[See PDF for image]

[End of figure]

According to SSA officials, the agency intends to evaluate the initial 
phase of EAE in conjunction with the State Department and DHS after it 
has been in full operation for at least a year or at a mutually agreed 
upon time. SSA is also planning to begin discussions with DHS and State 
on expanding the process to other noncitizen groups, such as students 
and exchange visitors. SSA officials told us that, as additional groups 
of noncitizens are phased in, it expects to further reduce its field 
office enumeration workload. Currently, SSA officials said that they 
are only in the early stages of developing a timetable to estimate 
either when the agencies would start to evaluate the first phase of EAE 
or when it would begin discussions on EAE expansion. SSA officials 
noted that the expansion of EAE to nonimmigrant groups, such as 
students or exchange visitors, would probably take longer and be more 
challenging because of the diversity of the populations and differences 
in State, DHS, and SSA information systems and business processes. For 
example, according to SSA and DHS officials, the process for 
transmitting information on groups other than legal permanent 
residents[Footnote 13] is not fully automated.

SSA Is Piloting a Specialized Enumeration Center:

In November 2002, SSA established a pilot center in Brooklyn, New York, 
to specialize in enumeration (now known as the Brooklyn Social Security 
Card Center, or BSSCC) wherein its staff is assisted by in-house DHS 
staff and focuses full time on enumeration and verification. In 
addition, SSA-OIG employees are on call to assist the BSSCC's staff. 
The center provides citizens and noncitizens residing in Brooklyn a 
one-stop location for applying for SSNs and replacement Social Security 
cards and is the only location where residents of Brooklyn can receive 
such services. If a Brooklyn resident visits one of SSA's 12 Brooklyn 
offices other than the BSSCC to apply for a SSN or a replacement card, 
they are referred to the center for assistance. As of April 2003, the 
BSSCC had processed a total of 44,000 Social Security cards, with 
18,000 of those for noncitizens. SSA officials plan to use this 
centralized and specialized location to prevent the inappropriate 
issuance of SSNs and to expand the concept to other locations.

According to SSA and DHS officials, a major benefit of the BSSCC is its 
specialized personnel and the immediate, on-site verification of 
documents submitted by applicants for SSNs and replacement cards. SSA 
officials told us that the enumeration center staff would become more 
specialized and skilled at identifying fraudulent documents as they 
perform only enumeration duties. In addition, on-site DHS staff who 
verify documents (called status verifiers) have access to DHS databases 
not available to SSA staff, and their presence is expected to improve 
DHS response time and accelerate the verification of applicant 
documents. (See table 2 for the composition of BSSCC's staff.) Also, 
SSA's New York regional officials told us that they have experienced a 
reduced enumeration workload for the 12 neighboring SSA field offices. 
These officials also told us that the use of one location for 
enumeration would increase SSA's control over SSNs and reduce the 
issuance of duplicate cards. For example, having only one center where 
citizens and noncitizens residing in the service area were required to 
apply for SSNs and replacement cards might eliminate the opportunity 
for individuals to "shop around" various SSA field offices in the 
region, using fraudulent documents in order to obtain an SSN.

Table 2: Composition of BSSCC's Staff:

Providing agency: SSA; Type of staff: Manager; Number of staff: 1.

Type of staff: Providing agency: Operations supervisor; Number of 
staff: Providing agency: 1.

Type of staff: Providing agency: Management support specialist; Number 
of staff: Providing agency: 1.

Type of staff: Providing agency: Service representative; Number of 
staff: Providing agency: 6.

Type of staff: Providing agency: Teleservice representative; Number of 
staff: Providing agency: 9.

Type of staff: Providing agencyDHS: Claims representative; Number of 
staff: Providing agencyDHS: 15.

Providing agency: DHS; Type of staff: Status verifier[A]; Number of 
staff: 1.

Providing agency: Total; Type of staff: [Empty]; Number of staff: 34.

Source: SSA.

Note: SSA-OIG's New York Office agents are on call to support the BSSCC 
at the request of BSSCC's manager.

[A] DHS initially provided two status verifiers for the BSSCC; as of 
June 2003, DHS reconsidered the need for these staff and had removed 
one of them.

[End of table]

SSA and DHS officials have made some revisions to the BSSCC's staffing 
plan. SSA's draft design plan for the center included on-site DHS 
investigators, who are experts in identifying fraudulent documents, as 
well as SSA-OIG investigators. However, after discussions with SSA, DHS 
agreed to provide status verifier staff in the BSSCC, who have access 
to DHS databases not available to SSA staff but do not have the 
technical expertise to authenticate and identify fraudulent documents. 
DHS's decision to place status verifiers in the BSSCC, rather than more 
specialized investigators, who are skilled at authenticating and 
identifying fraudulent documents, may diminish SSA's ability to detect 
fraudulent documents. Presently the main function of the one status 
verifier co-located with SSA staff, is to check DHS databases that are 
unavailable to SSA staff, rather than to authenticate documents. 
Furthermore, SSA's OIG employees, at one time physically based at the 
center, are now available only on an on call basis to assist the BSSCC 
staff.

Thus far, SSA has encountered workload issues involving returned mail 
processed through the BSSCC. According to SSA officials, the postal 
service returns mailed Social Security cards processed through the 
center as undeliverable at a higher than usual rate for other field 
offices. SSA officials told us the mailing errors might be occurring 
due to problems associated with a high frequency of similar names for 
noncitizens who use the center. However, they have not yet evaluated 
the returned mail issue and other performance issues associated with 
the enumeration center.

According to SSA officials, the BSSCC is operating on a trial basis for 
a period of 1 year during which SSA plans to evaluate its 
effectiveness. SSA officials told us that they will conduct two studies 
to evaluate the center: (1) SSA and DHS are to study if the center is 
serving the needs of SSA and if it is cost-effective for DHS to provide 
on-site status verifiers and (2) SSA will perform a separate assessment 
of the center, which may address issues such as trends in applicants' 
submission of fraudulent documents to obtain SSNs.[Footnote 14] 
However, SSA officials told us that a consideration of the long-term 
feasibility of the enumeration center in relation to SSA's other 
initiatives to improve the integrity of issuing SSNs to noncitizens--
for example, EAE, is not part of their analysis. This is a key issue 
considering that SSA's progress in implementing and expanding the EAE 
initiative, whereby noncitizens apply for SSNs prior to entering the 
United States, could influence the number of additional card centers 
needed, or mitigate the need for such centers altogether in the long 
term.

SSA's Actions to Tighten Controls Leave Some Key Areas Unaddressed:

Although SSA is undertaking a number of initiatives specifically 
addressing the enumeration of noncitizens, it has not addressed two 
areas that are especially vulnerable to fraud by citizens and 
noncitizens alike: the assignment of Social Security numbers to 
children under age 1 and the replacement of Social Security cards. 
Although SSA changed its policy in 2002 to require third-party 
verification of the birth records of U.S.-born citizens over age 1, it 
left in place its prior policy for children under age 1 that calls only 
for a visual inspection of birth records. SSA's policy for replacing 
Social Security cards allows individuals to obtain up to 52 
replacements a year with no lifetime limit and allows U.S. citizens to 
obtain replacement cards with less documentation than an original SSN. 
Of the 18 million cards issued by SSA in fiscal year 2002, 12.4 
million, or 69 percent, were replacement cards. Some field staff we 
interviewed told us that despite their reservations about individuals 
who have sought replacement cards in "excessive" numbers, SSA policy 
required them to issue the cards.

Process for Assigning Social Security Numbers to Children under Age 1 
Creates Fraud Opportunities:

The implementation of SSA's policy of assigning SSNs to children under 
age 1 may create opportunities for individuals with criminal intent to 
use false or stolen birth records to obtain an SSN. While the majority 
of newborns in fiscal year 2002 received SSNs at birth through a 
hospital registration processes that SSA calls Enumeration-at-Birth 
(EAB),[Footnote 15] the parents of about 368,000 U.S.-born children 
under age 18 applied for an SSN for their children at field offices 
using their own birth evidence documents.[Footnote 16] In 2002, SSA 
began requiring field offices to verify these birth records for U.S. 
citizens age 1 or older with a state or local bureau of vital 
statistics. However, SSA exempted records for children under age 1 from 
this policy. According to SSA, it excluded children under age 1 from 
its third-party verification requirements to limit potential service 
disruptions to these applicants due to possible delays in entry of 
birth information by some state or local bureaus of vital statistics. 
Parents or guardians often need an SSN for their child soon after birth 
so they can claim the child as a dependent for tax purposes or because 
an SSN is required for such purposes as opening a bank account or 
applying for government services.

SSA's decision to verify most birth certificates had been prompted by 
an SSA OIG finding that, despite training and guidance, field staff 
were unable, by themselves, to detect counterfeit birth 
certificates.[Footnote 17] In one case, individuals posing as parents 
of infants were able to obtain over 1,000 new SSNs based on fraudulent 
birth certificates.[Footnote 18] Also, the OIG reported that, without 
means to independently verify the authenticity of out-of-state birth 
certificates, field office staff were less likely to question this 
documentation.

We found that SSA's policy to exempt birth records for children under 
age 1 from third-party verification has left the enumeration process 
open to fraud. During our fieldwork, we found an example of a 
noncitizen who submitted a counterfeit birth certificate in support of 
an SSN application for a fictitious U.S.-born child under age 1. In 
this case, the SSA field office employee identified the counterfeit 
state birth certificate by comparing it with an authentic one. However, 
SSA staff acknowledged that if a counterfeit out-of-state birth 
certificate had been used, SSA would likely have issued the SSN because 
of staff unfamiliarity with the specific features of the numerous state 
birth certificates.

Indeed, we were able to prove the ease with which individuals can 
obtain SSNs by exploiting SSA's current processes. Working in an 
undercover capacity, our investigators were able to obtain two SSNs for 
children under age 1 by using counterfeit documents. By posing as 
parents of newborns, they obtained the first SSN by applying in person 
at a SSA field office using a counterfeit birth certificate; they 
obtained the second SSN by submitting the counterfeit birth record via 
the mail. In both cases, SSA staff verified our counterfeit documents 
as being valid. SSA officials told us that the agency plans to re-
evaluate its policy for enumerating children under age 1 but has no 
specific time frame for doing so. The officials also acknowledged that 
a challenge facing the agency is to strike a better balance between 
serving the needs of the public and ensuring SSN integrity.

SSA Policy on Replacing Social Security Cards Invites Abuse:

SSA's policy for replacing Social Security cards, which allows 
individuals to obtain up to 52 replacement cards per year; as well as 
its documentation requirements for U.S. citizens to obtain replacement 
cards, whereby U.S. citizens can obtain replacement cards with less 
documentation than an original SSN, also increases the potential for 
misuse of SSNs. Of the 18 million cards issued by SSA in fiscal year 
2002, 12.4 million, or 69 percent, were replacement cards, and 1 
million of these cards were issued to noncitizens.

SSA field staff we interviewed told us that despite their reservations 
regarding individuals seeking high numbers of replacement cards, they 
are required under SSA policy to issue the cards. For example, one 
field staffer spoke of replacement card applicants who already have 
made numerous requests and continue to make new requests.[Footnote 19] 
Furthermore, many of the field office staff and managers we spoke with 
acknowledged that the current policy weakens the integrity of SSA's 
enumeration process.

In September 2001, SSA's OIG reported numerous cases in which SSA had 
issued replacement cards where potential misuse existed, such as 
multiple individuals working under a single name and SSN. [Footnote 20] 
For example, the OIG found that SSA issued 23 replacement cards to a 
19-year-old male who had $113,000 in earnings from 24 employers in 19 
states during 1999. In another case, SSA had issued 12 replacement 
cards to a 25-year-old male with a suspect work history: $106,000 in 
earnings from 12 employers in 8 states and over $10,000 in earnings 
under his SSN but under a different name in 1999; $83,000 earnings from 
10 employers in 1998; and $60,000 in earnings from 13 employers in 
1997. The OIG concluded, "It is highly improbable that in 1 year an 
individual could work for multiple employers in numerous states and 
earn significant income from traditionally low paying jobs, such as 
those in the agriculture and service industries.":

Beyond SSA's policy on providing 52 replacement cards per year, its 
identity and document requirements for providing such cards to citizens 
could further threaten SSN integrity. While SSA requires noncitizens 
applying for a replacement card to provide the same identity and 
immigration information as if they were applying for an original SSN, 
SSA's evidence requirements for citizens are much less stringent. (See 
table 3.) Citizens are not required to prove their U.S. citizenship and 
can apply for a replacement card without photograph identification, 
using documentation such as a school report card, church membership 
record, or a life insurance policy. This represents a vulnerability in 
the application process due to the ease with which identity documents, 
especially those without photographs, can be forged. Thus, an 
individual could easily impersonate a legitimate SSN cardholder to 
obtain large numbers of replacement cards for a wide range of illicit 
uses, including selling them to noncitizens.

Table 3: Comparison of Identity, Age, and Citizenship Requirements for 
U.S. Citizens Applying for Original SSNs and Replacement Cards.

Original SSN requirements: Proof of identity; (Any one or a combination 
of the following); * Driver's license; * U.S. passport; * School ID 
card; * School record; * School report card; * Marriage or divorce 
record; * Adoption record; * Health insurance card (except Medicare 
card); * Life insurance policy; * Clinic, hospital, or doctor records; 
* Church membership or confirmation record; Replacement card 
requirements: Proof of identity; Same as for an original SSN..

Original SSN requirements: Proof of age; (Any one or a combination of 
the following); * U.S. birth certificate; * Religious record 
established before age 5 showing age; * Notification of birth 
registration; Replacement card requirements: Proof of age; Only 
required if there is a discrepancy between the date of birth on the 
application and the evidence presented with the application..

Original SSN requirements: Proof of U.S. citizenship; (Any one of the 
following); * U.S. passport; * U.S. birth certificate; * Religious 
record recorded in the U.S. within 3 months after birth; * Certificate 
of naturalization; * Certificate of citizenship; * Adoption 
finalization papers; * Other document that establishes a U.S. place of 
birth or U.S. citizenship; Replacement card requirements: Proof of U.S. 
citizenship; Not necessary..

Source: GAO analysis of SSA's enumeration procedures.

Note: The above lists are not all-inclusive and differ for children 
under age 1.

[End of table]

In our audit work, we identified Web sites and publications that give 
"how-to" guidance and design samples to assist individuals in making 
counterfeit documents that can be used in support of an application for 
either a new SSN or a replacement card, such as school cards, baptismal 
certificates, and hospital records. In addition, one guide offered tips 
on getting SSNs through the mail using such counterfeit documents.

"Generally, there are two ways that one can receive a [… ] social 
security number. Through the mail or in-person at the local social 
security office. I would suggest that you try to do everything through 
the mail…In my opinion,…you should never go to the SS office in person. 
[Emphasis added] Obviously, if there is a problem with your documents 
and you need to walk away from the process, with a mail drop, you 
simply close it and walk away. There is no more connection to you, but 
to be fair, I have never heard of a problem at the SSN office.":

Source: Withheld.

SSA officials told us the agency is considering limiting the number of 
replacement cards to 2 per year and 10 cards over an individual's 
lifetime, with certain exceptions for name changes, administrative 
errors, and hardship. However, SSA officials cautioned that while 
support exists for this change within the agency, some advocacy groups, 
such as those representing the homeless and mentally ill, oppose such a 
limit. At the completion of our audit work, it was unclear whether SSA 
would address the weaknesses in its document requirements for providing 
replacement cards to citizens. Until SSA changes its policy in this 
area, there will be an increased chance that both citizens and 
noncitizens seeking to fraudulently obtain SSNs may target this 
vulnerable area.

Conclusions:

SSA has made substantial progress toward strengthening its processes 
for issuing SSNs to noncitizens through initiatives that involve 
improvements to old procedures as well as broad new approaches. Indeed, 
the agency has taken a step it has never before attempted by requiring 
that the immigration and work status of every noncitizen applicant be 
verified through an independent third-party source before an SSN is 
issued. However, without further systems improvements and staff 
compliance with all prescribed verification procedures, this initiative 
may not sufficiently prevent the issuance of SSNs to individuals 
seeking to fraudulently obtain them.

Beyond changes to its verification procedures, SSA's ability to 
corroborate the immigration status and identity information of 
noncitizen applicants may be further enhanced by newly implemented 
initiatives such as EAE and the BSSCC. SSA's collaboration with the 
Departments of State and Homeland Security through the EAE initiative 
brings additional resources to bear on noncitizen applications. 
However, because this program represents a considerable change to the 
enumeration process, it merits a thorough evaluation to overcome 
operational problems and to identify changes that may be needed before 
it is expanded to other noncitizen groups.

Similarly, specialized enumeration centers that combine the expertise 
of SSA and DHS examiners have the potential to better deter SSN fraud 
and identity theft, as well as improve the timeliness and accuracy of 
the service SSA provides. Because EAE will not be fully realized for 
many years, the enumeration center concept may also represent a viable 
near-term strategy for concentrating expertise in key geographic 
regions to process SSNs for applicants already in the country. However, 
a comprehensive evaluation of the effectiveness of the BSSCC, as well 
as an assessment of the long-term viability of additional centers in 
the face of future EAE expansion are needed to help SSA think more 
strategically about how it can be best positioned to ensure the 
integrity of its enumeration process.

Finally, SSA's substantial efforts may be undercut by other 
vulnerabilities that remain unaddressed. As SSA closes off many avenues 
of unauthorized access to SSNs, perpetrators of fraud will likely shift 
their strategies to less protected areas. In particular, SSA's policies 
for enumerating children under age 1 and providing replacement cards 
may well invite such activity, unless they, too, are modified.

Recommendations:

To strengthen the integrity of SSA's policies and procedures for 
enumerating noncitizens, we recommend that the Commissioner of Social 
Security take the following actions:

* Perform systematic reviews of field office compliance with 
verification requirements for enumerating noncitizens and identify 
corrective actions needed to ensure maximum effectiveness of this 
process.

* Enhance the Modernized Enumeration System to prevent staff from 
issuing SSNs without following required verification procedures.

* Develop and implement a structured evaluation plan to assess the 
initial operation of the EAE initiative and identify SSA, State 
Department, and DHS business process changes needed to expand EAE to 
additional groups of noncitizens. For the initial phase of EAE, this 
evaluation should determine the accuracy of SSN issuance decisions and 
causes of operational weaknesses. To assist SSA in moving forward on 
EAE expansion, the assessment should identify categories of noncitizens 
to which EAE can and should be expanded as well as additional data 
collection and changes to automated systems that will be needed by all 
three participating agencies.

* Evaluate the BSSCC to assess the feasibility of expansion to other 
locations and interaction with SSA's other initiatives to improve the 
integrity of SSN issuance to noncitizens. This should include an 
assessment of the (1) need and role of possible future centers in 
relation to the agency's plans to expand EAE; (2) accuracy of SSN 
issuance decisions, its value as a fraud detection and prevention tool, 
and its impact on surrounding field office workloads; and (3) the costs 
and benefits of how such centers would function without DHS staff on-
site.

* Revise its requirement for verification of the birth records of U.S. 
citizens who apply for an SSN to require third-party verification of 
the birth records of children under age 1.

* Reassess SSA's policies for issuing replacement Social Security cards 
and develop options for deterring abuse in this area.

Agency Comments:

We obtained written comments on a draft of this report from the 
Commissioner of SSA. SSA's comments are reproduced in appendix II. SSA 
agreed with our recommendations to strengthen its policies and 
procedures for issuing SSNs to noncitizens and citizens alike and to 
enhance coordination and deployment of new initiatives in this area. 
SSA also provided information on planned and current actions that it 
believes address our recommendations. In particular, SSA discussed its 
efforts to assess field office staff compliance with its verification 
requirements as part of its ongoing enumeration quality reviews, to 
assess the accuracy of the EAE process, and to develop options to 
improve the integrity of its policies for issuing replacement Social 
Security cards. SSA also provided technical comments on our draft 
report, which we incorporated where appropriate.

We are sending copies of this report to the Commissioner of SSA, the 
Secretary of Homeland Security, the Secretary of State, and other 
interested parties. Copies will also be made available to others upon 
request. In addition, the report will be available at no charge on 
GAO's Web site at http://www.gao.gov. If you have any questions 
concerning this report, please call me on (202) 512-7215. Key 
contributors to this report are listed in appendix III.

Sincerely yours,

Barbara D. Bovbjerg 

Director, Education, Workforce, and Income Security Issues:

Signed by Barbara D. Bovbjerg: 

[End of section]

Appendix I: Scope and Methodology:

The Chairman, Subcommittee on Social Security, House Committee on Ways 
and Means asked us to describe and assess the Social Security 
Administration's (SSA) initiatives to ensure the appropriate issuance 
of Social Security Numbers (SSNs) to noncitizens and to identify 
vulnerabilities to error or fraud SSA has not yet addressed. To address 
the Chairman's questions, we examined SSA's enumeration policies and 
procedures and obtained information on key initiatives planned and 
undertaken to strengthen SSA's processes to ensure the integrity of the 
enumeration process. We also reviewed SSA's current noncitizen 
enumeration processes to identify areas where existing and recent 
changes to its Program Operations Manual System (POMS) were not being 
followed or the POMS guidance was not sufficient to ensure the 
integrity of the enumeration process. We collected and analyzed 
implementing documentation and available performance data on the 
timeliness, accuracy, and workload impacts for key noncitizen 
enumeration initiatives, including Enumeration at Entry (EAE), 
Collateral Verification, and Enumeration Centers. We analyzed the 
results of prior reviews and studies performed by SSA's Office of the 
Inspector General (OIG) and Office of Quality Assurance. In addition, 
we reviewed studies and data provided by the Department of Homeland 
Security (DHS) and Department of State on their specific agency 
processes that support SSA's noncitizen enumeration initiatives. We 
also analyzed our prior reports, related documents, and audits 
performed by the Inspectors General at the Departments of State and 
Justice. We conducted our review at SSA headquarters in Baltimore, 
Maryland, and in 4 of its 10 regional offices--Atlanta, Georgia; 
Chicago, Illinois; New York, New York; and San Francisco, California 
(and at 17 field offices in those regions). We selected the regional 
and field offices based on the following criteria (1) enumeration 
workload--the locations represented about 70 percent of noncitizen 
enumerations in 2001; (2) geographic distribution--the regions are 
dispersed across the nation, representing border and inland locations; 
and (3) best practices--locations trying innovative approaches to 
enumeration, such as the Brooklyn, New York, Social Security Card 
Center (BSSCC). We also collected and analyzed data and documents on 
SSA's enumeration initiatives and workloads.

We documented officials' perspectives on SSA's enumeration initiatives 
and identified areas where vulnerabilities and gaps exist in SSA's 
implementation of these policies from our in-depth interviews with more 
than 100 management and line staff. From our analysis of documents and 
data obtained during fieldwork, we were able to identify significant 
problems and issues associated with implementing these initiatives. 
Furthermore, we identified best practices developed at the regional or 
local levels that have the potential to improve the integrity of SSN 
issuance to noncitizens nationally. Also, our investigators tested 
SSA's enumeration practices by posing as parents of newborns and used 
counterfeit documents to obtain SSNs from an SSA field office and 
though the mail. We performed our work from September 2002 through July 
2003 in accordance with generally accepted government auditing 
standards.

[End of section]

Appendix II: Comments from the Social Security Administration:

SOCIAL SECURITY:

The Commissioner:

October 3, 2003:

Ms. Barbara D. Bovbjerg 
Director, 
Education, Workforce, and Income Security Issues 
U.S. General Accounting Office Washington, D.C. 20548:

Dear Ms. Bovbjerg:

Thank you for the opportunity to review and comment on the draft report 
"Actions Taken to Strengthen Procedures for Issuing Social Security 
Numbers to Noncitizens But Some Weaknesses Remain" (GAO-04-12). Our 
comments on the report are enclosed.

If you have any questions, please have your staff contact Laura Bell at 
(410) 965-2636.

Sincerely,

Signed by: 

Jo Anne B. Barnhart:

Enclosure:

SOCIAL. SECURITY ADMINISTRATION	BALTIMORE MD 21235-0001:

COMMENTS ON THE GENERAL ACCOUNTING OFFICE (GAO) DRAFT REPORT "ACTIONS 
TAKEN TO STRENGTHEN PROCEDURES FOR ISSUING SOCIAL SECURITY NUMBERS 
(SSN) TO NONCITIZENS BUT SOME WEAKNESSES REMAIN" (GAO-04-12):

Thank you for the opportunity to review and comment on the draft 
report. The Social Security Administration (SSA) has made the integrity 
of the SSN a major Agency priority. We have made a number of 
significant enhancements in the last two years and are continuing to 
improve these safeguards.

In the fall of 2001, SSA formed a high-level Enumeration Response Team 
to strengthen our ability to prevent criminals from using SSNs and SSN 
cards to advance their activities. We quickly began retraining 
employees on the rules for enumerating individuals, with a special 
focus on non-citizens.	On July 1, 2002, we began verifying with the 
Department of Homeland Security (DHS) any documents issued by them 
before assigning an SSN.

We implemented an "Enumeration at Entry" process, administered jointly 
with the Department of State and DHS, which assigns SSNs and issues 
cards to noncitizens who enter the country as permanent residents. We 
also revised our verification processes for young children. Although 
the vast majority of children receive an SSN through our "Enumeration 
at Birth" program, the parents may still apply through the local Social 
Security office. In June 2002 we began verifying all birth certificates 
for children age one or older.

We opened a Social Security Card Center in Brooklyn, New York, to bring 
a tighter overall focus to assigning SSNs. At this center, Social 
Security employees work closely with employees from both our Office of 
the Inspector General and the DHS. The results have been encouraging, 
and we are considering additional card centers. We drafted a regulation 
to stop assigning SSNs to non-citizens for the purpose of applying for 
a driver's license, which reinstates a policy that was overturned by a 
court. Also, SSA is leading a new government project, known as "E-
Vital" to compile and verify death and birth records electronically.

Turning to the subject of SSN verification, we currently provide over 
770 million verifications a year, almost 3 verifications for every 
active number. Requests continue to grow rapidly. Users include 
employers who verify their new hires and a wide range of government 
agencies, including law enforcement agencies. It is important to 
remember that when SSA receives a request for an SSN verification, all 
we can really verify is whether the information included in the 
request-name, number, date of birth	matches the information in our 
records. Our verification is no guarantee that the person presenting 
that number is in fact the person to whom it was originally issued.

Since 1997, SSA has worked to provide a verification service tailored 
to the needs of State Departments of Motor Vehicles (DMV). The Online 
Verification Service enables DMVs to request verification while 
processing a driver's license application. Requests are processed in 1 
second or less for over 90 percent of these transactions. In 2004, we 
expect to process 20 million verification requests-more than triple 
this year's number. We now have 34 States signed up of which 22 are 
active users.

The online system provides verification information to the DMV while 
the driver's license applicant is still at the counter, unlike the 
"batch" system currently used by 7 States. Also unlike the online 
system the batch system does not provide a death indicator. We are 
committed to expanding the online service because we believe it is the 
best way to improve the integrity of the licensing system.

We believe that the improvements we have implemented make it more 
difficult for individuals to obtain or use SSNs fraudulently. SSA is 
fully committed to strengthening the integrity of Social Security's 
process and to work with other agencies with the goal of thwarting 
identity crimes that burden Americans and threaten the security of the 
Nation. Our responses to the specific recommendations are provided 
below. We have also included technical comments to enhance the accuracy 
of the report.

Recommendation 1:

SSA should perform systematic reviews of field office (FO) compliance 
with verification requirements for enumerating noncitizens and identify 
corrective actions needed to ensure maximum effectiveness of this 
process.

Comment:

We agree. Beginning October 2002, all SSA regional offices had plans in 
place to monitor FO compliance with the collateral verification 
requirements, such as, reviewing samples of completed SS-5 
applications. Other actions we have taken to ensure compliance include: 
1) The issuance of Emergency Messages (EMs) to all FOs explaining our 
new policy and procedures; 2) broadcasting Interactive Video Training 
courses on SSN enumeration policies; 3) the national expansion of the 
regionally developed "NY SS-5 Assistant" which supports processing of 
SSN applications filed by non-citizens which streamlines the processing 
of SS card applications, improves service delivery and aids FOs in 
controlling the SS card workload; and 4) the development of an 
automated, intranet-based management information application that: 
offers more flexibility and information than the existing application; 
targets employee compliance with the new enumeration policies; 
recognizes potential local weaknesses in the enumeration process; 
identifies training needs; provides a mechanism to identify possible 
fraud or performance problems; and reinforces the continuing 
partnership among the FOs, areas and regional staffs in addressing 
these issues. We are including an assessment of FO staff compliance 
with verification requirements as part of our ongoing enumeration 
quality review. Finally, we continue to monitor compliance with 
existing processes through our Comprehensive Integrity Review Process 
(CIRP) program and to make improvements when weaknesses or errors are 
identified.

Recommendation 2:

SSA should enhance the Modernized Enumeration System (MES) to prevent 
staff from issuing SSNs without following required verification 
procedures.

Comment:

We agree. We plan to modify the MES to capture more discrete 
information about the evidence submitted and we are considering this 
MES change as part of our Long Term Enumeration Fraud Initiative. 
Specifically, one of the recommendations made by the Long Term 
Enumeration Fraud Initiative team is that the MES be revised to collect 
evidentiary data in specific fields tailored to the type of evidence; 
e.g., immigration evidence, drivers' licenses or birth records. 
However, these modifications will have to be considered as part of our 
Information Technology prioritization process. In the nearer term, SSA 
plans to make programming changes to the MES early next year which 
would interrupt the card production process whenever the system 
detects: 1) that an individual is the mother or father of an improbably 
large number of offspring, or 2) that an unusual number of cards are 
being mailed to the same address. In both of the above instances, a 
card would not be produced until the FO concluded an investigation.

Recommendation 3:

SSA should develop and implement a structured evaluation plan to assess 
the initial operation of the Enumeration at Entry (EAE) initiative and 
identify SSA, State Department and Department of Homeland Security 
(DHS) business process changes needed to expand EAE to additional 
groups of noncitizens.

For the initial phase of EAE, this evaluation should determine the 
accuracy of SSN issuance decisions and causes of operational 
weaknesses. To assist SSA in moving forward on EAE expansion, the 
assessment should identify categories of noncitizens to which EAE can 
and should be expanded as well as additional data collection and 
changes to automated systems that will be needed by all three 
participating agencies.

Comment:

We agree. SSA continues to work with the State Department and DHS to 
identify and quickly resolve operational problems. The issue regarding 
incorrect country codes cited in the report has already been corrected 
and others are in various phases of resolution.

Regarding the evaluation of the EAE, we have developed a sample study 
to assess the accuracy of EAE process. Specifically, the study will: 1) 
assess the accuracy of the EAE record based on the information in the 
State Department's and DHS's records; 2) determine if individuals are 
assigned multiple SSNs that were not cross-referred on our records, 
either because he/she had previously been assigned a number or was 
subsequently assigned a number through contact with us noting the 
frequency in which multiple SSNs are being assigned; and 3) collect 
management information on the EAE process; e.g., replacement cards 
requested on the issued EAE SSN.

We are also arranging a meeting with the State Department and DHS to 
discuss an intercomponent evaluation of the EAE process and we have 
written to the State Department to explore the feasibility of expanding 
the EAE process to certain non-immigrants.

Recommendation 4:

SSA should evaluate the Brooklyn Enumeration Center (BEC) to assess the 
feasibility of expansion to other locations and interaction with SSA's 
other initiatives to improve the integrity of SSN issuance to 
noncitizens. This should include an assessment of the:

1) need and role of possible future centers in relation to the agency's 
plans to expand EAE; 2) accuracy of SSN issuance decisions, its value 
as a fraud detection and prevention tool, and its impact on surrounding 
field office workloads; and 3) the costs and benefits of how such 
centers would function without DHS staff on-site.

Comment:

We agree. We have been closely monitoring the impact of the Brooklyn 
Social Security Card Center (BSSCC, formerly known as BEC) on both 
service delivery and the quality of SSN application processing. Our 
interim results show the BSSCC has enhanced service to the public and 
enumeration stewardship by processing SSN applications quicker with a 
higher degree of quality. We plan to provide a final evaluation on the 
center's first year of operation in January 2004. After this evaluation 
is completed, we will determine the next steps on any future 
enumeration center options.

Recommendation 5:

SSA should revise its requirement for verification of the birth records 
of U.S. citizens who apply for an SSN to require third-party 
verification of the birth records of children under age 1.

Comment:

We agree. This verification may help to deter fraud. Since April 1, 
2003, four enumeration fraud referrals have been made based on our 
internal CIRP involving children under one year of age. However, in 
considering whether to implement this recommendation, we have to 
consider the potential negative impact on our service to the public and 
the potential administrative cost.

Currently, nearly 90 percent of U.S. born children (3.8 million in FY 
2002) are enumerated through the Enumeration at Birth (EAB) program. 
Two to three percent of the parents who have used EAB to request SSNs 
for their newborns also visit an SSA office to apply for SSNs. This 
happens because State practices for transmitting data to SSA vary 
greatly and, as a result, it can take up to 6 months following a birth 
for some States to record the birth and be ready to verify a birth 
certificate. For FY 1999, the Office of Quality Assurance (OQA) 
determined that SSA assigned 374,900 non-EAB SSNs to U.S.-born persons 
under age 1 (approximately 79 percent of those non-EAB SSNs issued to 
U.S.-born persons under age 18). Considering current State birth 
registration policies, a collateral verification policy for those under 
age 1 could result in significant delays in assigning SSNs. This could 
be perceived negatively, especially at the end of a tax year as the 
inability to obtain an SSN in a timely manner may affect the ability of 
parents to file their income tax return on time.

Moreover, SSA is currently piloting the Electronic Verification of 
Vital Events (EVVE) system in eight pilot States and a number of SSA's 
FOs. EVVE allows SSA employees to verify State birth and death 
information online. EVVE provides direct government-to-government 
transactions that will help reduce fraud within the claims and 
enumeration processes.

We intend to conduct a study that will identify a sample of individuals 
who were enumerated before age 1, other than through the EAB process, 
and attempt to retrieve birth certificates from the appropriate State 
Bureau of Vital Statistics (BVS). This study will also verify the 
accuracy of our records based on the information on the birth 
certificate. Additionally, we, in collaboration with the National 
Association for Public Health Statistics and Information Systems 
(NAPHSIS), are planning to study the potential for fraud in this group 
of SSN applicants and the most effective way to address it. These study 
results will determine whether we can support the policy change.

Recommendation 6:

SSA should reassess its policies for issuing replacement Social 
Security cards and develop options for deterring abuse in this area.

Comment:

We agree. We have developed some options and plan to obtain additional 
information from DHS to determine which options would provide the 
greatest measure of deterrence.

For example, the SSN card stub (12/2002 version) currently contains the 
remark, "Keep your card in a safe place to prevent loss or theft." This 
language appears on the stub immediately above the card and above the 
applicant's mailing address. The reverse side of the card contains the 
following admonition, "DO NOT carry it with you.":

We are revising the SSN card to further emphasize the importance of the 
card holder taking steps to protect the card. On the left-hand side of 
this new card, there will be five bullets shown with the first two 
bullets stating the following:

* Keep this card in a safe place with your personal records to prevent 
loss or theft 

* DO NOT CARRY IT WITH YOU:

For additional emphasis, language on the reverse side of the card will 
also state, "DO NOT CARRY IT WITH YOU.":

[End of section]

Appendix III: GAO Contacts and Staff Acknowledgments:

GAO Contacts:

Barbara Bovbjerg, (202) 512-7215 Daniel Bertoni, (202) 512-5988 Anthony 
J. Wysocki, (202) 512-6016:

Staff Acknowledgments:

In addition to those named above, the following team members made key 
contributions to this report throughout all aspects of its development: 
Patricia M. Bundy, William E. Hutchinson, Eileen Peguero, and Jill D. 
Yost. In addition, Susan C. Bernstein, Andrew O'Connell, and Roger J. 
Thomas made contributions to this report.

FOOTNOTES

[1] On March 1, 2003, those functions performed by the Immigration and 
Naturalization Service related to monitoring individuals entering the 
United States were transferred to the Bureau of Citizenship and 
Immigration Services in the DHS. 

[2] For our review, we classified noncitizens as (1) immigrants 
(individuals who come to the United States to reside permanently, e.g., 
the alien spouse of a U.S. citizen) and (2) nonimmigrants (individuals 
who come to the U.S. temporarily, e.g., students and visitors).

[3] Under a process called Enumeration at Birth hospitals send birth 
registration data to a state or local bureau of vital statistics, where 
it is put into a database. SSA accepts the data captured during the 
birth registration process as evidence of age, identity, and 
citizenship and assigns the child an SSN without further parental 
involvement.

[4] As of September 2002, "collateral verification" is now required for 
all noncitizens. Under SSA's prior policy, it was only required for 
those who have been in the country more than 30 days. 

[5] The SAVE system is the only available data source on the 
immigration status of noncitizens. We are aware of limitations in DHS's 
SAVE data but have not conducted an independent assessment of the 
quality of the records in that system. The Justice Department's Office 
of the Inspector General has issued several reports that questioned the 
reliability, accuracy, and management controls over nonimmigrant data 
in the SAVE system. (See "Immigration and Naturalization Service 
Monitoring of Nonimmigrant Overstays," Rept. No. I-97-08, Sept. 1997; 
"Follow-Up Report On INS Efforts To Improve The Control Of Nonimmigrant 
Overstays," Rept. No. I-2002-006, April 2002; and "Immigration and 
Naturalization Service's Ability to Provide Timely and Accurate Alien 
Information to the Social Security Administration," Rept. No. I-2003-
001, Nov. 2002.)

[6] Schools accredited by DHS may issue letters authorizing foreign 
students to work without notifying DHS or obtaining DHS approval.

[7] As of our report's issuance, SSA was also seeking authority to 
require that students already have an on-campus job before an SSN may 
be issued.

[8] When SSA field office staff question the authenticity of a 
noncitizen's documents, they submit photocopies of those documents to 
DHS to be verified. 

[9] Presently, DHS's SEVIS database does not track foreign student on-
campus employment or work authorization. DHS has expressed interest in 
adding that information to the data gathered on noncitizen students, 
but has no immediate plans to do so.

[10] Representatives of the Immigration and Naturalization Service 
(INS) [INS was transferred to DHS in 2003] and SSA signed a MOU in 
October 2002 and December 2002, respectively. SSA also has a 1996 MOU 
with State.

[11] SSA's estimated savings are based on a projection of 400,000 
immigrants availing themselves of EAE once the current phase is fully 
implemented. SSA calculated the savings by multiplying 400,000 by 
$13.48 (the SSA field office unit cost for processing an SSN 
application) resulting in $5.39 million from which SSA subtracted 
$263,000 of yearly costs SSA pays DHS for processing SSN information 
under EAE. This resulted in an annual savings estimate of $5.13 
million.

[12] As part of the visa application process, State consulate officials 
also ask immigrants who already have an SSN, if they would like SSA to 
send them a replacement Social Security card. 

[13] Legal permanent residents are immigrants who have been granted 
permission to live and work permanently in the United States.

[14] As of the completion of our audit work, SSA has not yet finalized 
this evaluation plan. 

[15] Of the 4.2 million SSNs issued to U.S. citizens in fiscal year 
2002, about 89 percent, or 3.8 million, were issued under SSA's EAB 
process. Under EAB, hospitals send birth registration data to a state 
or local bureau of vital statistics where it is put into a database. 
SSA accepts the data from the birth registration process as evidence of 
age, identity, and citizenship and assigns the child an SSN without 
further parental involvement. 

[16] SSA does not maintain data on the actual number of children 
enumerated outside of the EAB process each year. 

[17] SSA Office of the Inspector General, Procedures for Verifying 
Evidentiary Documents Submitted with Original Social Security Number 
Applications, A-08-98-41009 (Sept. 2000).

[18] SSA Office of the Inspector General, Management Advisory Report: 
Using Social Security Numbers to Commit Fraud, A-08-99-42002 (May 28, 
1999). 

[19] SSA's automated system shows field staff how many times an 
individual has applied for a replacement card, which office processed 
the application, and when it was processed.

[20] SSA Office of the Inspector General, Replacement Social Security 
Number Cards: Opportunities to Reduce the Risk of Improper Attainment 
and Misuse, A-08-00-10061 (Sept. 2001).

GAO's Mission:

The General Accounting Office, the investigative arm of Congress, 
exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; evaluates federal programs and policies; and provides 
analyses, recommendations, and other assistance to help Congress make 
informed oversight, policy, and funding decisions. GAO's commitment to 
good government is reflected in its core values of accountability, 
integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony:

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains 
abstracts and full-text files of current reports and testimony and an 
expanding archive of older products. The Web site features a search 
engine to help you locate documents using key words and phrases. You 
can print these documents in their entirety, including charts and other 
graphics.

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order 
GAO Products" heading.

Order by Mail or Phone:

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to:

U.S. General Accounting Office

441 G Street NW,

Room LM Washington,

D.C. 20548:

To order by Phone: 	

	Voice: (202) 512-6000:

	TDD: (202) 512-2537:

	Fax: (202) 512-6061:

To Report Fraud, Waste, and Abuse in Federal Programs:

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470:

Public Affairs:

Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S.

General Accounting Office, 441 G Street NW, Room 7149 Washington, D.C.

20548: