U.S. Government Exposes 63,000 to Identity Theft

The U.S. government is being accused of attempting to cover up a violation of its own privacy laws.

The Washington Post reported that Marsha Bergmeier, an Illinois farmer, ran an internet search on April 12 for the name of her farm. The search turned up a link to FedSpending.com, a federal watchdog group which provides databases to help U.S. citizens to track government spending.

The database Bergmeier found contained agricultural loan and grant information that has been made available to the public since 1996 through the U.S. Census Bureau and the U.S. Department of Agriculture. When she looked through the website, Bergmeier found her social security number listed. She contacted OMB Watch, the company that runs FedSpending.com. OMB recommended that she contact the Census Bureau.

Upon being informed of the error, the Census Bureau ran an investigation and discovered that 63,000 social security numbers belonging to farmers were embedded in loan identifiers. Identifiers are fifteen-digit numbers assigned to individual loan and grant contracts. The numbers are also required for filing Freedom of Information requests.

Terri Teuber, a spokeswoman for the U.S. Department of Agriculture, told the Washington Post that the USDA's information security division wasn't aware social security numbers were still being used as identifiers, a practice which dates back at least twenty-five years.

On April 13, the Census Bureau removed the identifiers from their public databases, but did not inform the public about the issue until April 20. Government officials said they wanted to wait to report the incident until after they informed those whose personal data was made public. They also needed to remove the information from at least half a dozen mirror sites.

Gary Bass, the director of OMB Watch, told the Washington Post that the delay was because the government was trying to keep the public from finding out. "The bottom line is the government screwed up," he said. "What's really important is that they now try to rectify the problem. Thousands of research groups have copies of this site."

On September 26, 2006, President Bush signed the Federal Funding Accountability and Transparency Act, which requires the government to create a searchable database similar to FedSpending.com by January 1, 2008. It also requires loans and grants to have unique identifiers which do not contain personal data.

The identifiers containing the social security numbers have been redacted. Because the identifiers are needed to track federal spending, OMB is pushing the government to create new ones within thirty days.

On their website, the USDA states that although there is no evidence the social security numbers have been used for identity theft, they are offering free credit monitoring to those affected. USDA funding recipients can visit USA.gov for more information.

SOURCES:

"U.S. Exposed Personal Data," The Washington Post, April 21, 2007
URL: http://www.washingtonpost.com/wp-dyn/content/article/2007/04/20/AR2007042002208.html

"USDA Narrows List to 63,000 Individuals Whose Private Data was Exposed," USDA news release no. 0106.07, April 21, 2007
URL: http://www.usda.gov/wps/portal/!ut/p/_s.7_0_A/7_0_1OB?contentidonly=true&contentid=2007/04/0106.xml

"Statement from Gary D. Bass on Privacy Violation in Government Data ," OMB Watch, April 20, 2007
URL: http://www.ombwatch.org/article/articleview/3815/1/192?TopicID=5