Recommendations

Employment Development Department Its Practice of Mailing Documents Containing Social Security Numbers Puts Californians at Risk of Identity Theft March 2019 REPORT 2018‑129 CALIFORNIA STATE AUDITOR 621 Capitol Mall, Suite 1200 | Sacramento | CA | 95814 916.445.0255 | TTY 916.445.0033 For complaints of state employee misconduct, contact us through the Whistleblower Hotline: 1.800.952.5665 Don’t want to miss any of our reports? Subscribe to our email list at auditor.ca.gov For questions regarding the contents of this report, please contact Margarita Fernández, Chief of Public Affairs, at 916.445.0255 This report is also available online at www.auditor.ca.gov | Alternative format reports available upon request | Permission is granted to reproduce reports Elaine M. Howle State Auditor March 28, 2019 2018‑129 The Governor of California President pro Tempore of the Senate Speaker of the Assembly State Capitol Sacramento, California 95814 Dear Governor and Legislative Leaders: As requested by the Joint Legislative Audit Committee, the California State Auditor presents this audit report regarding the Employment Development Department’s (EDD) privacy protection practices when mailing documents to its customers. Based on our determination that EDD likely sent more than 17 million pieces of mail containing full Social Security numbers (SSNs) to a total of more than a million people in fiscal year 2017–18, this report concludes that EDD’s practice of including full SSNs on mail continues to put its customers at risk of identity theft. The recipients of these mailings are individuals who seek or receive benefits from two programs that EDD administers: the State’s Disability Insurance program (Disability) and Unemployment Insurance program (Unemployment). These programs provide wage replacement benefits to eligible workers who are unemployed, disabled, or caring for new children or ill family members (claimants). Some of EDD’s claimants and members of the Legislature have expressed concerns about EDD’s practice of mailing documents to claimants that contain SSNs, yet EDD still sends every Disability and Unemployment claimant documents containing full SSNs. Although EDD has undertaken efforts since 2015 to reduce the amount of mail it sends to claimants that include full SSNs, its efforts have been insufficient. Several of the security incidents that we reviewed from 2015 through 2018 showed that EDD exposed nearly 300 claimants to the risk of identity theft when it inappropriately disclosed their personal information, including SSNs, to other mail recipients. EDD intends to incorporate a unique identifier that will replace its need for printing full SSNs as part of its benefit systems modernization project (modernization project). However, EDD will not complete its modernization project—which includes replacing its aging IT infrastructure—any earlier than September 2024. At the time of our audit, EDD did not have a short-term plan for removing remaining SSNs from the high-volume documents that totaled more than 13 million mailings in fiscal year 2017–18. We believe that EDD needs to take near-term measures to better protect its claimants, and that it cannot wait to address these identity theft risks for the at least five and a half years it will take to complete its modernization project. To that end, we identify in this report interim solutions that EDD could implement to replace full SSNs on each of the types of documents we reviewed during our audit. Respectfully submitted, ELAINE M. HOWLE, CPA California State Auditor 621 Capitol Mall, Suite 1200 | Sacramento, CA 95814 | 916.445.0255 | 916.327.0019 fax | www.auditor.ca.gov iv California State Auditor Report 2018-129 March 2019 Blank page inserted for reproduction purposes only. California State Auditor Report 2018-129 v March 2019 Contents Summary 1 Introduction 5 Audit Results EDD Continues to Put Its Disability and Unemployment Claimants at Risk of Identity Theft by Printing SSNs on Mailed Documents 9 EDD Exposed Some Claimants’ Personal Information 11 EDD’s Reasons for Continuing to Print Full SSNs on Documents It Mails to Claimants Do Not Outweigh the Associated Risks 14 EDD Could Implement Interim Measures to Protect Claimants’ Privacy While Awaiting IT Modernization 15 EDD Has Not Offered Claimants an Alternative to Receiving Mailed Documents That Include SSNs 21 Recommendations 22 Appendix Scope and Methodology 25 Response to the Audit Employment Development Department 29 California State Auditor’s Comments on the Response From the Employment Development Department 31 vi California State Auditor Report 2018-129 March 2019 Blank page inserted for reproduction purposes only. California State Auditor Report 2018-129 1 March 2019 Summary Results in Brief Audit Highlights . . . Identity theft affects millions of Americans and costs billions Our audit regarding EDD’s privacy of dollars each year. For example, identity thieves can use other protection practices revealed the following: individuals’ Social Security numbers (SSNs) to fraudulently open financial accounts, obtain tax refunds, and amass medical bills. To » EDD sent its Disability and Unemployment combat the risk of identity theft, state agencies have an ongoing claimants more than 17 million pieces responsibility to protect Californians’ personal information, such as of mail containing full SSNs in fiscal their SSNs. The Employment Development Department (EDD) is year 2017–18. responsible for, among other things, the State’s Disability Insurance » Despite concerns about privacy protection program (Disability), which includes the Paid Family Leave from EDD’s claimants and members of program, and Unemployment Insurance program (Unemployment). the Legislature, EDD still sends every In administering these programs, EDD collects individuals’ personal Disability and Unemployment claimant information for a variety of purposes. Although EDD’s information documents containing full SSNs. security policies are generally consistent with federal and state requirements, EDD puts Californians at risk of identity theft » Since 2015 EDD has undertaken efforts when it mails documents containing SSNs to individuals who that have reduced the number of seek or receive benefits because they are unemployed, disabled, mailings that contain full SSNs that it or caring for new children or ill family members (claimants). Our sends to claimants, but those efforts have review determined that at least half of the mail Disability and been insufficient. Unemployment sent to claimants from EDD’s mailing facility in • It exposed nearly 300 claimants fiscal year 2017–18 included full SSNs. In that fiscal year alone, we to the risk of identity theft when estimate that EDD sent its claimants more than 17 million pieces of it inappropriately disclosed their mail that contained full SSNs. personal information—including SSNs—to others. EDD has undertaken efforts since 2015 that have reduced by at least 10 million the number of mailings that contain full SSNs that » EDD’s reasons for continuing to print full it sends annually to claimants, but its efforts have been insufficient SSNs on documents it mails to claimants to fully address privacy concerns. Several of the security incidents do not outweigh the risks. that we reviewed from 2015 through 2018 showed that EDD exposed nearly 300 claimants to the risk of identity theft when it » EDD intends to replace SSNs with a inappropriately disclosed their personal information—including unique identifier as part of its benefit SSNs—to others. Although the number of affected claimants we systems modernization project; however, identified is small relative to the millions of documents that EDD this project will take at least five and a mails to claimants, such disclosures could have a significant impact half years to complete. on those claimants if they were to become victims of identity theft. Members of the Legislature and some of EDD’s claimants have » Given the timeline for its benefit systems expressed concerns about EDD’s practice of mailing documents modernization project and the fact that that contain SSNs. Nonetheless, EDD still sends every Disability it does not offer claimants an alternative and Unemployment claimant documents that include full SSNs. to receiving mailed documents containing SSNs, EDD needs to take interim measures EDD has offered a number of reasons for including full SSNs on to better protect its claimants. documents that it mails to claimants, but these reasons do not outweigh the risks of identity theft when alternatives to using SSNs exist. EDD can lawfully print SSNs on documents it mails to claimants, and in limited instances it may be necessary for EDD to communicate with a claimant about that claimant’s SSN. 2 California State Auditor Report 2018-129 March 2019 However, we identified no federal or state law that expressly requires EDD to print SSNs on such documents. In fact, several federal agencies have initiated efforts to reduce their use of SSNs on mailed documents, including by replacing SSNs with alternative pieces of information that refer to only one person (unique identifiers). EDD management explained that EDD prints SSNs on documents that it mails to claimants to ensure that it can process those documents if it receives them back. Even so, EDD has included SSNs in these instances because of its own limitations: it has not yet implemented another method to guarantee that it can reliably locate claimants in certain information technology (IT) systems it uses. At the time of our audit, EDD did not have a short-term plan for removing remaining SSNs from the high-volume documents that we reviewed. Instead, it intends to incorporate a unique identifier as part of its benefit systems modernization project (modernization project)—which will fully replace its aging IT infrastructure with a unified system. This project will allow EDD to remove SSNs from these remaining documents. However, EDD’s planning documents and vendor responses to a December 2017 Request for Information indicate that EDD will not complete its modernization project any earlier than September 2024. In the interim five and a half years, EDD will likely continue to mail millions of documents annually that put claimants at risk of identity theft. Given the timeline for when EDD plans to complete its modernization project, we believe it needs to take interim measures to better protect its claimants. The tangible risk to claimants’ privacy, and the fact that EDD does not currently offer a means for claimants to opt out entirely from receiving mailed documents that contain SSNs, emphasize the need for EDD to take action in the near term. We identified possible solutions that EDD could use to replace full SSNs on each of the types of documents we reviewed. For example, one solution we proposed involves replacing full SSNs with a modified unique identifier. EDD management indicated that this solution would be the least disruptive to its existing systems, policies, and procedures, and that EDD supports this solution compared to the others we identified. Further, by implementing its recently developed plan for reviewing other types of personal information on new, revised, and existing documents, and eliminating any unnecessary uses of that information, EDD could ensure that it protects its claimants’ privacy. California State Auditor Report 2018-129 3 March 2019 Summary of Recommendations Legislature To better protect the Californians whom state agencies serve from the risk of identity theft, the Legislature should amend state law to require all state agencies to develop and implement plans to stop mailing documents that contain full SSNs to individuals by no later than December 2022, unless federal law requires the inclusion of full SSNs. To ensure that state agencies sufficiently prepare to implement this new law, the Legislature should also require that, by September 2019, they submit to it a report that identifies the extent to which they mail documents containing full SSNs to individuals. If any agency determines that it cannot reasonably meet the December 2022 deadline to stop including full SSNs on mailings to individuals, the Legislature should require that, starting in January 2023, the agency submit to it and post on the agency’s website an annual corrective action plan. Finally, if a state agency cannot remove or replace full SSNs that it includes on the documents it mails to individuals by January 2023, the Legislature should require the agency to provide access to and pay for identity theft monitoring for any individual to whom it mails documents containing SSNs. EDD To reduce the risk of identity theft for its claimants, EDD should, by December 2021, implement one or more of our proposed solutions or another viable solution to discontinue its use of full SSNs as unique identifiers on all documents that it mails to claimants. Further, it should prioritize addressing documents with the highest mail volumes and should make changes to those documents by March 2020. To ensure that it fully protects its claimants’ privacy, EDD should, by May 2019, implement its recently developed plan for reviewing new, revised, and existing documents. By December 2021, EDD should complete its full review of existing documents and remove any unnecessary instances of personal information. Agency Comments EDD agreed with our recommendations and indicated it would implement them. 4 California State Auditor Report 2018-129 March 2019 Blank page inserted for reproduction purposes only. California State Auditor Report 2018-129 5 March 2019 Introduction Background Californians have a right to privacy under state law and Types of Personal Information state agencies have a responsibility to protect personal Personal Information: Any information that identifies information that they use in the course of their work. or describes an individual such as an individual’s name, State law imposes specific requirements for the protection SSN, physical description, home address, home telephone of individuals’ information and declares that there number, education information, financial information, should be strict limits on the dissemination of personal medical history, and employment history. information. For instance, state law and policy require agencies to notify affected individuals if the agencies Notice-Triggering Information: A subcategory of personal information, it includes an individual’s first name or improperly disclose certain specified types of personal first initial and last name in combination with any of the information (notice-triggering information). Examples of following: SSN, driver’s license number, account numbers notice-triggering information include an individual’s first and codes that would permit access to financial accounts, name or first initial and last name in combination with a medical information, or health insurance information. Social Security number (SSN), a driver’s license number, a Source: State law and Statewide Information medical record, or other specified data. The text box lists Management Manual. the types of personal information that are defined under state law and further clarified under state policy. The Employment Development Department (EDD) collects personal information for a variety of administrative purposes. In addition to collecting payroll taxes for the State and assisting job seekers, EDD provides billions of dollars in partial wage replacement benefits each year to Californians who seek or receive such benefits and are unemployed, disabled, or caring for new children or ill family members (claimants). EDD collects claimants’ personal information—including SSNs, driver’s license numbers, and medical information—to verify that they are eligible for benefits and to fulfill other business needs and legal requirements. For instance, federal law requires states to use SSNs when verifying eligibility for unemployment insurance benefits. In addition, federal law requires states to administer their unemployment insurance programs in such a manner as to pay benefits promptly and properly and to enable the states to associate claimants’ records with their SSNs. In accordance with this directive, EDD requires claimants to provide their SSNs when they apply for benefits. EDD uses SSNs to administer unemployment insurance benefits by relying on SSNs to associate claimants with their wages, which determine the benefits that claimants receive. The Use of SSNs Increases the Risk of Identity Theft The use of SSNs poses an innate risk of identity theft, which affects millions of Americans and costs billions of dollars each year. Because the Social Security Administration assigns each individual a unique SSN, it is an effective piece of information that refers to only one person (unique identifier). Many organizations use SSNs as unique identifiers to reference individuals for administrative purposes and for communication with 6 California State Auditor Report 2018-129 March 2019 other organizations. Consequently, the State’s Office of the Attorney General and other entities have declared that SSNs are the key to identity theft. Identity thieves can use other individuals’ SSNs to fraudulently open financial accounts, obtain tax refunds, and amass medical bills. Identity thieves can gain access to SSNs using a variety of methods, including by breaching data systems and perpetrating Internet scams. Identity thieves can also access SSNs by stealing physical documents, such as mail. For example, thieves can take documents with SSNs from other individuals’ mailboxes, can receive mail that senders incorrectly address, and can obtain mail from trash receptacles after recipients discard it. In 2003 a Federal Trade Commission (FTC) survey reported that stolen mail was the cause of identity theft for 4 percent of all victims, which at that time totaled 400,000 individuals. However, a 2008 FTC report states that it is difficult to know how often identity theft is caused by mail theft or another method, largely because identity theft victims frequently do not know how their information was compromised. To address the risks of identity theft, several federal agencies have initiated efforts to reduce the number of mailings that unnecessarily contain full SSNs. As early as 2007, the President’s Identity Theft Task Force sought to reduce governmental use of SSNs on mailed documents. It noted that some entities had already made progress in this area—for instance, the Veterans Health Administration stopped printing SSNs on its identification cards in 2004—but concluded that more must be done to eliminate unnecessary uses of SSNs. To this end, a 2015 law prohibited federal and state agencies from printing SSNs on any checks they issued for payment. More recently, a 2017 law required certain federal agencies, including the Department of Labor, the Social Security Administration, and the Internal Revenue Service (IRS), to develop plans to eliminate unnecessary mailings of SSNs and to report to Congress on all mailed documents still containing full SSNs. In response, the Social Security Administration reported in 2017 that it had replaced full SSNs with truncated SSNs—displaying only the last four digits—or with other unique identifiers on two of its highest-volume notices, and that it planned to replace full SSNs on additional documents it mails millions of times. In addition, the IRS stated that it had either truncated or completely removed SSNs on notices that it sent nearly 50 million times by mail in fiscal year 2015–16. EDD Mails Millions of Documents Each Year EDD mails millions of documents each year to send or request information related to four of its programs: Disability Insurance (Disability), which includes the Paid Family Leave program; Unemployment Insurance (Unemployment); Tax; and Workforce Services.1 1 For the purposes of this report, we use documents to refer to physical versions of any correspondence, letters, or other communications. California State Auditor Report 2018-129 7 March 2019 Disability and Unemployment together processed claims for a total of more than a million claimants in 2017 and accounted for most of EDD’s outgoing mail in fiscal year 2017–18. Figure 1 details the volumes of mail that each of EDD’s programs sent from its central printing and mass mailing facility (mailing facility) in fiscal year 2017–18. Although Disability and Unemployment have more than 40 field offices that also mail documents, about 93 percent of the two programs’ total postage costs were from the mailing facility in fiscal year 2017–18. Figure 1 Disability and Unemployment Sent More Than 37 Million Documents From EDD’s Mailing Facility in Fiscal Year 2017–18 44.5 MILLION TOTAL MAILS VOLUME OF DOCUMENTS DOCUMENTS PRIMARILY TO: MAILED $ UNEMPLOYMENT Administers the Unemployment Insurance program, 25.5 which pays wage replacement benefits to workers who have lost their jobs and meet the program's MILLION eligibility requirements. CLAIMANTS DISABILITY $ Operates the Disability Insurance and Paid Family 12.2 Leave programs. These programs generally pay wage replacement benefits to eligible workers who need MILLION time off because of illnesses, injuries, or pregnancies, or to care for new children or ill family members. CLAIMANTS TAX Administers the collection, accounting, 5.1 and auditing of certain payroll taxes. MILLION EMPLOYERS WORKFORCE SERVICES 1.7 Offers public employment services that prepare Californians for participation in the workforce MILLION and connect job seekers with employers. EMPLOYERS AND JOB SEEKERS Source: EDD program descriptions and mailing facility volumes. 8 California State Auditor Report 2018-129 March 2019 As Figure 1 shows, Disability and Unemployment mail documents primarily to claimants, whereas EDD’s Tax and Workforce Services programs mail documents primarily to employers and job seekers. EDD sends all Disability and Unemployment claimants documents in the mail. EDD sends claimants documents with general information and other documents with personal information, which may include SSNs. Some of these documents require responses from claimants: for example, EDD mails a form that claimants use to verify that they are eligible for benefits. EDD also sends notices that provide information to claimants but do not always require responses: for instance, it mails a notice with claimants’ wages and pending benefit amounts and requests that claimants contact EDD if they identify inaccuracies. In addition, the four EDD programs we discuss earlier include SSNs on certain documents that they mail to employers or other third parties, generally to ensure that those entities can accurately identify the referenced individuals. However, this report focuses on documents containing personal information that EDD mails to Disability and Unemployment claimants, and specifically on documents that contain or previously contained SSNs. The information technology (IT) systems that EDD uses to handle its claims and generate its mailings are disparate, complex, and based on antiquated technology. These systems automatically generate mailings to claimants, and because of the systems’ technological limitations, altering physical documents that EDD sends to claimants requires significant IT programming effort and resources. EDD plans to replace and unify these aging systems through its benefit systems modernization project (modernization project), which includes both the Disability and Unemployment systems. California State Auditor Report 2018-129 9 March 2019 Audit Results EDD Continues to Put Its Disability and Unemployment Claimants at Risk of Identity Theft by Printing SSNs on Mailed Documents State entities have a responsibility to protect personal information, but EDD continues to put some Californians at risk of identity theft by mailing documents to claimants that include their full SSNs. As we note in the Introduction, state law protects individuals’ right to privacy and declares that there should be strict limits on the dissemination of personal information. EDD’s information security policies for its staff and data systems are generally consistent with federal and state requirements. For example, one of EDD’s information security and privacy policies allows system access only to staff who have signed confidentiality statements and received information security and privacy awareness training. However, we have concerns about EDD’s practice of mailing documents containing SSNs to individuals because doing so puts those individuals at risk of identity theft. State law allows EDD to print SSNs on mailed documents under certain circumstances. Further, in limited instances it may be necessary for EDD to communicate with a claimant specifically about the claimant’s SSN. Nonetheless, we identified no federal or state law that expressly requires EDD to print SSNs on documents that it mails to claimants. During our audit period of 2015 through 2018, EDD mailed millions of documents annually to claimants that included their full SSNs. Our review determined that at least half of the mail pieces Disability and Unemployment sent to claimants from EDD’s mailing facility in fiscal year 2017–18 included full SSNs. Although EDD sends hundreds of different types of documents, we reviewed 21 forms and notices that together accounted for more than 70 percent of the metered mail that Disability and Unemployment sent to claimants from EDD’s mailing facility in fiscal year 2017–18. The forms and notices included documents that EDD used to notify claimants of their potential benefit awards, to collect on benefit overpayments, and to verify that claimants were still eligible for benefits. The 21 documents all contained personal information, and 14—including 11 high-volume documents—contained full SSNs. Based on these high-volume documents alone, we estimate that EDD sent more than 17 million pieces of mail containing full SSNs in fiscal year 2017–18. Because EDD may send a single claimant multiple pieces of mail that include SSNs, EDD likely sent these 17 million pieces of mail containing SSNs to a total of more than a million Disability and Unemployment claimants. In response to legislative concerns regarding its use of SSNs, EDD has undertaken efforts since 2015 that have reduced the amount of mail containing full SSNs that it sends annually to claimants by 10 California State Auditor Report 2018-129 March 2019 at least 10 million pieces of mail, as Figure 2 shows. Specifically, following a letter from an assemblymember in July 2015 that urged EDD to redact SSNs from mailed correspondence, EDD reviewed its documents and removed SSNs when it determined it could do so without impacting program efficiency or without first creating a unique identifier to replace the SSNs. For example, EDD removed some SSNs from one high-volume document that we reviewed, and it also removed SSNs from other forms and notices, according to documents that EDD management provided. After another legislator’s office contacted EDD in late 2017, EDD reevaluated its documents in early 2018 and removed SSNs from some additional documents, including one notice it mails when it processes electronic payments for Disability claimants. Figure 2 EDD Removed SSNs From Certain Documents That It Mails Millions of Times Each Year, But Its Claimants Are Still at Risk of Identity Theft 25 DID NOT 20 REMOVE SSNs 13 MILLION— DID NOT REMOVED 15 Continuing risk REMOVE SOME BUT of identity theft SSNs NOT ALL SSNs 10 4 MILLION— Removed some SSNs in 2018 and all SSNs in REMOVED 5 January 2019 SOME BUT REMOVED 6 NOT ALL ALL MILLION SSNs SSNs 0 2015 THROUGH 2017 2018 OR LATER ANNUAL MAIL VOLUMES FOR A SELECTION OF HIGHVOLUME DOCUMENTS THAT EDD MAILS TO CLAIMANTS* STNEMUCOD FO EMULOV SNOILLIM NI DELIAM Source: EDD’s mailing facility reported volumes, analysis of EDD’s timelines and the efforts it made to remove full SSNs from its documents, and interviews with EDD staff. * Volumes are for documents that EDD reported sending from its mailing facility in fiscal year 2017-18. The volumes above are based on our selection of 21 Disability and Unemployment documents. California State Auditor Report 2018-129 11 March 2019 EDD missed an opportunity in 2015 to remove SSNs from at least one high-volume document from which it subsequently removed SSNs in its later efforts. EDD’s goal in 2015 was to conduct a full inventory of documents with SSNs and remove SSNs wherever possible, according to the deputy director of EDD’s Policy, Accountability, and Compliance Branch. However, an EDD administrator initiated an IT service request to remove SSNs from a high-volume document in 2015 that EDD did not change until 2018. Even then, EDD removed SSNs from only two of the three locations where they appeared on that document: EDD replaced the final SSN with a program-specific unique identifier in January 2019. EDD management indicated that EDD did not remove SSNs from that document in 2015 because the document was already scheduled to be changed in conjunction with an enhancement project for one of EDD’s systems, and that EDD decided to remove SSNs from the document in 2018 due to delays associated with the enhancement project. Nevertheless, EDD mailed the document with full SSNs more than four million times annually from fiscal years 2015–16 through 2017–18. Despite its efforts to remove SSNs Despite its efforts to remove SSNs from mailed documents, EDD from mailed documents, EDD has has continued to put its claimants at risk of identity theft, and continued to put its claimants at claimants have expressed concerns with EDD’s inclusion of SSNs on risk of identity theft, and claimants documents. EDD could not provide a precise number of claimants have expressed concerns with EDD’s who have raised concerns about SSNs on its documents because inclusion of SSNs on documents. of limitations of its data, but we identified 50 such complaints that claimants made through EDD’s website from 2015 through October 2018. We include a selection of these complaints in Figure 3 on the following page, along with EDD’s responses to the complaints. Although EDD reduced the amount of mail it sends that includes SSNs, its efforts did not decrease the number of Disability and Unemployment claimants who receive that mail: EDD still mails every Disability and Unemployment claimant documents containing full SSNs. Further, EDD has continued to send millions of mailings each year that contain SSNs. Until EDD discontinues its use of full SSNs as unique identifiers on documents that it mails to claimants, it will not have fully responded to legislative concerns and its claimants’ concerns, or addressed the risk that it may inappropriately disclose claimants’ information. EDD Exposed Some Claimants’ Personal Information Several of the security incident reports that we reviewed from 2015 through 2018 showed that EDD exposed nearly 300 claimants to the risk of identity theft when it inappropriately disclosed their notice-triggering information—including SSNs—to others. Although the number of affected claimants that we identified is 12 California State Auditor Report 2018-129 March 2019 Figure 3 Claimants Have Expressed Concerns to EDD About Its Inclusion of SSNs on Documents It Mails CLAIMANT CONCERN RESPONSE TO: EDD May 8, 2016 FROM: EDD May 9, 2016 “The twice monthly electronic benefit payment notifications “Thank you for submitting your question. The EDD is currently in the process of reviewing that I receive through US mail has my FULL SSN number listed how to replace the Social Security Number (SSN) on Unemployment Insurance (UI) forms twice! My mail often goes to the wrong location and I do not with an alternative unique customer account number for reference. However, the EDD want this sensitive information sent through the mail. Can legally is authorized to use SSNs to administer the UI Program. The EDD does have you please x-out/remove my SSN number on this statement safeguards in place to ensure individuals' personal confidential information is protected. or send it to me electronically without the SSN number? With Thank you again for your inquiry." the degree of identify theft occurring today, it is extremely concerning to me that my entire SSN number is listed on these mailed documents. I have attempted to call numerous times to discuss this with someone but cannot get through. Your assistance is greatly appreciated.” CLAIMANT CONCERN RESPONSE TO: EDD July 10, 2017 FROM: EDD July 10, 2017 "I received a determination letter from EDD in regards to my "Thank you for submitting your question. The EDD is currently in the process of reviewing how paid family leave claim. That letter included my complete to replace the Social Security Number (SSN) on Unemployment Insurance (UI) forms with an social security number on it. Why is this necessary? Why not alternative unique customer account number for reference. However, the EDD legally is just the last 4 digits of my social? What if this letter gets "lost" authorized to use SSNs to administer the UI Program. The EDD does have safeguards in place in the mail? These letters have my address and SSN on them. I to ensure individuals' personal confidential information is protected. Thank you again for have seen other EDD letters that only show the last your inquiry." 4 digits of the social. Why it did not happen on this particular determination letter, I do not know. Please see that this gets corrected immediately as I feel it is a breach of privacy." CLAIMANT CONCERN RESPONSE TO: EDD August 12, 2018 FROM: EDD August 13, 2018 "I have received few documents recently from EDD by mail "SSN Concerns: The Employment Development Department understands your privacy and noted that every document has full display of my Social concern. However, the Unemployment Compensation law is a part of the federal Social Security Number (SSN) printed on the paper. With concern of Security Act. Under this act, the unemployment insurance program is based on employment identification theft especially in mail and for protection of my payroll taxes paid by employers and wages paid to their employees. CA employers are identification safety, I hereby request EDD to not have my SSN required to report their employees' quarterly payroll wages under the social security number in full print or best not print at all for any hard copy document (SSN). Similarly, Disability Insurance claims utilize SSN's. All unemployment and disability mailed to me. In advance, thank you very much for your insurance processes and processing are based on the use of the SSN. EDD also uses a non-SSN understanding of my concern and request herein." 9-digit number with the current State Disability Insurance Online (SDIO) program and will convert to a similar feature for the upcoming release of the online California Unemployment Benefits Services (CUBS) program. SSN's may continue to be used with printed forms that are returned to EDD for automated document scanning purposes. The EDD strives to ensure the privacy and protection of individuals' SSNs. The EDD also notifies individuals if we believe their SSN may have been compromised in any way due to a handling, processing or mailing error. Thank you for your inquiry." Source: Examination of complaints from EDD’s database of electronic communications with claimants. California State Auditor Report 2018-129 13 March 2019 small relative to the millions of documents that EDD mails to claimants, such disclosures could have a significant impact on those affected claimants if they were to become victims of identity theft. A bulletin from the U.S. Department of Justice indicated that an individual who suffers from identity theft could experience out of pocket financial losses and emotional distress—additional burdens for those who may already be facing financial hardship due to disability or unemployment. As EDD itself includes in the notification letters it sends to claimants when it compromises their personal information: the disclosure of this information poses a possible risk of identity theft. EDD’s notification letters also identify steps that claimants can take immediately to protect their identities, such as reporting the potential identity thefts to all three of the major credit bureaus. According to the deputy director of EDD’s Policy, Accountability, and Compliance Branch, EDD is not aware of these incidents resulting in the theft of any claimant’s identity. Nevertheless, these security incidents demonstrate how mailing documents containing SSNs poses a tangible risk to claimants. In two of those security incidents, EDD inappropriately disclosed a In two security incidents, EDD total of more than 100 claimants’ personal information, including inappropriately disclosed a total of SSNs, to other individuals because of problems at its mailing facility. more than 100 claimants’ personal The first incident occurred in September 2015 when EDD believed information, including SSNs, that it included multiple claimants’ documents in envelopes that to other individuals because of it sent to other claimants. EDD staff discovered the error when a problems at its mailing facility. machine operator completing the second portion of the print job determined that 33 documents were unaccounted for. Because EDD was unable to determine whose information it inappropriately disclosed, its security incident report shows that EDD notified more than 3,800 claimants that their SSNs and other personal information might have been compromised. The second incident occurred in April 2016 and involved the mailing facility printing double-sided documents that it should have printed single-sided. EDD assumes that more than 90 claimants received the full name, mailing address, and SSN of other claimants printed on the reverse side of their own documents. The report describing this incident indicates that EDD sent 188 letters notifying claimants of the printing error. In other incidents that we reviewed, EDD disclosed the SSNs and other personal information of more than 150 claimants. The single incident affecting the most individuals occurred in April 2015 when an EDD staff member inadvertently sent three bundles of Disability claim documents intended for the document and information management center to the home of a former employee. In responding to this specific incident, EDD sent 112 notification letters to claimants indicating that it released information that may have included full names, addresses, driver’s license or California identification numbers, SSNs, phone numbers, employer names, and medical or health insurance information. Other incidents 14 California State Auditor Report 2018-129 March 2019 that we reviewed involved fewer disclosures and occurred due to human error, such as incorrectly inputting information in EDD’s IT systems. For example, in October 2017, an EDD staff member was working on two different sessions in one of EDD’s systems and unintentionally entered data on the wrong claim. The error led EDD to send a document with a claimant’s full name and SSN to an unauthorized recipient. We obtained evidence as recent as March 2018 demonstrating that staff have continued to incorrectly enter claimant information into EDD’s systems, causing exposure of claimants’ personal information to others. EDD’s Reasons for Continuing to Print Full SSNs on Documents It Mails to Claimants Do Not Outweigh the Associated Risks EDD has offered a number of reasons for including full SSNs on documents that it mails to claimants, but these reasons do not outweigh the risks of identity theft when alternatives to using SSNs exist. For instance, EDD referenced legal requirements to justify its inclusion of SSNs on mailed documents. Federal law requires states to use SSNs when verifying eligibility for unemployment insurance benefits. In addition, federal law requires EDD to administer Unemployment in such a manner as to pay benefits promptly and properly and to enable it to associate claimants’ records with their SSNs. Federal law also requires EDD to include sufficient information in certain notices to claimants to enable those claimants to understand EDD’s determinations and its reasons for denying or approving benefits. Further, although state law generally prohibits mailing SSNs to individuals, it allows EDD to mail SSNs when state or federal law requires it to do so or to include SSNs in applications and forms to verify the accuracy of an SSN or to establish, amend, or terminate an enrollment process or account. However, while we understand that in limited instances it may be necessary for EDD to communicate with a claimant specifically about that claimant’s We identified no federal or state law SSN, none of these laws expressly require that EDD print SSNs on that expressly requires EDD to print documents that it mails to claimants. In fact, several federal agencies SSNs on documents that it mails have established specific practices to reduce or eliminate using SSNs, to claimants. as we discuss in the Introduction. The chief of Unemployment’s Policy and Integrity Section (Unemployment section chief) explained that EDD prints SSNs on documents that it mails to claimants to ensure that it can process those documents if it receives them back. For instance, after claimants return certain forms to EDD, one of its systems scans the forms’ SSNs to issue automated benefit payments or to provide other appropriate services. These forms accounted for at least seven million mailings to claimants that contained full SSNs in fiscal year 2017–18. EDD also takes specific actions when it has been unable to deliver certain documents, and it relies upon California State Auditor Report 2018-129 15 March 2019 SSNs to take those actions because of the limitations of its current systems. For example, one of Unemployment’s notices informs claimants of their ineligibility for benefits and their right to appeal EDD’s determination. If the postal service returns that document to EDD as undeliverable, Unemployment uses the SSN to locate the corresponding claim in its systems and record the document as undelivered so it can attempt to reissue the document. According to the Unemployment section chief, this ensures the claimant’s access to due process and ability to appeal. However, EDD has included SSNs in these instances because of its own limitations: it has not EDD relies upon SSNs in specific yet implemented another method to guarantee that it can reliably instances because it has not yet locate claimants in certain systems it uses. As we discuss later, we implemented another method to found other methods that EDD could use for this purpose instead guarantee that it can reliably locate of printing full SSNs on documents it mails to claimants. claimants in certain systems it uses. Disability and Unemployment division chiefs also stated that including SSNs on certain documents allows claimants to verify the accuracy of their SSNs, but printing SSNs on these documents for verification purposes is redundant. Disability and Unemployment claimants provide their SSNs to EDD when they apply for benefits, and EDD then mails the claimants to verify that it correctly received and processed their SSNs. Of the 11 high-volume documents with full SSNs that we reviewed, three were documents on which EDD asked claimants to verify the accuracy of their SSNs. However, EDD already uses other methods to ensure that claimants’ SSNs are accurate. Unemployment verifies SSNs with the Social Security Administration before asking claimants to verify the same SSNs on mailed documents, and both Disability and Unemployment have procedures to request supporting documentation from claimants if they need to further verify claimants’ SSNs. Moreover, EDD already sends Disability and Unemployment claimants documents that include their wages—the basis for the amount of benefits they receive—to help ensure that EDD has processed their information correctly. Other state workforce agencies have taken advantage of this logic: Washington’s Employment Security Department includes wages but not SSNs on the verification notice it mails to claimants, and the Texas Workforce Commission verifies wages and uses truncated SSNs on documents that it mails to claimants. EDD Could Implement Interim Measures to Protect Claimants’ Privacy While Awaiting IT Modernization As we previously describe, EDD removed SSNs in January 2019 from a document that it mails about four million times each year. However, EDD does not currently have a short-term plan for removing SSNs from the other high-volume documents that we reviewed, which it mailed at least 13 million times in fiscal year 2017–18. Rather, it intends to incorporate a unique identifier 16 California State Auditor Report 2018-129 March 2019 as part of its modernization project, and this will allow it to remove SSNs from these remaining documents, according to EDD’s planning documents and its modernization project director. Nevertheless, EDD’s planning documents and vendor responses to a December 2017 Request for Information indicate that EDD will not complete the modernization project before September 2024— at least another five and a half years. Disability and Unemployment management assert that EDD does not plan to implement any interim solutions to remove SSNs from the high-volume documents that we reviewed, but we identified a number of different actions it could take to ensure that it protects claimants’ privacy in the short term. EDD considered replacing SSNs in its existing systems with an alternative unique identifier, but it sought approval for the modernization project instead because it believed its current systems were not fiscally sustainable beyond 2020. According to the IT branch deputy director, the modernization project—which will require fully replacing EDD’s aging IT infrastructure with a unified system—is EDD’s preferred solution for implementing an alternative unique identifier. The IT branch deputy director asserted that incorporating a unique identifier into EDD’s current systems would significantly delay its ability to make progress with its modernization project. She further stated that under the current systems, altering the documents that EDD sends to claimants requires significant programming effort. EDD’s current plan for implementing EDD’s current plan for implementing the modernization project the modernization project will will enable it to replace SSNs on mailed documents, but it will enable it to replace SSNs on mailed also delay removing SSNs from the high-volume documents documents, but it will also delay that we reviewed for several years. According to the IT branch removing SSNs from high‑volume deputy director, EDD cannot provide a precise timeline for the documents until at least implementation of the modernization project because the project is September 2024. in its nascent, planning stages. To improve the success of the State’s IT projects, state policy generally requires agencies to participate in a project approval lifecycle that the California Department of Technology (Technology) established. EDD’s planning documents for the modernization project show that EDD began early market research in support of the first stage of a project approval lifecycle in fiscal year 2015–16. It has since hired staff, diverted resources, and obtained approval for two budget change proposals of more than $4 million each to support its planning effort. EDD’s planning documents dated January 2017 further show that EDD proposed a total planning cost of $47.3 million for the project. Based on its most recent planning documents, EDD anticipates that it will award a contract to begin building and implementing the modernization project in September 2022, as we show in Figure 4. EDD’s most recent planning documents and vendor responses to its December 2017 Request for Information indicate that it California State Auditor Report 2018-129 17 March 2019 will not fully implement the modernization project until at least September 2024. However, historically, it has not been uncommon for state IT projects to take longer than expected to complete. Figure 4 EDD’s Modernization Project Will Take Years to Implement While Claimants’ SSNs Remain Vulnerable February 2016 EDD began market research for its modernization project. December 2016 EDD completed its business analysis. September 2018 EDD received approval of its analysis of alternatives from Technology. June 2020* EDD expects to complete detailed development plans for its preferred solution. September 2022* EDD anticipates starting project implementation; it September 2024 plans to award a contract to Vendor estimates for earliest begin building and implementation of EDD’s implementing the project. modernization project. 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 BASED ON THE FISCAL YEAR 201718 MAILING RATE OF 13 MILLION PER YEAR EDD COULD SEND APPROXIMATELY 70 MILLION MORE DOCUMENTS CONTAINING SSNs DURING THIS TIME FRAME Source: Analysis of EDD’s modernization project planning documents, other information provided by EDD, and EDD’s mailing facility volumes. * EDD provided this estimated date in September 2018. 18 California State Auditor Report 2018-129 March 2019 Given the timeline for when EDD plans to complete its modernization project, we believe an interim solution to remove or replace SSNs on its remaining documents is warranted: the inappropriate disclosure of claimant information that we previously discuss demonstrates the tangible risk to claimants’ privacy We identified possible interim if it does not act sooner. We identified possible solutions that solutions that EDD could use to EDD could use to replace full SSNs on each of the documents replace full SSNs on each of the that we reviewed. Figure 5 highlights these solutions and EDD’s documents that we reviewed. estimates of the costs and time needed to implement them. EDD’s estimates indicate that each solution in Figure 5 would take two to four years with costs ranging from $2.9 million to $26.3 million to implement. We did not audit EDD’s estimates for implementing the solutions we proposed, but those estimates indicate that it could implement these solutions before it completes its modernization project. We asked EDD to confirm that it may be able to replace SSNs on certain high-volume documents even earlier than its overall estimates suggest—such as by prioritizing three documents that accounted for nearly 10 million of the 13 million mailings that we mention earlier. In response, an IT branch division chief indicated that there are many variables associated with programming, testing, and production, and that it was too early to determine an implementation approach for the documents. Nevertheless, we believe that EDD should strongly consider prioritizing changes to its highest-volume documents to more quickly minimize the risk of disclosing personal information belonging to the claimants it serves. The IT branch deputy director expressed concerns about the limited funding and resources available to implement our proposed solutions, given the volume of projects and the competing priorities and requirements that EDD handles. Even so, the IT branch deputy director said that EDD undertook certain efforts in 2015 and 2018 to reduce its use of SSNs on mailed documents without requesting additional funding from the Legislature. The deputy director provided estimates that attribute roughly $1.5 million in IT costs to those efforts. EDD should assess the costs and benefits of implementing one or more of the solutions that Figure 5 describes, and it should determine whether it needs to request additional funding to do so. One of the solutions we proposed involves replacing full SSNs with a modified unique identifier. This solution could address the high-volume documents that we reviewed that still contain full SSNs. Further, EDD management stated that of the solutions we proposed, this option would be the least disruptive to its existing automated systems, policies, and program procedures. They indicated that EDD supports this proposed solution compared to the others we identified. California State Auditor Report 2018-129 19 March 2019 Figure 5 EDD Could Take Interim Actions to Replace Remaining SSNs on Its High-Volume Documents EDD ESTIMATES COST TIME PROPOSED ACTION 01 MODIFIED IDENTIFIER $3.4 2 YEARS Replace full SSNs with a modified unique identifier. MILLION 2 MONTHS PAPERLESS COMMUNICATIONS $2.9 3 YEARS 02 Provide claimants the option to receive documents MILLION 3 MONTHS online instead of by paper mail. TRUNCATION* $4.2 4 YEARS 03 #### Truncate full SSNs and enhance system search functionality † 3 MONTHS to include other key information, such as partial addresses MILLION and the last four digits of SSNs. OTHER IDENTIFIER $26.3 3 YEARS 04 Replace full SSNs with another unique identifier. MILLION 8 MONTHS Source: Analysis of EDD documents, estimated costs and timelines that EDD provided, and interviews with key EDD staff. Notes: The costs and timelines are based on the high- volume Disability and Unemployment documents that we reviewed. EDD provided the estimates of costs and timelines. EDD stated that its estimates include costs associated with Technology’s project approval lifecycle requirements and that implementation costs for some options could be lower if Technology opts to waive the project approval lifecycle requirements or delegate the solutions to EDD for management oversight. Because of the sensitive nature of one of these solutions, we provided EDD an explanation of how it could implement the proposed solution in a separate confidential management letter. * This solution would likely provide only partial coverage—roughly 43 percent—of the 13 million documents containing SSNs that we discuss in the Audit Results. † According to an IT branch division chief, the overall time to implement this solution may be shorter because EDD could potentially overlap some technical changes involved in both truncating SSNs and enhancing system search functionality. 20 California State Auditor Report 2018-129 March 2019 EDD did express concerns about one of the other solutions that we proposed. This solution involves truncating SSNs on certain documents that EDD mails to claimants, as well as enhancing search functionality in some of its systems. Some of EDD’s systems currently allow staff to search for claims using names, full addresses, and full SSNs, but this solution would allow EDD to process documents using partial identifying information such as the last four digits of claimants’ SSNs. The Unemployment section chief stated that EDD would not be able to guarantee it could match each piece of undelivered mail with a specific claim using this solution and that processing claims using truncated SSNs would take longer because staff would need to use additional search functions. According to the Unemployment section chief, Unemployment’s workload is such that even a one-minute delay in processing a claim can affect its ability to provide timely benefit payments. However, EDD could not quantify how often it might encounter multiple claimants with the same information, and it did not provide specific time or cost estimates for staff to add names and partial addresses to their searches. The Unemployment section chief also stated that Unemployment does not track the amount of undelivered mail that it receives back. Further, at least one other state’s workforce agency stated that it prints truncated SSNs on all documents requiring an SSN field that it mails to claimants, and that it locates claims using information such as names, addresses, and truncated SSNs. In addition to the high-volume documents that we reviewed, we identified low-volume documents that EDD mails to claimants that include full SSNs. EDD does not mail large quantities of these documents; however, these documents still create a risk of identity After EDD addresses its high‑volume theft. After EDD addresses its high-volume documents, it should documents, it should evaluate the evaluate the extent to which it can also replace full SSNs on these extent to which it can also replace other documents. EDD’s estimates of the costs and time needed to full SSNs on other documents. implement the solutions in Figure 5 are based on only a selection of documents, but those solutions can apply to other documents that EDD mails to claimants that contain full SSNs, including its low-volume documents. We also identified several types of personal information other than full SSNs that EDD has mailed to claimants, including phone numbers, employment histories, and dates of medical treatments. As we note in the Introduction, state law declares that the maintenance and dissemination of personal information should be subject to strict limits and also requires that agencies maintain only personal information that is relevant and necessary to accomplish specific required or authorized purposes. EDD has a policy to limit its collection of personal information and protect the personal information it collects and maintains, which it uses for purposes such as determining claimants’ eligibility for benefits, conducting California State Auditor Report 2018-129 21 March 2019 fraud prevention activities, and reporting information to federal EDD’s 2015 and 2018 efforts to entities. However, EDD’s 2015 and 2018 efforts to remove SSNs remove SSNs from its documents from its documents did not evaluate the necessity of collecting and did not evaluate the necessity of disseminating other types of personal information. collecting and disseminating other types of personal information. More recently, EDD has taken steps to formalize its processes for reviewing documents that contain personal information. In late 2018, EDD established a committee initially consisting of representatives from its director’s office and certain branches to oversee its use of personal information on its documents. The committee’s guidelines describe steps the committee can take to limit EDD’s inclusion of personal information on its mailings. Although the guidelines currently state that the committee will meet as necessary to review new or revised documents only, EDD provided us with a meeting agenda from February 2019 that incorporates the guidelines into a recently developed plan to review all existing documents. The plan includes prioritizing high-volume documents and documents that contain personal information. EDD should implement its plan for reviewing new, revised, and existing documents to ensure it eliminates any unnecessary uses of personal information and fully protects its claimants’ privacy. EDD Has Not Offered Claimants an Alternative to Receiving Mailed Documents That Include SSNs Absent interim action, EDD’s claimants have no other option but to receive at least some mailed documents containing SSNs. EDD documents indicate that it implemented partial online claimant self-service functionality for its Disability system in 2012, and its Unemployment system in 2015. Collectively, the online systems allow some claimants to file claims, access claim information, manage their accounts, and specify a preference for electronic or hard copy communication. Neither online system, however, allows claimants to opt out entirely from receiving mailed documents— many with full SSNs—even if the claimants indicate a preference for electronic communication. EDD’s records show that in late 2018, about half of the nearly 1.7 million users who had registered to use the online Disability or Unemployment systems indicated their preference to receive emails from EDD. Nevertheless, EDD includes disclaimers on its website indicating that claimants will still receive some documents through the mail. The online systems allow claimants to receive certain documents electronically. For instance, Unemployment’s system allows claimants to file online the continued claims form—a high-volume document that EDD requires Unemployment claimants to submit every two weeks to certify for continued claim benefits. In fact, shortly after implementing the system, EDD documents mention 22 California State Auditor Report 2018-129 March 2019 that EDD changed the system default to electronic certification of continued claim benefits for all new registered users. The implementation of the online system has therefore reduced the amount of continued claim forms that EDD mails to claimants, and EDD asserts that claimants increasingly use its electronic certification channels. In addition, the chief of Disability’s Central Office Division stated that EDD intends to provide a paperless communication option for additional documents, including one high-volume document that contains an SSN. However, because other documents that EDD sends to claimants are not available online, it continues to mail claimants documents that contain SSNs. The option to indicate a preference for online communication has led some claimants to express confusion about the capability of EDD’s online systems to fully replace mailed documents. In our review of complaint data, we found that EDD received complaints from claimants who were concerned about receiving mailed documents even though they had selected a preference for electronic communication. It appears that some of these claimants believed that they could opt out entirely from receiving mailed documents. State law does require EDD to either mail or personally serve certain documents to claimants, but it is not always necessary for EDD to print SSNs on those documents when it mails them to claimants. The fact that EDD does not currently offer a means for claimants to opt out entirely from receiving mailed documents, which could help minimize unauthorized disclosures of personal information in mailed documents, points to the need for EDD to take additional action in the near term to reduce the risk of inappropriately disclosing SSNs. Recommendations Legislature Because other state agencies may mail full SSNs to Californians, and because this practice—regardless of the agency involved— exposes individuals to the risk of identity theft, the Legislature should amend state law to require all state agencies to develop and implement plans to stop mailing documents that contain full SSNs to individuals by no later than December 2022, unless federal law requires the inclusion of full SSNs. To ensure that state agencies sufficiently prepare to implement this new law, the Legislature should also require that, by September 2019, they submit to it a report that identifies the extent to which their departments mail any documents containing full SSNs to individuals. California State Auditor Report 2018-129 23 March 2019 If any agency determines that it cannot reasonably meet the December 2022 deadline to stop including full SSNs on mailings to individuals, the Legislature should require that, starting in January 2023, the agency submit to it and post on the agency’s website an annual corrective action plan that contains, at a minimum, the following information: • The steps it has taken to stop including full SSNs on mailed documents. • The number of documents from which it has successfully removed full SSNs and the approximate mailing volume that corresponds to those documents. • The remaining steps that it plans to take to remove or replace full SSNs it includes on mailed documents. • The number of documents and approximate mailing volume that it has yet to address. • The expected date by which it will stop mailing documents that contain full SSNs to individuals. Finally, if a state agency cannot remove or replace full SSNs that it includes on documents that it mails to individuals by January 2023, the Legislature should require the agency to provide access to and pay for identity theft monitoring for any individual to whom it mails documents containing SSNs. EDD To reduce the risk of identity theft for its claimants before it completes its modernization project, EDD should, by December 2021, implement one or more of our proposed solutions or another viable solution to discontinue its use of full SSNs as unique identifiers on all documents that it mails to claimants. Further, it should prioritize addressing documents with the highest mail volumes, and it should make changes to these documents by March 2020. When providing us with the status of its implementation of this recommendation at 60 days, six months, and one year after the issuance of this report, and annually thereafter, EDD should note which documents it has addressed since the release of our report, how it has addressed them, and the dates by which it expects to address the remaining documents containing full SSNs that it mails to claimants. 24 California State Auditor Report 2018-129 March 2019 To ensure that it eliminates any unnecessary uses of personal information in its external communications and to ensure that it fully protects its claimants’ privacy, EDD should, by May 2019, implement its recently developed plan for reviewing new, revised, and existing documents. EDD should provide documents to us indicating the progress it has made to implement this recommendation at 60 days, six months, and one year following the release of this report. Finally, it should, by December 2021, complete its full review of existing documents and remove any unnecessary instances of personal information. We conducted this audit under the authority vested in the California State Auditor by Government Code section 8543 et seq. and according to generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives specified in the Scope and Methodology section of the report. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Respectfully submitted, ELAINE M. HOWLE, CPA California State Auditor Date: March 28, 2019 California State Auditor Report 2018-129 25 March 2019 Appendix Scope and Methodology The Joint Legislative Audit Committee (Audit Committee) directed the California State Auditor to perform an audit related to EDD’s privacy protection practices when mailing documents to its customers, as well as other audit objectives. The table below outlines the Audit Committee’s objectives and our methods for addressing them. Audit Objectives and the Methods Used to Address Them AUDIT OBJECTIVE METHOD 1 Review and evaluate the laws, rules, and Researched and reviewed relevant laws, rules, regulations, and policies. regulations significant to the audit objectives. 2 Determine whether EDD’s policies and Obtained and reviewed EDD’s information security policies and its policy and procedures procedures for protecting customers’ personal manuals for Disability and Unemployment. information comply with applicable state and federal laws and state policy. 3 Determine whether EDD has been mailing • Interviewed key staff and reviewed records related to EDD mailing documents to documents to its customers since 2015 that claimants that contain SSNs and other personal information and its efforts to remove contain personal information and, if so, SSNs from mailed documents. determine the following: • Obtained inventory lists and document templates for documents that EDD mailed or a. EDD’s reasons for mailing documents to its received by mail with SSNs, or for documents from which it had removed or otherwise customers that contained full SSNs or other mitigated its use of SSNs from 2015 through 2018, and determined whether EDD personal information rather than using included other personal information on its Disability and Unemployment documents. other alternative methods, such as redacting the SSNs. • Selected 21 documents that EDD mails to Disability or Unemployment claimants— including documents both with and without SSNs—and evaluated the documents’ b. To the extent possible, the number of functions, how frequently EDD mailed the documents, its reasons for including individuals who requested to receive full SSNs on the documents, and whether it was required or permitted to mail the information online only but were mailed documents with SSNs. documents containing full SSNs or other personal information. • Interviewed key staff and reviewed records related to EDD’s processes for ensuring that its documents include only necessary personal information. • Obtained from EDD’s IT branch the number of registered users for its Disability and Unemployment online systems and the number of those users requesting to receive online communication from EDD. 4 Determine whether EDD provides, or plans to Interviewed relevant staff and reviewed documents related to the Disability and provide, alternatives to mailed documents, Unemployment online systems and their ability to reduce the volume of documents that including providing online communication. EDD mails to claimants that contain full SSNs. If so, to the extent possible, evaluate the effectiveness of those alternatives to increase customer privacy. continued on next page . . . 26 California State Auditor Report 2018-129 March 2019 AUDIT OBJECTIVE METHOD 5 Determine the number of complaints EDD has • Interviewed key staff and reviewed policy manuals to determine EDD’s methods for received from its customers about receiving processing complaints. documents through the mail that contain SSNs, • Obtained and analyzed complaint data from EDD’s database of electronic including any complaints related to identity communications with claimants to assess the number and nature of complaints. Due to theft. Determine whether EDD adequately limitations associated with the various complaint channels available to claimants and responded to those complaints. EDD’s method for recording those complaints, EDD was unable to determine a precise number of claimants who complained to it regarding SSNs on mailed documents. Further, the records EDD maintains in its database of electronic communications do not always match the category of the complaint and also contain multiple free form data fields, which present challenges when searching and filtering the data. Nevertheless, we reviewed numerous complaints. • Reviewed a selection of reports that EDD provided that summarized information security incidents from 2015 through 2018. When we requested clarification of certain issues arising from our review of those documents, EDD was unable to locate some of its internal documentation of information security incidents. It instead provided us with records from the California Compliance and Security Incident Reporting System (Cal-CSIRS), to which it reports such incidents. We found the information available in the Cal-CSIRS records to be less detailed than what EDD captured in its internal reports and consequently insufficient for the purposes of our review. Due to this limitation, the information we present regarding EDD’s information security incidents is not meant to reflect EDD’s information security incidents in total. 6 Evaluate EDD’s efforts since 2015 and plans • Interviewed relevant staff and obtained documents related to EDD’s previous efforts to to better protect personal information of increase its protection of claimants’ privacy and its future plans to do so. its customers and determine the costs and • Reviewed planning documents related to EDD’s modernization project and pertinent timelines of these efforts. Determine whether approved budget change proposals. any other resources or low-tech or temporary options are available to resolve this issue. • Discussed with key staff our proposed interim solutions so that we could determine the solutions’ feasibility and obtain estimated implementation costs and timelines. We determined that certain solutions—such as manually redacting SSNs from EDD’s mailings—would be impractical because of the cost, effort, and risks involved. We present the remaining solutions in the Audit Results. 7 Review and assess any other issues that are Did not identify any additional issues that are significant to the audit. significant to the audit. Source: Analysis of the Audit Committee’s audit request number 2018-129, as well as information and documentation identified in the column titled Method. Assessment of Data Reliability In performing this audit, we obtained electronic data from EDD related to its metered mail and online communications, including complaints. The U.S. Government Accountability Office, whose standards we are statutorily required to follow, requires us to assess the sufficiency and appropriateness of any computer-processed information we use to support our findings, conclusions, or recommendations. We found the data related to metered mail to be reasonable; however, we found limitations with the online communications data, which we describe in the Scope and Methodology table. To evaluate these data, we performed electronic testing of the data and interviewed key staff knowledgeable about the data. We did not perform accuracy or completeness testing California State Auditor Report 2018-129 27 March 2019 of these data so they are of undetermined reliability for our audit purposes. Although these determinations may affect the precision of the numbers we present, there is sufficient evidence in total to support our findings, conclusions, and recommendations. 28 California State Auditor Report 2018-129 March 2019 Blank page inserted for reproduction purposes only. California State Auditor Report 2018-129 29 March 2019 March 8, 2019 Elaine M. Howle, CPA * California State Auditor 621 Capitol Mall, Suite 1200 Sacramento, CA 95814 Dear Ms. Howle: The Labor and Workforce Development Agency has authorized me to respond to the draft findings of the California State Auditor’s Report 2018-129 on the Employment Development Department’s practice of mailing documents containing Social Security numbers. The report raises serious concerns on the risks of identity theft, and the Employment Development Department’s (EDD) is committed to strengthening its efforts to safeguard the personal information of Californians. I concur with your assessment that EDD must take reasonable interim steps to safeguard customer identifying information while it works to achieve a comprehensive solution. I also appreciate your recognition of EDD’s prior and ongoing efforts to reduce the number of printed and mailed forms containing Social Security numbers, and I appreciate the recommendations contained in the report. My responses to your specific recommendations are set forth below:  Recommendation One: EDD should implement one or more of our proposed solutions or another viable solution to discontinue its use of full SSNs as a unique identifier on all documents it mails to claimants by December 2021. It should prioritize addressing those documents with the highest mail volume and should make changes to these documents by March 2020. Agree. Figure 5 of the audit report describes four proposed interim actions that EDD could take to replace Social Security numbers on its high volume documents. EDD will immediately implement the first solution. As noted in Figure 5, the timeline for completing the high-volume documents is two years and two months (to be completed by June 2021), which extends beyond the March 2020 1 target set forth in the recommendation. In addition, EDD is exploring how to accomplish the second solution simultaneously by shifting priority from other technology projects. EDD will reprioritize current projects and secure necessary funding to accomplish these solutions. Further, in the implementation status PO Box 826880 • Sacramento, CA 94280-0001 • www.edd.ca.gov * California State Auditor’s comments appear on page 31. 30 California State Auditor Report 2018-129 March 2019 Ms. Howle March 8, 2019 Page 2 report due 60 days from the issuance of the final audit, EDD will describe its plan and anticipated timeline for expeditiously expanding solution one to its remaining forms.  Recommendation Two: To ensure it eliminates any unnecessary uses of personal information in its external communications and to ensure it fully protects its claimants’ privacy, EDD should implement its proposed review process for new, revised, and existing documents by May 2019. Finally, EDD should complete its full review of existing documents and remove any unnecessary instances of personal information by December 2021. Agree. EDD is developing an Executive Notice that it will issue to all of its executives, managers, and staff by April 15, 2019 to standardize a review process for EDD forms and make this process permanent. EDD is reviewing all 2 of its communications to identify those that have Social Security numbers. EDD held its most recent review on February 22, 2019, and will provide your office with a status update and applicable documentation 60 days from the issuance of the final audit report. Thank you for the opportunity to provide this response and for the professionalism and courtesy shown by your office and staff throughout this process. Sincerely, PATRICK W. HENNING Director cc: Julie A. Su, Secretary, California Labor and Workforce Development Agency California State Auditor Report 2018-129 31 March 2019 Comments CALIFORNIA STATE AUDITOR’S COMMENTS ON THE RESPONSE FROM THE EMPLOYMENT DEVELOPMENT DEPARTMENT To provide clarity and perspective, we are commenting on EDD’s response to the audit. The numbers below correspond to the numbers we have placed in the margin of its response. As a point of clarification, when we recommended that EDD 1 prioritize addressing documents with the highest mail volumes by March 2020, we were referring to the three documents that accounted for nearly 10 million of the 13 million high-volume mailings, as we state on page 18. The recommendation applies to SSNs as well as other personal 2 information, such as phone numbers, employment histories, and dates of medical treatments, as we state on page 20.