Spotlight on Surveillance

May 2007:
National Employment Database Could Prevent Millions of Citizens From Obtaining Jobs

EPIC’s “Spotlight on Surveillance” project scrutinizes federal government programs that affect individual privacy. For more information, see previous Spotlights on Surveillance. This month, Spotlight scrutinizes the national employment verification system now under consideration in Congress. The national database is proposed to prevent undocumented immigrants from obtaining employment in the United States, but it could instead prevent millions of Americans from obtaining lawful employment. The federal program will also be expensive. The Government Accountability Office has estimated that a nationwide expansion of the Basic Pilot program would cost $11.7 billion.^[1]

Congress is considering two bills that would create such a nationwide, mandatory employment eligibility verification system.^[2] An examination of the two bills finds that the proposed changes would make the already-flawed identification systems worse for both U.S. citizens and documented immigrants. Most troubling is the fact that the bills will give the Department of Homeland Security unprecedented control over the employment of all workers in the United States.

The Current Employment Eligibility Verification System

Both the House and Senate bills create a new, mandatory, national Electronic Employment Verifications System based on the current Basic Pilot program.^[3] The new system creates an enormous datamining infrastructure, where the Department of Homeland Security would be given unprecedented power to control the employment of all U.S. citizens, legal permanent residents, and documented immigrants. Previously, Spotlight on Surveillance reviewed employment eligibility verification systems and found they are filled with problems, which would be exacerbated by the creation of a mandatory, national employment eligibility verification system.^[4]

Few Employers Use Basic Pilot Program

The Immigration Reform and Control Act of 1986 (“IRCA”) made it illegal for employers to “knowingly” employ unauthorized workers, and Basic Pilot grew out of the requirement for work-eligibility verification.^[5] Basic Pilot, a joint project of U.S. Customs and Immigration Services and the Social Security Administration, is a voluntary employment eligibility verification system created in 1997 and implemented in all 50 states.^[6]

Source: Government Accountability Office Basic Pilot has different processes for citizens and non-citizens who seek to confirm their employment eligibility status.

A new employee is required to fill out an Employment Eligibility Verification form (commonly known as an I-9 form) stating that she is authorized to work in the United States, and produce identification documents.^[7] This identification can be a configuration of one or two documents from a list of 29 possible items, including U.S passport, driver’s license, Social Security card, and school ID card.^[8] Employers do not need to verify the authenticity of the ID documents, but they do need to keep a copy of them on file: for three years after the date or hire or one year after the date employment ends, whichever is later.^[9] The documents must merely pass a good-faith test: Do they look real? If an employee is found to be unauthorized, the employer must terminate her employment. Employers who do not end employment of unauthorized workers or who knowingly hire unauthorized workers may be fined up to $11,000 for each ineligible employee.^[10]

An employer can voluntarily sign up for the Basic Pilot program. In Basic Pilot, an employer fills out an online form with the new employee’s name, date of birth and Social Security Number, and if the new hire states she is not a U.S. citizen, the “A” Number or I-94 Number within three days of the employee’s hire date.^[11] This information is checked against Social Security Administration databases “to verify the name, SSN, and date of birth of newly-hired employees, regardless of citizenship.”^[12] The SSA “maintains a record of each Social Security card, both original and replacement cards, in a system of records called the Numerical Identification File (NUMIDENT).”^[13] NUMIDENT includes “all relevant data connected to the issuance of the Social Security card, including the appropriate codes related to citizenship status and the type of Social Security card issued.”^[14] (There are three types of Social Security cards, and an individual is assigned a particular type dependent on the citizenship status and work-authorization status of the individual.^[15]

If the work authorization cannot be determined by the data in the SSA databases or if the employee is a non-citizen, her data is then checked against the Department of Homeland Security databases to verify employment eligibility.^[16] If eligibility cannot be confirmed, Basic Pilot sends a “tentative nonconfirmation” of work authorization status to the employer.^[17] There are several reasons for a "tentative nonconfirmation" determination including, “when the SSN, name, or date of birth does not match the information in SSA's database or if a death indicator is present,” “if the new hire indicated he or she was a U.S. citizen and SSA's records did not show that the person was a U.S. citizen,” or if “DHS' database does not show the newly-hired noncitizen as authorized for employment.”^[18] The employer must inform the employee of the "tentative nonconfirmation" and the employee has eight business days to contest this decision.^[19] If the employee contests the determination, SSA or DHS “is required to determine work-authorization status within 10 Federal working days.”^[20] If the review by DHS or SSA still cannot determine if the employee is eligible to work in the United States, a  “final nonconfirmation” is issued.^[21] A "final nonconfirmation" also is issued if the employee does not contest the "tentative nonconfirmation".^[22] A "final nonconfirmation" means the employee must be fired.^[23]

Underlying Databases Are Filled With Errors

The creation of a national database for employment verification has severe implications for national and individual security, civil liberties and privacy. One significant problem with this new national EEVS is that it would use databases that are filled with inaccurate or untimely information; these databases have high error rates in determining work eligibility status. In a 1997 report and a 2002 follow-up review, the Inspector General of the Department of Justice found that data from the Immigration and Naturalization Service (the predecessor of U.S. Citizenship and Immigration Services), which Basic Pilot and EEVS query, was unreliable and “flawed in content and accuracy.”^[24] In August 2005, the Government Accountability Office investigated and found errors in information from Department of Homeland Security databases.^[25]

A December 2006 report on Basic Pilot from the Social Security Administration’s Office of Inspector General also found problems in databases of Citizenship and Immigration Services.^[26] The same report found accuracy problems in the Social Security database Numerical Identification File (“NUMIDENT”), which also is used to check employment eligibility status. The Social Security Administration’s Inspector General estimated that about 17.8 million records in NUMIDENT have discrepancies with name, date of birth or death, or citizenship status.^[27] About 13 million of these incorrect records belong to U.S. citizens.^[28] 

In June 2006, the Government Accountability Office testified about the weaknesses of the Basic Pilot program. The GAO said that an August 2005 review of Basic Pilot showed “a number of weaknesses in the pilot program’s implementation, including its inability to detect identity fraud and DHS delays in entering data into its databases, could adversely affect increased use of the pilot program, if not addressed.”^[29] In August 2005, Citizenship and Immigration Service officials told GAO that a national expansion of the Basic Pilot program such as EEVS would create significant backlogs in employment verification.^[30] In Fiscal Year 2004, “about 15 percent of queries authorized by DHS required manual verification by immigration status verifiers.”^[31] In 2005, there were about 1 million Basic Pilot verifications.^[32] Some of these manual verifications took up to two weeks to resolve.^[33]

The Proposed National Employment Database

As of December, Basic Pilot consisted of 12,000 employers, about 0.2 percent of the seven million employers nationwide.^[34] In Fiscal Year 2005, less than one million verifications were run through Basic Pilot, a fraction of 60 million new hires per year.^[35] Under H.R. 1645 and S. AMDT 1150, all of the nation’s seven million employers would be mandated to use the Basic Pilot system, creating a national employment eligibility verification system (“EEVS”) of 143.6 million authorized workers.^[36]

EEVS Affects the Employment Prospects of Almost Every Eligible Worker in the U.S.

Both the House and Senate bills would implement the national employment system within four years, with some exceptions for “critical” employers, who would have to begin using EEVS immediately. Under S.AMDT. 1150, employers would have to process the data of all new employees through EEVS within 18 months of passage.^[37] Employers would have three years to process all workers.^[38] Under H.R. 1645, there are different implementation timelines for different-size employers. “Large employers,” with more than 5,000 employees, would have two years to process all new employees through the national employment system.^[39] “Mid-sized employers,” with between 1,000 to 5,000 employees, would have three years.^[40] “Small employers” would have four years.^[41] H.R. 1645 exempts some types of employees from mandatory use of the national employment system, but allows them to participate voluntarily. Exempt employees are: ‘‘(I) an individual performing casual employment for the employer and who provides domestic service in a private home that is sporadic, irregular, or intermittent; (II) a worker provided to the employer by a person providing contract services, such as a temporary agency; or (III) an independent contractor, performing services for the employer.”^[42] The Senate bill does not contain such an exception and defines “employer” as “any person or entity hiring, recruiting, or referring an individual for employment in the United States.”^[43]

How the National Employment Eligibility Verification System Would Operate

Source: Office of Inspector General, Social Security Administration In Fiscal Years 2004 and 2005, 1.7 million verifications were run through Basic Pilot, less than a million per year. This is a fraction of 60 million new hires per year that would have to be processed under EEVS.

The House and Senate bills have different yet similar processes for submitting data to the national employment verification system, and contesting the determination through administrative or judicial appeals. Under S.AMDT. 1150, employers must submit data on new employees to EEVS sometime between the hire date and the first day of actual employment.^[44] Under H.R. 1645, employers must submit data no later than five days after the first day of employment.^[45] EEVS will provide either a “confirmation” or “further action” / “tentative nonconfirmation” notice to the employer within three business days (under S.AMDT. 1150) or one business day (under H.R. 1645).^[46] Under both bills, a “confirmation” means the employee is eligible for employment.^[47]

If there is a “further action” or “tentative nonconfirmation” notice, the employer must immediately inform the affected employee, who has 10 days (under S.AMDT. 1150) or 15 days (under H.R. 1645) to contest the “further action” notice.^[48] Under H.R. 1645, a “tentative nonconfirmation” means a “manual verification” must be conducted.^[49] EEVS will issue a final “confirmation” or “nonconfirmation” determination either 10 days (under S.AMDT. 1150) or 30 days (under H.R. 1645) after the employee contests.^[50] A final “nonconfirmation” notice means the employee is deemed ineligible for employment and must immediately be fired.^[51] Under S.AMDT. 1150, the firing may be delayed if the employee files an administrative appeal and the DHS Secretary (if the employee is not a citizen) or the Social Security Commissioner (if the employee is a citizen) stays the final notice pending the outcome of the appeal.^[52] If the employer does not fire the employee after a final “nonconfirmation” notice, then (under both S.AMDT. 1150 and H.R. 1645) “a rebuttable presumption is created that the employer has violated [the law].”^[53]

The administrative appeals process has not yet been created, but both S.AMDT. 1150 and H.R. 1645 direct the DHS Secretary and the SSA Commissioner to create one.^[54] Under S.AMDT. 1150, the employee has 15 days to file an administrative appeal after the final “nonconfirmation” notice is given.^[55] S.AMDT. 1150 also directs the DHS Secretary and the SSA Commissioner to “stay the final nonconfirmation notice pending the resolution of the administrative appeal unless the Secretary or the Commissioner determines that the administrative appeal is frivolous, unlikely to succeed on the merits, or filed for purposes of delay.”^[56] The employee may provide additional information for the administrative appeal, which must be resolved “within 30 days after the individual has submitted all evidence relevant to the appeal.”^[57] Also, the administrative appeal “shall be limited to whether the final nonconfirmation notice is supported by the weight of the evidence.”^[58] Relief under the administrative appeal is limited to an “administrative order upholding, reversing, modifying, amending, or setting aside the final nonconfirmation notice.”^[59] No monetary compensation is allowed, including lost wages.^[60]

H.R. 1645 allows the employee 60 days from date of termination to file an administrative appeal.^[61] If this administrative appeal results in a “confirmation of the individual’s employment eligibility,” then DHS must determine if it was agency “error or negligence” that led to the final “nonconfirmation” notice.^[62] If DHS determines that it was agency error or negligence, then DHS will “compensate the individual for lost wages.”^[63]

Proposed Appellate Process Would Not Adequately Protect Employees

The judicial review processes under both bills are wholly inadequate. Under S.AMDT. 1150, after the administrative appeal decision, the employee has 30 days to file a petition for judicial review in the U.S. Circuit Court of Appeals for the area in which the employee resides.^[64] The Circuit Court of Appeals must stay the final notice pending the appeal unless it determines the appeal is “frivolous, unlikely to succeed on the merits, or filed for the purposes of delay.”^[65] After the administrative record is made available, the employee has 40 days to file a brief.^[66] In the Circuit Court of Appeals, the burden is on the employee to show that the final “nonconfirmation” notice was “arbitrary, capricious, not supported by substantial evidence, or otherwise not in accordance with law.”^[67] Administrative findings of fact are deemed “conclusive unless any reasonable adjudicator would be compelled to conclude to the contrary.”^[68] In fact, the Circuit Court of Appeals decides the petition “only on the administrative record on which the final nonconfirmation order is based.”^[69]  

Under H.R. 1645, individuals have 90 days (or further time as the Secretary may allow) to “obtain judicial review of the [administrative appeal] decision in a civil action.”^[70] However, H.R. 1645 has not created the judicial review process.^[71] H.R. 1645 directs the director of the Federal Judicial Center to “submit to Congress a report on judicial review of an administrative decision on a final nonconfirmation. The report shall contain recommendations on jurisdiction and procedures that shall be instituted to seek adequate and timely review of such decision.”^[72] Once the review process has been created, H.R. 1645 states that, if the court overturns the administrative decision of nonconfirmation, “the court shall compensate the for lost wages.”^[73]

H.R. 1645 includes another provision to assist employees affected by EEVS. DHS must “establish a fully staffed 24-hour hotline that shall receive inquiries from individuals or employers concerning determinations made by the EEVS and shall identify for an individual the particular data that resulted in a determination that the EEVS was unable to verify the individual’s identity or eligibility for employment.”^[74] However, H.R. 1645 denies a “private right of action … for any claim based on a violation of this section.”^[75] H.R. 1645 also states that the U.S government will have “exclusive enforcement authority over violations of this section and shall use only the powers, penalties, and mechanisms found in this section.”^[76]

These administrative and judicial appellate processes do not protect the rights of authorized workers. The burden is on the worker to rebut a presumption she is ineligible for employment, even though the finding is based on databases known to be filled with errors.

Data Sharing and Data Collection Are Greatly Expanded, Giving the DHS Secretary Unprecedented Authority Over the Employment of U.S. Workers

Both H.R. 1645 and S.AMDT. 1150 expand data sharing and collection, consolidating the power to access and control this information in the Department of Homeland Security. New exemptions are created, requiring the Social Security Administration, Internal Revenue Service, and Department of State to disclose confidential and sensitive personal data to the Department of Homeland Security.^[77] This data includes employee data, birth and death records, driver’s license and state identification files, visa and passport records and taxpayer information.

As under Basic Pilot, S.AMDT. 1150 and H.R. 1645 require employers, under penalty of perjury, to verify the identity and work authorization of employees by examining relevant documents, and attest to the employee’s work eligibility.^[78] The types of documents that newly hired employees must present depend on her citizenship or immigration. The following are documents that, on their own, would be accepted as proof of both employment eligibility and identity. U.S. citizens may present either a U.S. passport or Western Hemisphere Travel Initiative passport card under S.AMDT. 1150.^[79] H.R. 1645 requires citizens to present a U.S. passport, a “biometric, machine readable, tamper-resistant Social Security card,” or a REAL ID license or state ID card (neither the biometric Social Security or REAL ID card exist).^[80] Under S.AMDT. 1150, non-citizens, including legal permanent residents, may present a “permanent resident card” or other employment authorization document issued approved by the Secretary of DHS or State.^[81] These documents must contain “a photograph of the individual, biometric data, such as fingerprints, or such other personal identifying information relating to the individual as the [DHS] Secretary finds, by regulation, sufficient for the purposes of this subsection.”^[82] Under H.R. 1645, non-citizens, including legal permanent residents, may present either a “permanent resident card” or a “biometric, machine readable, tamper-resistant Social Security card.”^[83] Those with “Z-visas” (S.AMDT. 1150) or “nonimmigrant visas” (H.R. 1645) must present a “temporary interim benefits card” or another card designated by the DHS Secretary.^[84] H.R. 1645 also allows these employees to present a biometric, machine readable, tamper-resistant Social Security card.”^[85]

H.R. 1645 requires individuals without the previously listed documents to present a “document designated by the [DHS] Secretary” that must contain “a photograph of the individual or other identifying information, including name, date of birth, gender and address; and contains security features to make the document resistant to tampering, counterfeiting, and fraudulent use,” or any other document or combination of documents as designated by the DHS Secretary.^[86] S.AMDT. 1150 requires individuals without the previously listed documents to submit a combination of documents that separately prove identity or employment eligibility. In most cases, to prove identity, S.AMDT. 1150 requires a REAL ID driver’s license or a non-REAL ID license plus birth certificate, naturalization certificate, or similar document.^[87]  To prove employment authorization, S.AMDT. 1150 requires a Social Security card or other documentation approved by the DHS Secretary.^[88]  After June 1, 2013, S.AMDT. 1150 prohibits the use of non-REAL ID cards in EEVS.^[89] Both H.R. 1645 and S.AMDT. 1150 allow the DHS Secretary to prohibit the use of certain documents for employment verification.^[90] Both bills would require the DHS Secretary to publish notice of such prohibitions in the Federal Register.^[91] This would give the DHS Secretary the power to mandate the use of a national ID card, such as the REAL ID card, as the sole acceptable document for employment eligibility verification in the United States.

Under S.AMDT. 1150, employers must retain “paper, microfiche, microfilm, or electronic” copies of certain documents submitted to the national employment database for “(i) seven years after the date of such hiring; or (ii) two years after the date the individual’s employment is terminated, whichever is earlier.”^[92] The documents that must be retained are: (1) a copy of any documents that the employee submitted as proof of identity and / or employment eligibility, (2) records of any SSA correspondence “regarding name and number mismatches or no-matches and the steps take to resolve such issues,” and (3) “records all actions and copies of any correspondence or action taken by the employer to clarify or resolve any issue that raises reasonable doubt as to the validity of the alien’s identity or work authorization.”^[93] S.AMDT. 1150 also states that the DHS Secretary “may prescribe the manner of recordkeeping,” including “that these documents be transmitted electronically,” and “may require that additional records be kept or that additional documents be copied and maintained.”^[94] Again, this gives the DHS Secretary enormous power to control the employment prospects of all eligible workers, giving the Secretary unlimited authority to require and retain a broad range of data. The Senate bill reiterates this broad expansion of power in another section, where S.AMDT. 1150 allows the DHS Secretary, in consultation with the SSA Commissioner of Social Security, to “modify by Notice published in the Federal Register the documents that must be presented to the employer, the information that must be provided to EEVS by the employer, and the procedures that must be followed by employers with respect to any aspect of the EEVS if the Secretary in his discretion concludes that the modification is necessary.”^[95]

Under H.R. 1645, employers must retain certain documents for ‘‘(i) 3 years after the date of such hiring; or (ii) 1 year after the date the individual’s employment is terminated; or (B) during a shorter period determined by the [DHS] Secretary, if the Secretary reduces the period described in subparagraph (A) for the employer or a class of employers that includes the employer.”^[96] The documents that must be retained are: (1) employer and employee attestations, (2) a copy of any documents that the employee submitted as proof of identity and / or employment eligibility, and (3) records “of any action taken and copies of any correspondence written or received, with respect to the verification of an individual’s identity or eligibility for employment in the United States.”^[97]

S.AMDT. 1150 also would allow employers to “voluntarily” choose to require their new employees submit their fingerprints to the federal government.^[98] The choice is that of the employers, not the employees. Though S.AMDT. 1150 prohibits retention of the fingerprints after 10 business days and restricts the use of the biometrics to employment verification, the possible collection of fingerprints for every eligible worker in the nation, about 144 million strong, would be a serious temptation for mission creep.^[99] It is an easy step from allowing “voluntary” submission by employers to requiring fingerprints from workers, especially since S.AMDT. 1150 gives the DHS Secretary broad authority to change the documents required or prohibited under EEVS.^[100] This would give the Department of Homeland Security unprecedented power to require all eligible workers and employers nationwide to submit personal, biographic, biometric or any other data the DHS Secretary concludes is necessary.

Though both H.R. 1645 and S.AMDT. 1150 place restrictions on access to and use of the data collected under the proposed EEVS, the creation of the massive national identification system of all people employed within the country, which could be easily indexed and correlated with other databases via the Social Security Number creates enormous privacy and security risks.^[101] A centralized identification system would be a tempting target for identity thieves. If a criminal breaks the system’s security, then the criminal would have access to the personal information of every single person in that database. If this one, centralized system is used across the nation, this would put hundreds of millions of people at risk for identity theft.

There is another significant security risk, besides that of attacks by unauthorized users, and that is of authorized users abusing their power. In a case in Maryland just last year, three people – including a Maryland Motor Vehicle Administration official – were indicted on charges of “conspiring to sell unlawfully produced MVA-issued Maryland identification cards.”^[102] The danger of negligent and accidental disclosures affecting victims of abuse increases significantly under a national identification database, as substantially more government employees will have access to the sensitive information. Past abuses exemplify what can be expected in a nationwide scale. For example, in Arizona, a police officer admitted to accessing motor vehicle records to find personal information on women he was romantically interested in, as well as co-workers.^[103] One example of accidental disclosure occurred in Wisconsin earlier this year -- a police officer disclosed a victim’s address, found in a DMV record to a stalker; the officer did not know that the victim had a restraining order against this.^[104] Intentional breaches by outsiders or authorized insiders abusing their power would have a wider scope with a national database of employment data.

H.R. 1645 and S.AMDT. 1150 both restrict access and use of EEVS data. Under H.R. 1645, employers are prohibited from using retained documents for any purpose other than complying with the requirements in the section.^[105] H.R. 1645 mandates that employers must “safeguard any information collected for purposes of the System,” and they must also “protect any means of access to the information to ensure that it is not used for any purpose other than to determine the identity and employment eligibility of the individual and to protect the confidentiality of such information including ensuring that such information is not provided to any person other than a person who carries out the employer’s responsibilities.”^[106] No “department, bureau or other agency of the U.S.” is allowed to use EEVS “information, database or other records” for any purpose “other than as provided for under this” Act.^[107] However, H.R. 1645 also mandates that the Social Security Administration “transmit to the Secretary of Homeland Security such information . . . in an individual’s application for [a Social Security] Number or such card” that the DHS Secretary determines necessary to implement EEVS.^[108] H.R. 1645 also exempts the Department of Homeland Security from confidentiality provisions of Section 6103 of the Internal Revenue Code.^[109] These exemptions would require SSA to disclose taxpayer identity information on various groups of employers and employees, such as when identity fraud is suspected.^[110] The exemptions would also allow DHS access to taxpayer identity information of all EEVS employers and new employees.^[111]

Source: Office of the Inspector General, Social Security Administration The Social Security Administration has estimated its databases contain about 18 million erroneous records, which would lead to “tentative” or “final nonconfirmation” notices for affected employees. About 13 million of these records belong to U.S. citizens.

S.AMDT. 1150 states that EEVS shall only be used for the “enforcement and administration of immigration laws, anti-terrorism laws, or for enforcement of Federal criminal law relating to functions of EEVS, including prohibitions on forgery, fraud, and identity theft.”^[112] S.AMDT. 1150 also creates fines for unauthorized disclosure of information.^[113] Also, S.AMDT. 1150 requires the DHS Secretary, in consultation with the SSA Commissioner and other “appropriate Federal and State agencies” to “develop policies and procedures to ensure protection of the privacy and security of personally identifiable information and identifiers contained in” certain records.^[114] However, S.AMDT. 1150 also mandates that the DHS Secretary be granted access to a variety of records “for the purposes of preventing identity theft and fraud in the use of the EEVS and enforcing the provisions of this section governing employment verification.”^[115] DHS would have access to any “a) records maintained by the Social Security Administration as specified in (D); b) Birth and death records maintained by vital statistics agencies of any state or other United States jurisdiction; c) Passport and visa records (including photographs) maintained by the United States Department of State; d) State driver’s license or identity card information (including photographs) maintained by State department of motor vehicles.”^[116] DHS would withhold funds from States that do not allow the agency unfettered access to their databases. S.AMDT. 1150 says, “A State or other non-federal jurisdiction that does not provide such access shall not be eligible for any grant or other program of financial assistance administered by the Secretary.”^[117] This sledgehammer approach negates any other privacy protections set out in the bill, because the personal information of every U.S. worker would be available under this national employment eligibility verification system.

EEVS Would Use Biometric Social Security Cards and REAL ID Cards

The identification documents required under H.R. 1645 and S.AMDT. 1150 also raise privacy and security issues. Both bills depend on the use of a “biometric, machine-readable” Social Security card and the REAL ID card, neither of which exist.^[118] EPIC previously explained that machine readable, biometric Social Security cards and the REAL ID national identification system are fundamentally flawed plans that would harm our national security protections.^[119]

It is important to note that the Social Security Number and card are not intended to be used for authentication and identification purposes today, and yet far too many entities rely upon it for just those purposes. “The card was never intended and does not serve as a personal identification document -- that is, the card does not establish that the person presenting the card is actually the person whose name and SSN appear on the card,” Frederick G. Streckewald, the Social Security Administration’s Assistant Deputy Commissioner, said in Congressional testimony last year.^[120] “Although we have made the card counterfeit resistant, it does not contain information that would allow the card to be used as proof of identity,” Streckewald said.^[121] At the same hearing of the House Subcommittee on Social Security, EPIC Executive Director Marc Rotenberg urged against the addition of digital photos, machine-readable identifiers, and biometric identifiers that could turn the Social Security card into a national ID card. He reiterated that the Social Security Number was never meant to be an identification document, and said, “Adding the trappings of an identification document to it, including photographs and machine-readable technology, only reinforces the card’s status as a badge of identity.”^[122]

The creation of biometric machine readable Social Security and REAL ID cards is especially troubling because, without proper security safeguards, such cards allows for easier collection of personal data and tracking of individuals. When a person hands over her license or ID card today, the data is not routinely downloaded and stored. A grocery store clerk or club bouncer usually merely looks at the card, verifies age or address, and then hands the card back to the individual. No transaction is recorded. However, allowing universal access to machine readable biometric Social Security and REAL ID cards would allow the data to be downloaded, stored and transferred without the knowledge or permission of the individual cardholder. A digital transaction would be recorded and a digital trail could be created.

In May comments to the Department of Homeland Security about the REAL ID system, EPIC and a group of privacy and technology experts explained that creating a national identification database full of personal documents such as birth and citizenship certificates, making that database accessible to thousands of people, while not requiring adequate security and privacy safeguards, would necessarily make us less secure as a nation and as individuals.^[123] Though the REAL ID card is ostensibly “voluntary” and the purposes are limited to three set out in the REAL ID Act (entering Federal facilities, boarding commercial aircraft, entering nuclear power plants), the House and Senate legislation seeks to enmesh the REAL ID national identification system into everyday life, taking the driver’s license far from its original purpose, to license drivers.^[124] After June 1, 2013, S.AMDT. 1150 prohibits the use of non-REAL ID cards in the national employment system.^[125] Previously, legislators and federal officials stated that REAL ID was voluntary and not a national identification system because state funding was not conditioned on mandated implementation of REAL ID. However, the Senate bill creates a Department of Homeland Security grant program that would give funding to states only if they agree to implement the REAL ID national identification system.^[126]

The authors of H.R. 1645 and S.AMDT. 1150 also seek to reduce identity theft through this national employment eligibility system. However, EPIC has repeatedly explained, “The best long-term approach to the problem of identity theft is to minimize the collection of personal information and to develop alternative technologies and organizational practices.”^[127] There is a need to establish better privacy and security practices to reduce the risk of identity theft, rather than simply expand law enforcement authority. EPIC has criticized, "government and private agencies that collect and store excessive amounts of often unnecessary personal information in systems that lack adequate privacy and security safeguards."^[128]

Problems Could Result in Millions Incorrectly Identified as Ineligible to Work

As explained above, the underlying databases used by Basic Pilot and the proposed national employment eligibility verification system are filled with inaccurate or untimely data. The Social Security Administration has estimated its databases contain about 18 million erroneous records, which would lead to “tentative” or “final nonconfirmation” notices for affected employees.^[129] These errors have profound consequences for U.S. citizens and documented immigrants, leading some authorized worker have their pay reduced or their employment terminated.^[130]

In 2002, the Immigration and Naturalization Service (now U.S. Citizenship and Immigration Services) commissioned an independent analysis of the Basic Pilot program.^[131] The analysis of Basic Pilot found that mistakes in the system led to “false negatives,” where workers eligible for employment were deemed ineligible by Basic Pilot. For example, out of a sample of employees who received “final nonconfirmation” notices, 42 percent were “false negatives” and were eligible to work.^[132] The report also found that “employers do not always follow Federally mandated safeguards for the Basic Pilot program.”^[133] The researchers found that employers took adverse action against an employee because of a “tentative nonconfirmation,” though it is illegal under Basic Pilot (and also under proposed EEVS).^[134]

Thirty percent of pilot employers reported restricting work assignments while employees contest a tentative nonconfirmation. Among the 67 employees who decided to contest a tentative nonconfirmation, 45 percent reported one or more of the following adverse actions: were not allowed to continue working while they straightened out their records, had their pay cut, or had their job training delayed.^[135]

Current law (and H.R. 1645 and S.AMDT. 1150) also prohibits employers from pre-screening job applicants before making a hiring decision, yet some employers were doing just that. In December 2006, the Social Security Administration’s Office of the Inspector General reviewed Basic Pilot and found that 42 percent of employers used the program to prescreen employees, and 30 percent of employers used the program to verify the employment eligibility of their existing workforce.^[136] In 2002, the independent analysis found that, “[a]mong a sample of individuals classified on the transaction database as unresolved tentative nonconfirmations, 28 percent said that they did not receive a job offer from the pilot employer.”^[137] Also, these job applicants were not informed they were being pre-screened through Basic Pilot, and “[c]onsequently, they were denied not only jobs, but also the opportunity to resolve any inaccuracies in their Federal records.”^[138]

This problem ties in with another found by the researchers; though “Basic Pilot procedures were also designed to protect employee rights to resolve verification problems . . . not all employers inform their employees of verification problems.”^[139] The report stated that, “73 percent of the employees who should have been informed of work authorization problems were not.”^[140] Because they did not know about the “tentative nonconfirmations,” the employees were not able to contest the “tentative nonconfirmation” notices. A failure to contest a “tentative nonconfirmation” results in a “final nonconfirmation” decision against the affected employee under Basic Pilot, H.R. 1645, and S.AMDT. 1150.^[141] Neither Basic Pilot nor S.AMDT. 1150 compensates eligible workers for wages lost because of an incorrect "tentative nonconfirmation” determination.^[142] H.R. 1645 does allow for repayment of lost wages for an incorrect "final nonconfirmation.”^[143] This certainly a nightmare scenario – a person is rejected for a job she was qualified for because the government made a mistake, and she might never learn of this problem. This illustrates the fundamental problem with Basic Pilot and EEVS: presumed unauthorized for employment unless they prove otherwise. There are about 143.6 million authorized workers nationwide, according to the Bureau of Labor Statistics.^[144] Even a one percent failure rate for a national employment identification system would affect millions of people.

Full Protections of Privacy Act Must Be Applied to These Systems

H.R. 1645 directs the DHS Secretary and SSA Commissioner to “establish procedures to permit an individual to verify the individual’s eligibility for employment in the United States prior to obtaining or changing employment, to view the individual’s own records in the System in order to ensure the accuracy of such records, and to correct or update the information used by the System regarding the individual.”^[145] S.AMDT. 1150 does not include such a provision. Neither bill offers the full protections of the Privacy Act of 1974.^[146]

The federal government already has proven its databases are full of mistakes; one relevant example is the terrorism watch lists. In 2003, Homeland Security Presidential Directive No. 6 consolidated administration of the no-fly, selectee and other security watch lists under the jurisdiction of the Terrorist Screening Center.^[147] When the Department of Justice Inspector General issued a report on the Terrorist Screening Center in June 2005, he found major concerns about, among other things, data accuracy and completeness.^[148] The Inspector General “determined that the TSC could not ensure that the information in that database was complete and accurate.”^[149] He said, “Our review of the consolidated watch list identified a variety of issues that contribute to weaknesses in the completeness and accuracy of the data, including variances in the record counts between [two versions of the Terrorist Screening Database], duplicate records, missing or inappropriate handling instructions or categories, missing records, and inconsistencies in identifying information between TSDB and source records.”^[150]

In February 2006, there were 325,000 names on the watch lists, according to the National Counterterrorism Center.^[151] Last year, the director of TSA’s redress office revealed that more than 30,000 people who are not terrorists have asked the agency to remove their names from the lists since September 11, 2001.^[152] Earlier this year, the head of TSA said that the watch lists were being reviewed, and he expected to cut the list of names in half.^[153] However, he has not disclosed details, such as what the criteria would be for removing a name or when the review would be complete. These reports show that the watch lists are rife with mistakes and “false positives.”

Like the watch lists, the national employment eligibility system will profoundly affect almost everyone in the United States. Authorized workers must have the judicially enforceable right to notice, access, correction, and redress of the data in the national employment eligibility verification system. The full protections of the Privacy Act must be applied because of the profound effect that the system will have: because the employment verification systems will include many “false negatives,” employers will (either inadvertently or deliberately) take adverse action against those who receive “tentative nonconfirmation” notices, workers may never know they have received “tentative” or "final nonconfirmation" notices and be unable to contest them. The only way to ensure that the personal data is accurate and complete is to apply all Privacy Act obligations to government record-keeping systems, including EEVS.

Conclusion

In Congressional testimony discussing another proposed national identification database, EPIC Executive Director Marc Rotenberg cautioned against creating such a system and his words are applicable to the proposed national employment eligibility verification database. “A mandatory, national index of all people employed within the U.S. would allow the tracking of individuals on an unprecedented scale. Each person applying for a job would be subject to a status determination by a government agency with each application. In essence, a person’s life and livelihood would be determined by a database kept by the federal government -- a database grounded in a flawed system of identification never intended for the purpose.”^[154] The national employment eligibility verification system being debated in Congress would give the Secretary of Homeland Security the power to control and mandate the data employees are required to submit to the federal government in order to obtain a job. Such data could be personal, biographic, or biometric. 

---

^[1] Gov’t Accountability Office, Immigration Enforcement: Weaknesses Hinder Employment Verification and Worksite Enforcement Efforts, GAO-05-813 29 (Aug. 2005) [“GAO Report on Basic Pilot”], available at http://www.gao.gov/new.items/d05813.pdf.

^[2] Security Through Regularized Immigration and a Vibrant Economy Act, of 2007, H.R. 1645, 110th Cong. (2007) “H.R. 1645”), available at http://www.epic.org/privacy/surveillance/spotlight/0507/hr1645.pdf; Secure Borders, Economic Opportunity and Immigration Reform Act of 2007, S.AMDT. 1150 to S. 1348, 110th Cong. (2007) (“S.AMDT. 1150”), available at http://www.epic.org/privacy/surveillance/spotlight/0507/samdt1150.pdf.

^[3] Both H.R. 1645 and S.AMDT. 1150 seek to change Section 274A of the Immigration and Nationality Act, 8 U.S.C. § 1324a. Therefore, citations to the bills will necessarily reference how the proposed legislation will affect §274A. H.R. 1645 §301(a) (amending §274A(c)); S.AMDT. 1150 §302(a) (amending §274A(d)).

^[4] EPIC, Spotlight on Surveillance, SAVE System Can’t Save Itself From 11-Year History of Inaccuracy, Unreliability (Apr. 2007), http://www.epic.org/privacy/surveillance/spotlight/0407/; EPIC, Spotlight on Surveillance, Expansion of Basic Pilot Would Steer Employment Verification Toward Disaster (Apr. 2006), http://www.epic.org/privacy/surveillance/spotlight/0406.

^[5] Immigration Reform and Control Act, 8 U.S.C. §1324a (1986), supplanted by Illegal Immigration Reform and Immigrant Responsibility Act, 8 U.S.C. §1324a(b) (1996) (“IRIRA”).

^[6] Id., Basic Pilot Extension Act, Pub. L. 107-128 (2001); and Basic Pilot Program Extension and Expansion Act, Pub. L. 108-156 (2003).

^[7] IRIRA, supra note 5.

^[8] Employment Eligibility Immigration Form (Form I-9), OMB No. 1615-0047, at 3.

^[9] IRIRA, supra note 5.

^[10] Id.

^[11] Office of Inspector Gen., Soc. Sec. Admin, Congressional Response Report: Accuracy of the Social Security Administration’s Numident File, A-08-06-26100, Appendix D (Dec. 18, 2006) (“Inspector General Report on SSA Database”), available at http://www.ssa.gov/oig/ADOBEPDF/A-08-06-26100.pdf.

^[12] Id.

^[13] Inst. for Survey Research, Temple Univ., and Westat, Findings of the Basic Pilot Evaluation (June 2002) [“Detailed Independent Analysis of Basic Pilot”], available at http://www.uscis.gov/portal/site/uscis/menuitem.5af9bb95919f35e66f614176543f6d1a/?vgnextoid=9cc5d0676988d010VgnVCM1130048f3d6a1RCRD&vgnextchannel=2c039c7755cb9010VgnVCM1130045f3d6a1RCRD.

^[14] Id. at 35.

^[15] “The three types of cards appear to be identical except for the presence or absence of a particular legend.  The type of card issued to U.S. citizens and lawful permanent residents, refugees, and asylees has no legend. A Social Security card with the legend ‘Valid for work only with INS Authorization’ is issued to noncitizens with temporary work authorization. Noncitizens without work authorization who have a legitimate non- work reason for having a Social Security number are issued cards that include the legend

‘Not Valid for Employment.’” Id.

^[16] Inspector General Report on SSA Database at Appendix D, supra note 11.

^[17] Id.

^[18] Id.

^[19] Id.

^[20] Detailed Independent Analysis of Basic Pilot at 44, supra note OOO.

^[21] Inspector General Report on SSA Database at Appendix D, supra note 11.

^[22] Detailed Independent Analysis of Basic Pilot at 44, supra note OOO.

^[23] Inspector General Report on SSA Database at Appendix D, supra note 11.

^[24] Office of Inspector Gen., Dep’t of Justice, Immigration and Naturalization Service Monitoring of Nonimmigrant Overstays, Rept. No. I-97-08 (Sept. 1997), available at http://www.usdoj.gov/oig/reports/INS/e9708/index.htm; Follow-Up Report on INS Efforts to Improve the Control of Nonimmigrant Overstays, Rept. No. I-2002-006 (Apr. 2002), available at http://www.usdoj.gov/oig/reports/INS/e0206/index.htm/; and Immigration and Naturalization Service’s Ability to Provide Timely and Accurate Alien Information to the Social Security Administration, Rept. No. I-2003-001 (Nov. 2002), available at http://www.usdoj.gov/oig/reports/INS/e0301/final.pdf.

^[25] GAO Report on Basic Pilot at 25, supra note 1.

^[26] Inspector General Report on SSA Database at 15, supra note 11.

^[27] Id. at 6.

^[28] Id. at Appendix C-2.

^[29] Richard M. Stana, Dir., Homeland Sec. & Justice, Gov’t Accountability Office, Testimony Before the Subcomm. on Immigration,  Border Sec., & Citizenship of the S. Comm.on the Judiciary, 109th Cong. (June 19, 2006), available at http://www.gao.gov/new.items/d06895t.pdf.

^[30] GAO Report on Basic Pilot at 6, supra note 1.

^[31] Id. at 23.

^[32] James B. Lockhart III, Deputy Comm’r of Soc. Sec., Soc. Sec. Admin., Testimony at a Hearing on Social Security Number High-Risk Issues Before the Subcomm. on Soc. Sec. of the H. Comm. on Ways and Means, 109th Cong. (Feb. 16, 2006).

^[33] GAO Report on Basic Pilot at 24, supra note 1.

^[34] U.S. Citizenship & Immigration Serv., Dep’t of Homeland Sec., I Am an Employer... How Do I Use the Employment Eligibility Verification/Basic Pilot Program? 1 (Jan. 2007), available at http://www.uscis.gov/files/nativedocuments/EEV_FS.pdf.

^[35] Office of Inspector Gen., Soc. Sec. Admin, Congressional Response Report: Employer Feedback on the Social Security Administration’s Verification Programs, A-03-06-26106 1 (Dec. 18, 2006) [“Inspector General Report on Employers”], available at http://www.ssa.gov/oig/ADOBEPDF/A-03-06-26106.pdf; Press Release, Bureau of Labor Statistics, Job Openings and Labor Turnover March 2007 (May 8, 2007), available at http://www.bls.gov/news.release/pdf/jolts.pdf.

^[36] H.R. 1645 §301(a) (amending §274A(c)); S.AMDT. 1150 §302(a) (amending §274A(d)).

^[37] S.AMDT. 1150 §302(a) (amending §274A(d)(2)(C)).

^[38] S.AMDT. 1150 §302(a) (amending §274A(d)(2)(D)).

^[39] H.R. 1645 §301(a) (amending §274A(c)(11)(A)(ii)).

^[40] H.R. 1645 §301(a) (amending §274A(c)(11)(A)(iii)).

^[41] H.R. 1645 §301(a) (amending §274A(c)(11)(A)(iv)).

^[42] H.R. 1645 §301(a) (amending §274A(c)(11)(C)(ii)).

^[43] S.AMDT. 1150 §302(a) (amending §274A(b)(2)).

^[44] S.AMDT. 1150 §302(a) (amending §274A(d)(5)(B)(i)).

^[45] H.R. 1645 §301(a) (amending §274A(c)(3)(A)).

^[46] H.R. 1645 §301(a) (amending §274A(c)(3)(B)); S.AMDT. 1150 §302(a) (amending §274A(d)(5)(C)(i)).

^[47] H.R. 1645 §301(a) (amending §274A(c)(3)(B)(i)); S.AMDT. 1150 §302(a) (amending §274A(d)(5)(C)(ii))(I).

^[48] H.R. 1645 §301(a) (amending §274A(c)(3)(D)); S.AMDT. 1150 §302(a) (amending §274A(d)(5)(C)(ii))(II).

^[49] H.R. 1645 §301(a) (amending §274A(c)(3)(C)(i)(II)).

^[50] H.R. 1645 §301(a) (amending §274A(c)(3)(C)(ii)); S.AMDT. 1150 §302(a) (amending §274A(d)(5)(C)(ii))(III).

^[51] H.R. 1645 §301(a) (amending §274A(c)(12)(D)); S.AMDT. 1150 §302(a) (amending §274A(d)(5)(C)(ii))(IV).

^[52] S.AMDT. 1150 §302(a) (amending §274A(d)(5)(D)(i)).

^[53] H.R. 1645 §301(a) (amending §274A(c)(12)(D)); S.AMDT. 1150 §302(a) (amending §274A(d)(5)(D)(ii)).

^[54] H.R. 1645 §301(a) (amending §274A(c)(19)(B)); S.AMDT. 1150 §302(a) (amending §274A(d)(7)(B)).

^[55] S.AMDT. 1150 §302(a) (amending §274A(d)(7)(A)).

^[56] S.AMDT. 1150 §302(a) (amending §274A(d)(7)(C)).

^[57] S.AMDT. 1150 §302(a) (amending §274A(d)(7)(B)).

^[58] S.AMDT. 1150 §302(a) (amending §274A(d)(7)(B)).

^[59] S.AMDT. 1150 §302(a) (amending §274A(d)(7)(C)).

^[60] S.AMDT. 1150 §302(a) (amending §274A(d)(7)(D)).

^[61] H.R. 1645 §301(a) (amending §274A(c)(19)(A)).

^[62] H.R. 1645 §301(a) (amending §274A(c)(19)(C)).

^[63] H.R. 1645 §301(a) (amending §274A(c)(19)(D)), Lost wages will be “calculated based on the wage rate and work schedule that prevailed prior to termination . . . beginning on the first scheduled work day after employment was terminated and ending 180 days after completion of the administrative review process or the day after the individual is reinstated or obtains employment elsewhere, whichever occurs first.”

^[64] S.AMDT. 1150 §302(a) (amending §274A(d)(8)(B)(i)).

^[65] S.AMDT. 1150 §302(a) (amending §274A(d)(8)(B)(vi)).

^[66] S.AMDT. 1150 §302(a) (amending §274A(d)(8)(B)(iv)).

^[67] S.AMDT. 1150 §302(a) (amending §274A(d)(8)(B)(v)).

^[68] S.AMDT. 1150 §302(a) (amending §274A(d)(8)(B)(v)).

^[69] S.AMDT. 1150 §302(a) (amending §274A(d)(8)(B)(v)).

^[70] H.R. 1645 §301(a) (amending §274A(c)(20)(A)).

^[71] H.R. 1645 §301(a) (amending §274A(c)(20)(B)).

^[72] H.R. 1645 §301(a) (amending §274A(c)(20)(B)), The report must be submitted no later than 180 days after the date of enactment of H.R. 1645.

^[73] H.R. 1645 §301(a) (amending §274A(c)(20)(C)), Lost wages will be “calculated based on the wage rate and work schedule that prevailed prior to termination . . . beginning on the first scheduled work day after employment was terminated and ending 180 days after completion of the judicial review described in this paragraph or the day after the individual is reinstated or obtains employment elsewhere, whichever occurs first.”

^[74] H.R. 1645 §301(a) (amending §274A(c)(10)).

^[75] H.R. 1645 §301(a) (amending §274A(c)(20)(D)), “This limitation applies to all cases in which a final judgment has not been entered prior to or on the date of enactment of [H.R. 1645].”

^[76] H.R. 1645 §301(a) (amending §274A(c)(20)(D)).

^[77] H.R. 1645 §301(b)(2), §306; S.AMDT. 1150 §302(a) (amending §274A(c)(9)(F)), §304(a)(1), §308.

^[78] H.R. 1645 §301(a) (amending §274A(b)(1)(A)); S.AMDT. 1150 §302(a) (amending §274A(c)(1)).

^[79] S.AMDT. 1150 §302(a) (amending §274A(c)(1)(B)(i)); see EPIC, Spotlight on Surveillance, Homeland Security PASS Card: Leave Home Without It (Aug. 2006), http://www.epic.org/privacy/surveillance/spotlight/0806/ (why the Western Hemisphere Travel Initiative’s proposed passport card creates security threats).

^[80] H.R. 1645 §301(a) (amending §274A(b)(1)(B)(i)).

^[81] S.AMDT. 1150 §302(a) (amending §274A(c)(1)(B)(ii)).

^[82] S.AMDT. 1150 §302(a) (amending §274A(c)(1)(B)(ii)(I)).

^[83] H.R. 1645 §301(a) (amending §274A(b)(1)(B)(ii)).

^[84] “Z-visas” (as defined under S.AMDT. 1150) and “nonimmigrant visas” (as defined under H.R. 1645), denote the nonimmigrant lawful status of previously unlawful immigrants. As these are new categories of visas that would be created by the passage of S.AMDT. 1150 or H.R. 1645, the “temporary interim benefits cards” do not exist. H.R. 1645 §301(a) (amending §274A(b)(1)(B)(iii)(I)); S.AMDT. 1150 §302(a) (amending §274A(c)(1)(B)(iii)).

^[85] H.R. 1645 §301(a) (amending §274A(b)(1)(B)(iii)(II)).

^[86] H.R. 1645 §301(a) (amending §274A(b)(1)(B)(iv)).

^[87] S.AMDT. 1150 §302(a) (amending §274A(c)(1)(C)).

^[88] S.AMDT. 1150 §302(a) (amending §274A(c)(1)(D))

^[89] S.AMDT. 1150 §302(a) (amending §274A(c)(1)(F)).

^[90] H.R. 1645 §301(a) (amending §274A(b)(1)(E); S.AMDT. 1150 §302(a) (amending §274A(c)(1)(E)).

^[91] H.R. 1645 §301(a) (amending §274A(b)(1)(E); S.AMDT. 1150 §302(a) (amending §274A(c)(1)(E)).

^[92] S.AMDT. 1150 §302(a) (amending §274A(c)(3), (c)(4)).    

^[93] S.AMDT. 1150 §302(a) (amending (c)(4)).

^[94] S.AMDT. 1150 §302(a) (amending (c)(4)(D)).

^[95] S.AMDT. 1150 §302(a) (amending §274A(c)(5)(G)).

^[96] H.R. 1645 §301(a) (amending §274A(b)(3), (b)(4)).

^[97] H.R. 1645 §301(a) (amending §274A(b)(3), (b)(4)(A)).

^[98] S.AMDT. 1150 §307(a).

^[99] S.AMDT. 1150 §307(b)(1).

^[100] S.AMDT. 1150 §302(a) (amending §274A(c)(4)(D), (c)(5)(G)).

^[101] See discussion infra.

^[102] Fake ID Cards, Wash. Post, Mar. 15, 2006, at B02.

^[103] Michael Kiefer, Officer Admits to Tampering; Databases Used to Check on Women, Ariz. Republic, Apr. 6, 2006, at B3.

^[104] Kevin Murphy, Officer’s Actions will Cost 25,13, GazetteXtra, Feb. 15, 2007, available at http://www.gazetteextra.com/mezera021507.asp.

^[105] H.R. 1645 §301(a) (amending §274A(b)(4)(B)).

^[106] H.R. 1645 §301(a) (amending §274A(c)(12)(A)(iv)).

^[107] H.R. 1645 §301(a) (amending §274A(c)(15)).

^[108] H.R. 1645 §301(b)(2).

^[109] H.R. 1645 §306(b)(1) (amending §6103(1) of the Internal Revenue Code of 1986).

^[110] H.R. 1645 §306(b)(1) (amending §6103(1) of the Internal Revenue Code of 1986).

^[111] H.R. 1645 §306(b)(1) (amending §6103(1) of the Internal Revenue Code of 1986).

^[112] S.AMDT. 1150 §302(a) (amending §274A(d)(10)).

^[113] S.AMDT. 1150 §302(a) (amending §274A(d)(11)).

^[114] S.AMDT. 1150 §302(a) (amending §274A(d)(9)(D)(ii)).

^[115] S.AMDT. 1150 §302(a) (amending §274A(d)(9)(D)(i)).

^[116] S.AMDT. 1150 §302(a) (amending §274A(d)(9)(B)(v)).

^[117] S.AMDT. 1150 §302(a) (amending §274A(d)(9)(D)(i)).

^[118] H.R. 1645 §301(a) (amending §274A(b)(1)(B), (c)(12)(A)(iii)); S.AMDT. 1150 §302(a) (amending §274A(c)(1)(B) – (c)(1)(F)).

^[119] Marc Rotenberg, Exec. Dir., EPIC, Testimony and Statement for the Record at a Hearing on Social Security Number High Risk Issues Before the Subcomm. on Social Sec., H. Comm on Ways & Means, 109th Cong. (Mar. 16, 2006) [“EPIC Testimony on SSN”], available at http://www.epic.org/privacy/ssn/mar_16test.pdf; EPIC, Spotlight on Surveillance, Federal REAL ID Proposal Threatens Privacy and Security (Mar. 2007), http://www.epic.org/privacy/surveillance/spotlight/0307; EPIC and 24 Experts in Privacy and Technology, Comments on Docket No. DHS 2006-0030: Notice of Proposed Rulemaking: Minimum Standards for Driver’s Licenses and Identification Cards Acceptable by Federal Agencies for Official Purposes (May 8, 2007) [“EPIC REAL ID Comments”], available at http://www.epic.org/privacy/id_cards/epic_realid_comments.pdf.

^[120] Frederick G. Streckewald, Assistant Deputy Comm’r, Disability & Income Sec. Programs, Soc. Sec. Admin., Statement at a Hearing on Social Security Number High-Risk Issues Before the Subcom. on Soc. Sec. of the H, Comm. on Ways & Means, 109th Cong. (Mar. 16, 2006), available at http://www.ssa.gov/legislation/testimony_031606a.html.

^[121] Id.

^[122] EPIC Testimony on SSN at 3, supra note 119.

^[123] EPIC REAL ID Comments, supra note 119.

^[124] REAL ID Act of 2005, Pub. L. No. 109-13, 119 Stat. 231 (2005).

^[125] S.AMDT. 1150 §302(a) (amending §274A(c)(1)(F)).

^[126] S.AMDT. 1150 §306.

^[127] EPIC, Comments to the Federal Identity Theft Task Force, P065410 (Jan. 19, 2007), available at http://www.epic.org/privacy/idtheft/EPIC_FTC_ID_Theft_Comments.pdf.

^[128] Id.

^[129] Inspector General Report on SSA Database at 6, supra note 11.

^[130] See discussion, infra.

^[131] Inst. for Survey Research, Temple Univ., and Westat, INS Basic Pilot Evaluation Summary Report (Jan. 29, 2002) [“Summary of Independent Analysis of Basic Pilot”], available at http://www.uscis.gov/files/nativedocuments/INSBASICpilot_summ_jan292002.pdf.

^[132] Id. at 8.

^[133] Id. at 19.

^[134] Id.; H.R. 1645 §301(a) (amending §274A(c)(12)(C)); S.AMDT. 1150 §302(a) (amending §274A(d)(5)(C)).

^[135] Summary of Independent Analysis of Basic Pilot at 19, supra note 131.

^[136] Inspector General Report on Employers at 6, supra note 35.

^[137] Summary of Independent Analysis of Basic Pilot at 19, supra note 131.

^[138] Id. at 19.

^[139] Id. at 20.

^[140] Id. at 20.

^[141] H.R. 1645 §301(a) (amending §274A(c)(12)(C)); S.AMDT. 1150 §302(a) (amending §274A(d)(5)(C)).

^[142] H.R. 1645 §301(a) (amending §274A(c)(19)(C)); S.AMDT. 1150 §302(a) (amending §274A(d)(7)(C)).

^[143] H.R. 1645 §301(a) (amending §274A(c)(19)(D)(ii)).

^[144] Press Release, Bureau of Labor Statistics, Employment Situation Summary, (May 4, 2007), available at http://www.bls.gov/news.release/empsit.nr0.htm.

^[145] H.R. 1645 §301(a) (amending §274A(c)(3)(K)).

^[146] 5 U.S.C. § 552a.

^[147] Homeland Sec. Presidential Directive/HSPD-6, Subject: Integration and Use of Screening Information (Sept. 16, 2003), available at http://www.whitehouse.gov/news/releases/2003/09/20030916-5.html.

^[148] Inspector Gen., Audit Div., Dep’t of Justice, Audit Report No. 05-27: Review of the Terrorist Screening Center 66-67 (June 2005), available at http://www.usdoj.gov/oig/reports/FBI/a0527/final.pdf.

^[149] Id. at xi.

^[150] Id. at 66.

^[151] Walter Pincus & Dan Eggen, 325,13 Names on Terrorism List, Wash. Post. Feb. 15, 2006.

^[152] Anne Broache, Tens of thousands mistakenly matched to terrorist watch lists, CNet News.com, Dec. 6, 2005.

^[153] Edmund S. “Kip” Hawley, Assistant Sec’y, Transp. Sec. Admin., Dep’t of Homeland Sec., Testimony at Hearing on Aviation Security: Reviewing the Recommendations of the 9/11 Commission Before the S. Comm. on Commerce, Science & Transportation, 110th Cong. (Jan. 17, 2007), available at http://commerce.senate.gov/public/_files/TestimonyofMrHawley.pdf.

^[154] EPIC Testimony on SSN at 3, supra note 119.