Lawmakers Order EDD Audit Following CBS13 Investigation
SACRAMENTO (CBS13/KPIX5) — One of California's largest agencies promised lawmakers it would make changes following a CBS13 (KPIX) investigation. But, three years later, we discovered they broke that promise and are still putting millions at risk for identity theft. Now, citing our investigation, lawmakers have launched an investigation of their own. They're embedding a state auditor inside the Employment Development Department for five months to figure out why that agency can't seem to stop compromising Social Security numbers.
Follow Our Continuing Coverage
CBS13 Investigates EDD Identity Theft Concerns
California Assemblywoman Catharine Baker, speaking before the Joint Legislative Audit Committee (JLAC) on Wednesday, summarized three years of CBS13's investigative reports as she asked the bi-partisan group of lawmakers to approve an audit of the EDD.
She noted "inconsistent answers" from the state's largest agency in response to our findings over the years. Recounting to lawmakers that the EDD first implied "that the federal government required the Social Security numbers to be used. Baker added, "We later found that was not the case."
Also Read: Why California Continues To Put Millions At Risk Of ID Theft: The EDD Responds
State law prohibits printing social security numbers on mailed documents, unless it's required by federal law. The EDD initially said the federal government requires that they use Social Security numbers. However, both the Department of Labor and the Social Security Administration later confirmed that there is no requirement to print the numbers on mailed documents.
As CBS13 first reported in 2015, viewers like Maxine Hines were horrified to discover the state was printing full Social Security numbers on documents mailed to the millions of Californians collecting benefits for unemployment, disability and maternity leave.
When Hines, a former IRS employee, called the EDD to complain: "(The representative) kinda laughed a bit and said, 'yeah, a lot of people complain.'"
Then we discovered the EDD was also mishandling that sensitive mail. Viewers from across California contacted us with complaints ranging from full Social Security numbers exposed in the clear plastic EDD envelope window to the EDD mailing them other people's documents with full SSNs.
After seeing our reports in 2015, lawmakers demanded that the EDD make changes and the agency promised it would. Catharine Baker was among the members of the 2015 Assembly Committee on Privacy and Consumer Protection who sent a letter to the EDD demanding that they stop printing SSNs.
"The response that we received from EDD stated that they would work to remove Social Security numbers and that all SSNs would be removed from all forms by December 2015," Baker explained Wednesday to the Joint Legislative Audit Committee. She added that EDD also implied online customers could opt out of paper mail.
Yet, nearly three years after that 2015 deadline, CBS13 reporter Julie Watts discovered that the EDD was still mailing full Social Security numbers, even to online enrollees who had opted-out of paper mail. Watts received her own Social Security number on EDD documents while on maternity leave in 2018.
Following public records requests in 2018, CBS13 learned that the state was still printing full Social Security numbers on more than 250 different types of forms and had decided to continue printing the full numbers until the agency gets around to replacing its antiquated legacy computer system.
CBS13 then learned that the agency isn't even scheduled to start taking bids from vendors to build the new IT system until after 2020. In light of the extensive history of failed state technology projects, insiders say the project, in all, could take a decade or more to complete.
Assemblywoman Baker explained to lawmakers on Wednesday that she, again, reached out to the director of the EDD after our 2018 follow-up reports.
"The answer that I received, and that we continue to receive, is 'this is a good as we can do and what we said before wasn't quite right and now its going to take many years to make the kind of changes necessary," she told lawmakers.
So, Baker requested an EDD audit to determine if something could be done — right now — to conceal or remove SSNs from mail until the long-term IT solution can be implemented.
In response, EDD Director Patrick Henning set up meetings with committee members ahead of the hearing, asking them to refuse the audit.
Henning vigorously defended the agency to lawmakers during Wednesday's hearing.
"We received the best rating from the Social Security Administration. They tell me we are the best at keeping people's information private," Henning told lawmakers.
"Are you OK with the audit then?" Southern California Assemblywoman Blanca Rubio asked in response.
Henning ultimately noted that it wasn't up to him.
During his remarks to the committee, Henning defended the agency's continued use of SSNs in mail by pointing to the federal government. "We will frankly never be able to get rid of Social Security numbers, and its use, in the Unemployment System. And it's not a state issue, it's the way the Federal Government gives us a way to move about money.
Rubio later questioned the Director about the implication that the Feds require they print the numbers.
Assemblywoman Rubio: "Right now you just made a statement that the federal government is requiring you to put the Social Security number on there."
Henning: "I didn't make that statement."
Rubio: "I just heard it, so."
Henning: "It sounds like a nuance but what the federal government says is that we need to identify people."
Southern California Senator Richard Roth later pointed out that even federal agencies can now identify people without mailing Social Security numbers.
"I have this thing called a Medicare card," Roth said noting that the federal agency had recently replaced Social Security numbers with unique identifiers for Medicare recipients. "So I know this can be done," he added.
The director argued that removing SSNs would cost "a lot of money" and that an audit focused on protecting Social Security numbers would distract from the agency's other priorities. However, the committee unanimously approved the audit, noting that the agency clearly needed outside help.
JLAC Chairman, Assemblyman Muratsuchi, pointed out that the auditor essentially serves as a consultant and can provide "new ideas or new suggestions, or perhaps a foundation for future budget requests for updates to the computer systems." Several members indicated that they would consider additional funding in order to expedite the removal of SSNs.
The auditor will now examine why the EDD has failed to follow through with its promise to remove SSNs from mail, what can be done to immediately stop mailing the full numbers on outgoing mail and how much it will cost to implement an immediate fix.
Follow Our Continuing Coverage at:
CBS13 Investigates: EDD Identity Theft Concerns
NOTE: CBS13 Investigative Reporter Julie Watts was based at the CBS San Francisco station (KPIX) when this investigation began and has continued the work after moving to CBS Sacramento. The stories have aired on CBS stations across California.
