Why California Continues To Put Millions At Risk Of ID Theft: The EDD Responds
SACRAMENTO (CBS13/KPIX 5) — One of the nation's largest state agencies says it is finally removing Social Security numbers from a document mailed every two weeks to millions of Californians—years after it told CBS13 and lawmakers it had already removed the numbers. However, a spokeswoman for the state Employment Development Department (EDD) says the agency will continue to print SSNs on other mailed documents and the EDD admits it doesn't know how many people have been compromised by the mailings so far.
Follow Our Continuing Coverage
CBS13 Investigates EDD Identity Theft Concerns
Following CBS13 's reporting in 2015, and subsequent demands by lawmakers, the EDD agreed to stop printing full Social Security numbers on clearly-marked, biweekly-mailed documents. EDD also said that online enrollees could opt out of paper mailings with their SSNs three years ago.
Contrary to assurances from the agency, reporter Julie Watts recently found her own Social Security number printed on EDD documents mailed to her while on maternity leave. She was enrolled in EDD's online services.
In response, the EDD now admits that online enrollees cannot opt out of mailings that print their Social Security number and the agency agreed to add a disclaimer to the website.
In a recent interview, Deputy Director of Communications Loree Levey said, while the agency has finally removed the SSNs from the biweekly statements sent to anyone collecting disability, maternity or paid family leave benefits, there are no immediate plans to stop printing Social Security numbers on more than 200 other mailed forms sent to millions of people.
She also said that the agency does not know how often it mails sensitive information to the wrong address and won't reveal how many people have contacted the agency to complain about mail theft, misdirected mail or other concerns involving SSNs printed on mailed EDD documents.
Consumer advocates are calling on Attorney General Xavier Becerra and Gov. Jerry Brown to take action and force the agency to immediately stop putting millions of Californians at risk of identity theft.
CBS13 shared our findings with Gov. Brown's office, which oversees the EDD, and with Attorney General Becerra, who has the power to take legal action. Both declined to comment, referring us back to the EDD.
VICTIMS & ADVOCATES CALL FOR CHANGE
Seasonal tax preparer Mary Shaw knows what can happen when sensitive information gets into the wrong hands.
"I help with restoration when it comes to identity theft. It takes a long time to straighten that kind of thing out," Shaw explained.
She said she goes to great lengths to protect her mail and her identity. She files her taxes online to keep her Social Security number out of the mail and she even enrolled in Informed Delivery from the USPS. The service scans and e-mails users images of each letter before it leaves the post office.
That is how she learned that, despite her best efforts, the Employment Development Department may have compromised her anyway.
Like millions of Californians who collect unemployment, disability, maternity or paid family leave, the EDD sends Shaw clearly-marked letters with her full Social Security number printed inside.
And, thanks to the USPS Informed Delivery e-mail, she knows one recent letter from the EDD left the post office but never arrived. Every other letter was delivered.
"This particular one was the only one with sensitive information and it was the one that disappeared," she told CBS13. "Someone knew that my document might give them a Social Security number to sell."
The EDD has long defended its printing of Social Security numbers, in part arguing the agency "is not aware of any cases where our forms were used to commit identity theft."
Shaw points out, just because the agency isn't aware of any cases, doesn't mean there aren't cases—or that there isn't any harm.
"I feel like I've been harmed over it. It's caused me a lot of grief," Shaw said.
She had to sign up for credit monitoring and is pulling her credit reports at regular intervals to check for fraud. But, she notes, ID thieves often wait years to use stolen information, hoping victims let their guard down.
"They could use it in a year (or) a couple years and I don't want to have to worry about that," she said, "but I am worrying about it."
Even more frustrating for Mary, she's enrolled in EDD's online benefits but the agency won't let her opt out of duplicate paper mailings that include her full Social Security number.
"They should allow people receiving benefits to opt out of getting mail since they refuse to adhere to California's law."
CONSUMERS CAN'T SUE – BUT ATTORNEY GENERAL XAVIER BECERRA CAN
Envelopes from government agencies like the EDD are a known target for ID thieves and state law prohibits printing someone's Social Security number on mailed documents.
Privacy advocates like Consumer Watchdog's Jamie Court point out that just one EDD envelope contains enough information to steal someone's identity.
"The state is aiding and abetting identity theft by recklessly disregarding their duty to take those Social Security numbers out of those envelopes in the mail," Court said.
Court notes that private companies and insurers have been sued for far less than what the EDD is doing but he says members of the public don't have the legal authority to sue the state in this case.
Attorney General Xavier Becerra, who is currently running for re-election, is one of the few with the legal authority to enforce state law and take legal action against the state agency.
"The AG can sue; the governor should come down on director Henning like a ton of bricks," Court said.
He pointed to Gov. Brown, who appointed EDD Director Patrick Henning, and lawmakers in Sacramento as others who have the power to demand change.
EDD FAILED TO KEEP PROMISES TO LAWMAKERS
Following our reports in 2015, lawmakers from the Assembly privacy committee did demand the EDD stop printing SSNs and the EDD said it would.
In its written response to lawmakers on Oct. 1, 2015, the EDD said it would be "redirecting staff and using existing funds" to immediately remove the SSN from forms that would not "(impact) program efficiency, such as bi-weekly continued claim forms for UI benefits." The agency said it expected the work to be completed on the remaining forms by December 31, 2015.
Despite the assurance to lawmakers, three years later while on maternity leave, CBS13's Julie Watts noticed the EDD was still printing her full SSN on her bi-weekly maternity claim forms. The SSN should have already been removed from those documents which served only to notify her when the EDD deposited money into her account.
Furthermore, in 2016, the EDD repeatedly assured CBS13 that, "EDD customers do have online options that do not involve the mailing of paper documents."
However, as of March 2018, Watts was enrolled in EDD online services and direct deposit, yet she was still getting duplicate mailed statements displaying her full SSN in two places—even though she received the same information via e-mail and in her secure online portal.
Watts shared this information with some of the members of the Assembly privacy committee, which had demanded the changes three years earlier. While each expressed shock and outrage, they acknowledged there was little they could do before the next budget year (2019) to force the agency to stop mailing SSNs.
EDD SAYS IT'S ABOVE THE LAW
CA Civil Code section 1798.85 specifically states: "(A) person or entity may not… print an individual's Social Security number on any materials that are mailed to the individual."
There is an exemption if another state or federal law "requires the Social Security number to be on the document to be mailed."
First, the EDD insisted that federal law did "require" it to use full SSNs, citing the federal Social Security Act. However, the Social Security Administration noted that the EDD is not required to print the Social Security number on mailed documents and other states do truncate or redact SSNs.
In other words, there is no federal law that "requires the Social Security number to be on the document to be mailed."
So next, the agency cited a different state law, Civil Code section 1798.24, which "permits" an agency to disclose "personal information … to the individual to whom the information pertains."
Again, it doesn't "require the Social Security number to be on the document to be mailed, so the state still appears to be in violation of section 1798.85. And, as CBS13 discovered, the state appears to be violating section 1798.24 too.
Following our initial reports, viewers began contacting us from across the state to say they had received other people's EDD documents with full Social Security numbers in the mail. The agency was putting the wrong documents in the wrong envelopes and literally sending people's sensitive information to strangers.
The agency said it does not know how often it discloses personal information to the wrong people.
Finally, the EDD cited a third law that it says exempts the agency from section 1798.85 and authorizes it to mail SSNs. The agency pointed to the Unemployment Insurance Code, which gives EDD Director Patrick Henning the right to "permit the use of any information in his possession to the extent necessary."
Again however, it does not "require the Social Security number to be on the document to be mailed," so that doesn't appear to exempt them from section 1798.85 either.
THE LONG TERM PLAN
Instead of removing or redacting SSNs from all mailed forms, the EDD has opted for a long-term plan to overhaul its antiquated patchwork of computer systems that run the Unemployment, Disability and Paid Family Leave programs.
Eventually, the EDD says the modernization will allow it to replace the SSNs with unique identifiers.
However, even though the agency received the requested $3 million funding for that project last year, it is not even scheduled to begin taking bids from vendors to build the new system until 2020.
State insiders are not optimistic.
They point to an extensive history of failed state technology projects which, in the past few years, have "suffered colossal delays and significant cost overruns" according to a recent audit. In fact, the state recently canceled three major technology projects, forfeiting nearly $900 million it had already paid.
In a recent interview with CBS13, former EDD Director Michael Burnick called the EDD a "large, highly routinized, Weberian bureaucracy."
"They work under a very strict set of protocols and rules, and if you want to make an IT change–any IT change–you can't just make it. You go to agency, agency goes to the Governor's Office, the Governor's Office works with something called the Department of Technology, and the Department of Technology works under its own very, very complex procurement processes," Burnick explained.
Insiders note that it could take a decade or more to complete the EDD's proposed technology overhaul.
In the meantime, the agency says it simply can't figure out how to redact or conceal the millions of SNNs it currently mails—or how to let people opt out of mail all together.
WHY?
If the EDD dedicated staff and funds to this issue—as it claimed it had three years ago—why hasn't the agency been able to come up with temporary low-tech solutions to conceal SSNs on all of its forms?
Why can't it find a way to physically stop mailing documents to people who want to opt out?
Why can't the EDD use the last four digits of a Social Security number, like other state and federal agencies?
EDD director Patrick Henning has repeatedly declined our request for an interview but, after three years and over 100 e-mails, the agency's head of communications recently agreed to an interview in his place.
ANSWERS FROM THE EDD
Deputy Director of Communications Loree Levey began by announcing that, just before the interview, the agency had finally removed Social Security numbers from one of its highest-volume forms—biweekly deposit statements mailed every two weeks to everyone collecting disability, maternity or paid family leave benefits.
The move came after Watts reported that her own Social Security number was still being printed on those forms during her recent maternity leave.
"What prevented you from removing this number three years ago when I first brought it to your attention?" Watts asked.
"All of it takes time and we have numerous forms and … we have limited resources," Levey explained.
Levey added, "We have, for the last three years, been working to mitigate as many forms as we can. I wish we had an easy button in the sky — I really do — for all of our systems. Unfortunately, all of it, with COBOL programming, takes a lot of testing, development, et cetera."
HOW MANY SSNS ARE STILL BEING MAILED?
Levey said that, of the 3,000 different forms which the EDD mails, the agency has identified about 450 that contain an SSN.
According to a list provided to CBS13, the agency says it has removed, replaced or truncated the numbers on 148 forms so far and the EDD plans to mitigate another 13 forms this summer. However, this only addresses about 35 percent of forms with SSNs.
"Now, moving forward, we do have some forms that we're still gonna have to have an SSN on it for various reasons," Levey explained.
"And one of them is, we have some very old — within the patchwork of systems, much of it based on COBOL programming — that have no other way of identifying a claimant except under a Social Security number."
When asked, "How many people are still getting their Social Security numbers in the mail?" Levey said she didn't know because the agency doesn't "track people."
She could only say they send out about three million claims a year. Ultimately, she admitted, the agency simply doesn't know how many Social Security numbers it continues to mail out.
WHY CAN'T ONLINE CUSTOMERS OPT OUT OF MAIL?
In an e-mail to CBS13 investigative reporter Julie Watts dated May 18, 2016, Levey said "EDD customers have online options that do not involve mailing of documents." In a separate e-mail she reiterated to Watts, "We do offer our customers online options that do not require paperwork through the mail."
However, two years later, Watts was enrolled in the EDD's online services but was still getting duplicate mailed statements that included her full SSN.
Levey never directly addressed why the agency had provided the false information to both CBS13 and lawmakers. Instead, she responded to repeated questions with prepared statements noting that the agency had made "significant progress" and had looked at the forms in a "painstaking way."
Eventually, she acknowledged that—despite the previous claims—online enrollees cannot, in fact, opt out of mailings. Levey said the agency is now adding a disclaimer on its website at the suggestion of Assemblywoman Jacqui Irwin, following an interview with CBS13 earlier this year.
"We actually took the recommendation of Assemblywoman Irwin and put the disclaimer up on our website that says 'even though you selected to choose electronic communications, you still may have cause to get a notices from us through the mail in some instances.'"
"Why can't I opt out of mail altogether?" Watts asked.
"We don't have that full capability right now. If we remove SSNs, it would prevent us from being able to pay benefits timely," Levey said, adding, "That's the way our systems were built. That (automatically) triggers that notice. (That's) the best we can do right now."
She couldn't explain why the agency can't come up with low-tech solutions to physically prevent unwanted mail from being sent to the post office—like dedicating staff to plucking selected automatic notices out of a batch of mail.
WHAT ABOUT OTHER LOW-TECH SOLUTIONS?
Levey admits that some forms like paid family leave are processed manually, which provides the opportunity for some low-tech solutions. Watts questioned why, instead of typing in the full SSN, they couldn't manually truncate the number by only typing in the last 4 digits.
"Why can't the person just type in XXX-XX-1234? Why must they type in the entire social?" Watts asked.
Levey argued the agency could not operate using just the last four digits. "In our system we have 55 Smiths with the same last four digits of a Social Security number," she claimed.
"But do they all live at the same address?" Watts asked.
"We would have to painstakingly go through every one of those. It would take us hours, it would really elongate the time," she said.
While an SSN might be necessary for identification purposes on an incoming document, Levey didn't explain exactly why the agency needs to print the full SSN on an outgoing mail, especially to claimants already enrolled online.
However, when asked, she did say that using paper stock with pre-printed black boxes to conceal the number would be too cumbersome for the agency because they are still printing the numbers on so many different types of forms.
CONCEALING COMPLAINTS
Shortly before the interview, Levey said in an e-mail, "The EDD is not aware of any cases where our forms have been used to commit identity theft."
It's a sentiment the EDD has echoed for years and one that lawmakers have reiterated to CBS13 in defense of the agency.
During the interview, Watts asked Levey to clarify how the agency might become aware of identity theft.
"I don't know," Levey admitted. "But I can tell you, we're not aware of that."
"Because ID thieves don't generally call the EDD to say 'Hey I stole this person's identity,'" Watts pointed out.
But viewers have been complaining to CBS13 about compromised EDD documents for years.
Maxine Hines was the first to bring the security risk to CBS13 's attention.
When Hines complained to the EDD, she said the response she got from an employee surprised her. "She kind of laughed a bit, and said 'a lot of people have complained.'"
Shortly after seeing Hines' story on CBS13 Jody Howard noticed the EDD had mistakenly sent her someone else's EDD documents along with her own.
"How in the world did this piece of paper get into an envelope addressed to me?" she wondered. She said she could not get hold of anyone at the EDD to let them know about the mistake.
Alicia Brown, from Glendale, tweeted "I once received someone else's EDD letter attached 2 mine w/ their ss#! I complained as well but nothing was done."
We have received many similar complaints from people who say they contacted the EDD to report issues ranging from misdirected mail to mail theft.
"How often does that happen?" Watts asked Levey.
"I can tell you it's very rare," Levey responded, adding, "We don't hear that many cases and, when we do, we go ahead and follow the prescribed process by forwarding it up to the Information Security Office."
CBS13 has repeatedly requested redacted information regarding the number of complaints and types of complaints that the EDD receives related to Social Security numbers or misdirected mail.
While we have never requested information that might identify a complainant, the EDD has repeatedly denied our requests stating either that the information is confidential or that they don't track the complaint information we are seeking.
"So, you won't tell us how often you mess up and compromise people's identity?" Watts asked.
"I can't," Levey admitted, "I don't have that information."
Following our initial reports in 2015, internal agency e-mails revealed that employees asked for standard language to respond to SSN-related complaints.
Still, the agency contends it does not track complaints and it has no idea how many people have been compromised. The agency's position remains: there is no evidence anyone has been harmed.
ONGOING
Mary Shaw feels she has absolutely been harmed; "My information is out there and I don't know who has it."
She is now forced to take the time-consuming steps of proactively protecting her identity, "And that's a lot of work and it's ongoing."
Also ongoing: the agency's efforts to stop putting people at risk of ID theft. Meanwhile, Shaw says the EDD is still printing her SSN on the documents it sends to her.
Follow Our Continuing Coverage at:
CBS13 Investigates: EDD Identity Theft Concerns
NOTE: CBS13 Investigative Reporter Julie Watts was based at the CBS San Francisco station (KPIX) when this investigation began and has continued the work after moving to CBS Sacramento. The stories have aired on CBS stations across California.
