Congress asks for assurances of E-Verify information security

Congress pressed officials with the Homeland Security Department and Social Security Administration on Thursday for assurances that an individual's personal information would remain secure during expansion of the system used to verify work eligibility.

As of July 18, more than 137,000 employers are enrolled in the electronic employment verification system known as E-Verify, with an additional 1,000 employers signing on every week, said Gerri Ratliff, deputy associate director of the National Security and Records Verification Directorate at Homeland Security's U.S. Citizenship and Immigration Services bureau, during testimony before a House Oversight and Government Reform subcommittee. Employers have run more than 6.4 million queries in fiscal 2009 so far.

Those numbers are expected to increase dramatically. DHS last week announced that by Sept. 8, federal contractors must begin using E-Verify to confirm that employees assigned to federal contracts are allowed to work legally in the United States. This will result in an additional 3.8 million system queries by September 2010 alone, Ratliff said. In addition, the Senate passed an amendment earlier this month that would allow employers to verify the work eligibility of existing employees, not only new hires.

"Given our current system capacity, we're well poised to handle that," Ratliff said, adding the online application could deal with as many as 65 million queries, though more staff would be needed.

Rep. Gerald Connolly, D-Va., questioned whether -- as the number of individuals certified by E-Verify increases -- contractors and employees are at risk of personal identifiable information being compromised because of a cyberattack, and what USCIS is doing to thwart hackers from infiltrating the system.

Ratliff said the E-Verify system meets all federal standards for information security and privacy.

"That's a bureaucratic answer," Connelly replied. "Lots of agencies are meeting standards, yet the hacking incidents are growing. Meeting standards is not a satisfactory answer."

Ratliff agreed to work with the Government Management, Organization and Procurement Subcommittee to develop additional security provisions as needed. She also pointed to efforts by USCIS to prevent fraud, including attempts to expand the type of documents used for photo confirmation. Currently, only DHS-issued identity documents are displayed in E-Verify's photo tool.

"USCIS is assessing the feasibility of a state-based department of motor vehicles data exchange that would incorporate driver's license photos into the photo tool," Ratliff said. "This would represent a significant enhancement to the system, since new hires most often present a driver's license for [Employment Eligibility Verification Form] I-9 purposes." To date, no state has yet agreed to add its driver's license data to the photo tool, according to Ratliff. She also noted that USCIS is in the final stages of developing an initiative that would enable victims of identity theft to "lock" and "unlock" their records in E-Verify.

DHS sends the information entered into the Web-based system to SSA, which electronically verifies that a new hire's Social Security number, name and date of birth match the information in its records. The subcommittee's ranking member Brian Bilbray, R-Calif., expressed concern about potential breach of Social Security numbers, which could be used for identity fraud.

"The role of the SSN card is simply a record of the number assigned to the worker so that he or she can provide the correct number to the employer," said David Rust, deputy commissioner for retirement and disability policy at SSA. "The SSN card was never intended, and does not serve, as a personal identification document. Although we have made many changes over the years to make the card counterfeit-resistant and continue to work to strengthen its security, the card does not contain information that would allow it to be used as proof of identity."