oversight

Prison Work Programs: Inmates' Access to Personal Information

Published by the Government Accountability Office on 1999-08-18.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                 United States General Accounting Office

GAO              Report to the Honorable Charles F. Bass
                 House of Representatives



August 1999
                 PRISON WORK
                 PROGRAMS
                 Inmates’ Access to
                 Personal Information




GAO/GGD-99-146
United States General Accounting Office                                                               General Government Division
Washington, D.C. 20548




                                    B-280467
                                    August 18, 1999

                                    The Honorable Charles F. Bass
                                    House of Representatives

                                    Dear Mr. Bass:

                                    This report responds to your request that we obtain information on
                                                                          1
                                    correctional industry work programs under the federal Bureau of Prisons
                                                                        2
                                    (BOP) and in state prison systems that allow inmates access to personal
                                    information. For this assignment, we defined personal information as
                                    information that can be used to threaten an individual’s physical,
                                    psychological, or financial well-being. This information would include (1)
                                    credit card numbers (personal or business); (2) Social Security numbers;
                                    or (3) names in combination with physical descriptions or financial,
                                    medical, or motor vehicle information. You also were interested in
                                    information on inmates who had access to only names and addresses or
                                                         3
                                    telephone numbers. This type of information tends to be more readily
                                    available to the public, such as through telephone books, than personal
                                    information.

                                    More specifically, you asked for information on

                                 • the extent to which inmates in the BOP and state prison systems had
                                   access to personal information through correctional industry work
                                   programs;
                                 • prison safeguards and procedures, statutes and regulations, and proposed
                                   legislation that addressed correctional industry work programs involving
                                   personal information;
                                 • the extent to which contracts that provided inmates access to personal
                                   information contributed to BOP’s and states’ correctional industry income;
                                 • the extent to which BOP and state prison inmates had access to only
                                   names and addresses or telephone numbers through correctional industry
                                   work programs; and

                                    1
                                    For our study, we defined correctional industry work programs as work programs that produce
                                    products and services for sale to government agencies and/or to the private sector.
                                    2
                                        For this report, when we refer to state or states, we are including the District of Columbia.
                                    3
                                     When we use the phrase “names and addresses or telephone numbers” we are referring to names and
                                    one or more of the following: work or home addresses or telephone numbers, names of employers, or
                                    job titles but no other item that we defined as personal information.




                                    Page 1                                    GAO/GGD-99-146 Inmates’ Access to Personal Information
                     B-280467




                   • incidents of inmates misusing information obtained through correctional
                     industry work programs, including how safeguards failed and what, if any,
                     changes were made as a result of the incidents.

                     To answer these questions, we surveyed BOP and state correctional
                                                4
                     industry officials by mail. Although questionnaire respondents provided us
                     with data on the number of inmates with access to personal information or
                     only names and addresses or telephone numbers, it should be noted that
                     some officials told us that these data were estimates. We also contacted
                     states’ attorneys general and the special counsel for the District of
                     Columbia, interviewed officials from federal investigative agencies, and
                     conducted literature and database searches.
                                                                                              5                               6
                     On September 30, 1998, of approximately 1.2 million inmates, about 1,400
Results in Brief     in BOP and 19 state prison systems had access to personal information
                     through correctional industry work programs, based on the questionnaire
                     responses from correctional industry officials.

                   • Of these 1,400 inmates, about 1,100 had access to names and dates of birth
                     or Social Security numbers. These inmates were performing work, such as
                     data entry, for the federal, state, or local governments.
                   • BOP and all of the 19 states reported using a variety of safeguards to
                     prevent inmates from misusing the information. The safeguards cited by
                     the largest number of states were close supervision; selective hiring (e.g.,
                     excluding inmates convicted of sex offenses or fraud); confidentiality
                                  7
                     agreements; and security checks at the exits from the work areas. The
                     federal government and seven states in which inmates had access to
                     personal information were identified as having either enacted statutes or
                     had bills pending that related to limiting which inmates could perform
                     work involving personal information.


                     4
                      Representatives from Arizona’s state-run facilities, Ohio, and Tennessee declined to respond to our
                     questionnaire. The representatives from Arizona and Ohio told us that they would not respond due to
                     limited staffing. The Ohio representative informed us that inmates involved in data entry work
                     programs did not have access to credit card numbers or Social Security numbers. Arizona provided
                     information on work programs in privately run facilities, which we included in our analyses.
                     5
                      The latest date for which data were available from the Bureau of Justice Statistics on the number of
                     inmates in custody in federal and state correctional facilities was June 30, 1998. See Prison and Jail
                     Inmates at Midyear 1998, Bureau of Justice Statistics, March 1999, NCJ 173414.
                     6
                     This number is an estimate because, as noted previously, state-run facilities in Arizona, Ohio, and
                     Tennessee declined to respond to our survey.
                     7
                      Confidentiality agreements are agreements signed by the inmates not to release information obtained
                     through a work program.




                     Page 2                                GAO/GGD-99-146 Inmates’ Access to Personal Information
               B-280467




             • Less than one-hundredth of 1 percent of BOP’s and no more than 22
               percent of any state’s fiscal year 1998 gross correctional industry income
               was generated from contracts that resulted in inmates having access to
               personal information. Six states reported that less than 1 percent of their
               gross correctional industry income was earned from these contracts.

               In addition, about 5,500 inmates in BOP and 31 state prison systems had
               access to only names and addresses or telephone numbers through
                                                                               8
               correctional industry work program contracts or support work. The three
               safeguards that the largest number of states and BOP reported using were
               similar to those used when inmates had access to personal information—
               close supervision, security checks at the exits from the work areas, and
               selective hiring.

               Questionnaire respondents described nine incidents in which inmates
               misused personal information or names and addresses or telephone
               numbers obtained from correctional industry work programs. In four of
               the nine incidents, inmates removed information from the work areas,
               either physically or by memorization. In five of the incidents, the work
               programs were discontinued.

               In 1995, the latest year for which complete data were available, about 65
Background     percent (or about 647,000) of the inmates in custody in federal and state
                                       9                                                 10
               places of confinement participated in 1 or more types of work programs.
               These work programs included prison industries (e.g., involving the
               manufacture of license plates, wood products, and textiles); facility
               support services (e.g., doing office and administrative work, food service,
               laundry, and building maintenance); farming/agriculture; and public works
               assignments (i.e., inmates working outside the facility on road, park, or
               other public maintenance work). Data entry was the type of work that
               most often allowed inmates access to personal information.



               8
                We defined a contract as a formal or informal agreement (including purchase orders) to produce a
               specific product or perform a specific service. By support work, we mean inmates who were not
               associated with a specific correctional industry work program contract but who had access to personal
               information by performing tasks, such as order taking, order fulfillment, manufacturing or customer
               support, complaint resolution, or shipping, that supported the industry work program operations.
               9
                Places of confinement included prisons; prison hospitals; prison farms; boot camps; and centers for
               reception, classification, or alcohol/drug treatment.
               10
                  The latest date for which these data were available from the Bureau of Justice Statistics was June 30,
               1995. See Census of State and Federal Correctional Facilities, 1995, Bureau of Justice Statistics, August
               1997, NCJ-164266.




               Page 3                                GAO/GGD-99-146 Inmates’ Access to Personal Information
                B-280467




                One mission of the Federal Prison Industries (FPI), a BOP component, is
                to employ and provide skills training to the greatest practicable number of
                inmates and to produce market priced quality goods in a self-sustaining
                manner that minimizes potential impact on private business and labor. FPI
                markets about 150 types of products and services to federal agencies.

                Some states had similar programs and provisions. For example, Alabama
                generally requires state departments, institutions, and political
                subdivisions to purchase their products and services from Alabama
                Correctional Industries, to the extent to which they can be supplied. In
                addition, only those entities can purchase Correctional Industries
                products. According to the Alabama Correctional Industries purpose
                statement, it exists primarily for the purpose of providing a work-training
                program for inmates of the Department of Corrections. Another important
                purpose is to assist all state departments, institutions, and political sub-
                divisions of the State to secure their requirements to the greatest possible
                extent.

                To obtain information on the assignment objectives, we surveyed BOP and
Scope and       state correctional industry officials by mail. We asked the officials to
Methodology     answer questions on correctional industry work programs in federal, state,
                and privately run facilities for which the federal or state government or
                state-appointed organizations had oversight. We limited the questionnaire
                to work programs associated with secure, confined facilities, including
                youth authorities but excluding programs associated with prerelease
                facilities and city and county jails. We asked

              • if on September 30, 1998, they had inmates who, through performing (1)
                work on correctional industry work program contracts that were either in
                progress or were agreed to but the work had not been started or (2)
                support work for the industry work program operations, had access to
                personal information or only names and addresses or telephone numbers;
              • what prison procedures, statutes, regulations, pending legislation, or other
                guidelines provided guidance on (1) limiting which inmates perform work
                involving access to personal information and (2) preventing personal
                information from being retained by inmates or being transferred to
                unauthorized inmates or other persons;
              • what the total gross income was for the correctional industry work
                program and the income generated by those contracts that resulted in
                inmates having access to personal information in the most recently
                completed fiscal year; and
              • what incidents of misuse occurred as a result of inmates having access to
                the information through correctional industry work programs.



                Page 4                      GAO/GGD-99-146 Inmates’ Access to Personal Information
                        B-280467




                        We received responses from BOP, 47 states, and the District of Columbia.
                        We did not independently verify the information provided by questionnaire
                        respondents. We did, however, compare the questionnaire responses to the
                        results of our current literature and legal database searches. After we
                        consolidated the data received from the questionnaire respondents in the
                        tables included in this report, we faxed the compiled information to all of
                        the questionnaire respondents for confirmation of the accuracy of the data
                        displayed and made corrections as necessary.

                        We interviewed BOP and state officials. We also contacted states’
                        attorneys general to obtain information on (1) incidents of misuse of which
                        they were aware and (2) state statutes or regulations, pending legislation,
                        or other guidelines that provided guidance on work programs involving
                        personal information.

                        We requested comments on a draft of this report from BOP and the
                        Correctional Industries Association, Inc. They provided written comments
                        that are summarized at the end of this report and are reprinted in
                        appendixes X and XI.

                        We performed our work from June 1998 to June 1999 in accordance with
                        generally accepted government auditing standards. Appendix I provides
                        more details on our objectives, scope, and methodology.

                        On September 30, 1998, about 1,400 inmates in BOP and 19 state prison
Extent to Which         systems had access to personal information through correctional industry
Inmates Had Access to   work programs, according to the questionnaire respondents. This number
Personal Information    accounts for (1) about one-tenth of 1 percent of all inmates in custody as
                        of June 30, 1998, (or approximately 1.2 million) and (2) about 2 percent of
                        all inmates participating in correctional industry work programs
                        (approximately 61,500). Almost all of the inmates who had access to
                        personal information were being held in federal or state-run facilities
                        (1,332 inmates) as opposed to privately run facilities (25 inmates).

                        The number of inmates with access to personal information in each of the
                        19 states ranged from 6 in New Jersey to 426 in California. The types of
                        information to which the largest number of inmates had access were (1)
                                                                                 11
                        names and dates of birth or (2) Social Security numbers. About 30

                        11
                         The numbers of inmates having access to specific types of personal information are the maximum
                        number that would have had access to the information. Some inmates worked on more than one
                        contract. Also, we asked respondents for the number of inmates on each contract and the types of
                        information to which inmates had access. However, each inmate may not have had access to all the
                        types of personal information involved in a contract.




                        Page 5                              GAO/GGD-99-146 Inmates’ Access to Personal Information
    B-280467




    percent of the inmates had access to names and (1) drivers’ license
    numbers or (2) vehicle makes and models. Appendix II shows the number
    of inmates in BOP and individual state prison systems that had access to
    personal information on September 30, 1998, and the types of information
    to which they had access.

    Most of the inmates who had access to personal information were
    performing work for federal, state, or local governments (93 percent) as
    opposed to private sector companies (7 percent). Over half of the inmates
    with access to personal information were involved in data entry work.
    Another about 25 percent of the inmates were duplicating or scanning
    documents. Types of information processed in these work programs
    included

•   medical records;
•   state, county, or local licenses;
•   automobile registrations;
•   unemployment records;
•   student enrollment data; and
•   accident reports.

    The length of time the contracts that resulted in inmates having access to
    personal information had been in effect ranged from less than 1 year to 19
    years. About 1 quarter of the contracts had been in place from 10 to 19
    years; the remainder were more recent. The reasons BOP and states most
    commonly identified for selecting the contracts that resulted in inmates
    having access to personal information were the contracts

•   provided valuable job skills training,
•   satisfied a need or demand for a service,
•   were needed to provide work for more inmates,
•   were profitable, and
•   provided work that was relatively easy for training inmates.

    Questionnaire respondents from 11 states said they planned to add and/or
    expand existing correctional industry work programs that allow inmates
    access to personal information. Respondents from 29 states said they did
    not plan to add or expand existing work programs that would allow
    inmates access to personal information, and respondents from 8 states
    said they did not know whether their states had plans to add and/or
    expand existing correctional industry work programs that would allow
    inmates access to personal information.




    Page 6                       GAO/GGD-99-146 Inmates’ Access to Personal Information
                        B-280467




                        In response to our survey, 29 states indicated that inmates did not have
                        access to personal information on September 30, 1998. The more
                        commonly stated reasons were that the opportunity had not presented
                        itself, the prisons prohibited such work programs, and public opinion
                        limited the feasibility of implementing such work programs.

                        BOP and each state that had work programs in which inmates had access
Safeguards Used When    to personal information reported that they had in place a variety of
Inmates Had Access to   safeguards to prevent inmates from misusing personal information. In
Personal Information    addition, BOP and most of the states in which inmates had access to
                        personal information reported that they had prison procedures that limited
                        which inmates could perform work that would give them access to
                        personal information. The federal government and seven states in which
                        inmates had access to personal information were identified as having
                        either enacted statutes or had bills pending that related to limiting which
                        inmates could perform work involving personal information.

                        The safeguards most frequently reported as being used when inmates had
                        access to personal information were close supervision; selective hiring
                        (e.g., excluding inmates convicted of sex offenses or fraud); confidentiality
                        agreements; and security checks at the work area exits. Other commonly
                        used safeguards included security checks at the work area entrances, no
                        photocopy machines in the work area, and monitored telephone calls.
                        Appendix III provides additional information on the safeguards cited by
                        questionnaire respondents.

                        BOP and most of the 19 states in which inmates had access to personal
                        information reported that they had prison procedures that placed
                        limitations on which inmates could perform work that would give them
                        access to personal information. Questionnaire respondents from BOP and
                        18 states said that they screened inmates before hiring them for work
                        programs involving personal information. For example, one state
                        respondent said that inmates who were convicted of rape or who have life
                        sentences were ineligible to work on contracts where they would have
                        access to personal information. In addition, in the course of our work,
                        statutes or proposed legislation related to this issue were identified in
                        seven of the states as well as the federal government in which inmates had
                        access to personal information. A brief summary of these provisions is
                        provided in appendix IV, table IV.1.

                        Further, six states were identified in which inmates did not have access to
                        personal information that had enacted statutes or introduced legislation




                        Page 7                      GAO/GGD-99-146 Inmates’ Access to Personal Information
                        B-280467




                        that related to this issue. For more information on these statutes and
                        pending bills, see appendix IV, table IV.2.

                        Less than one-hundredth of 1 percent of the BOP’s annual gross
Income Generated        correctional industry income of $568 million was generated from its
From Contracts That     contract that allowed inmates access to personal information. For those
Allowed Inmates         states in which inmates had access to personal information, no more than
                        22 percent of any state’s gross fiscal year 1998 correctional industry
Access to Personal      income was generated from these contracts; six states reported that less
Information             than 1 percent of their gross correctional industry income was earned from
                        these contracts. In total, these states grossed about $18 million in 1998
                        from correctional industry work program contracts that allowed inmates
                        access to personal information, compared to an annual gross correctional
                        industry income of about $515 million. Appendix V provides information
                        on the income generated from these contracts.

                        About 5,500 inmates, in BOP and 31 state prison systems, had access to
Extent to Which         only names and addresses or telephone numbers through correctional
Inmates Had Access to   industry work programs. Over half of these inmates were in the custody of
Only Names and          BOP. Appendix VI presents these data by BOP and state. The types of work
                        inmates were performing in the largest number of states in which they had
Addresses or            this access were order fulfillment, data entry, shipping, and printing. For
Telephone Numbers       additional information on the types of work performed by inmates with
                        access to only names and addresses or telephone numbers, see appendix
                        VII.

                        The safeguards that BOP and most states reported using when inmates had
                        access to only names and addresses or telephone numbers were similar to
                        those reported being used when inmates had access to personal
                        information. The most commonly used safeguards reported by states
                        included close supervision while working, security checks at the exits
                        from the work areas, selective hiring, and security checks at the entrances
                        to the work areas. For additional information on safeguards that BOP and
                        states used when inmates had access to only names and addresses or
                        telephone numbers, see appendix VIII.

                        Questionnaire respondents from eight states reported a total of nine
Incidents of Inmates    incidents in which inmates misused personal information or names and
Misusing Personal       addresses or telephone numbers that they obtained from a correctional
Information or Names    industry work program. We defined misuse of information as any action
                        that threatened or caused injury to the physical, psychological, or financial
and Addresses or        well-being of any member of the public. Each of these incidents was
Telephone Numbers       associated with a different contract. Six of the incidents involved inmates



                        Page 8                      GAO/GGD-99-146 Inmates’ Access to Personal Information
  B-280467




  contacting individuals identified through a work program by telephone or
  by mail (in one of these instances, the inmate in the work program passed
  information on an individual to another inmate, who then contacted the
  individual). Two incidents involved inmates using credit card numbers that
  they obtained through participating in a work program. The other incident
  involved two inmates’ attempts to smuggle copies of documents out of the
  prison through the U.S. mail.

  Five of the contracts related to these incidents were terminated after the
  incident occurred. In three of the four other incidents, the prison
  responded by either adding new safeguards or reinforcing existing
  safeguards used on the contract. In the remaining incident, the prison’s
  procedures remained the same. For more information on these incidents,
  see appendix IX.

  Questionnaire respondents also provided information on four additional
  incidents that did not meet the previously described criteria for misuse of
  personal information. On the basis of one or more of the following
  reasons, these four incidents were not included in appendix IX: no
  reported injury, a court finding of no wrongdoing, or termination of the
  inmate from the work program on the basis of an allegation or suspected
  wrongdoing. These incidents, however, resulted in some type of program
  change. The types of program changes ranged from adding or reinforcing
  policies and safeguards to program termination. Briefly, these incidents, as
  reported by the respondents, consisted of the following:

• An inmate was processing accident reports in a data entry work program.
  He told another inmate, not in the work program, about an individual
  involved in one of the accident reports he processed. The other inmate
  contacted the individual involved in the accident. The questionnaire
  respondent reported that nobody was harmed, safeguards did not fail, and
  no sanctions were taken. After this incident, the state reportedly
  reinforced its policies and safeguards associated with this contract.
• An inmate working in a data entry work program saw, reportedly by
  accident, a state document that had information about one of his family
  members. He spoke with another member of his family about the
  information he saw. A member of his family filed a lawsuit claiming that
  the inmate should not have had access to this information. The
  questionnaire respondent reported that the case was dismissed because
  the information was covered by an open record regulation whereby birth
  records are considered to be public records. The state, however, canceled
  the contract for processing this type of information.




  Page 9                     GAO/GGD-99-146 Inmates’ Access to Personal Information
                        B-280467




                      • An inmate working in a telemarketing work program was accused of
                        harassing a customer. The inmate was terminated and transferred to
                        maximum security on the basis of the allegation alone. The state
                        reportedly implemented additional safeguards after the alleged incident
                        was reported.
                      • An inmate wrote a letter to an individual, and it was suspected that the
                        inmate obtained the individual’s name and address through the work
                        program. According to the survey response, the inmate was disciplined
                        and terminated from the work program, and a measure providing for the
                        closer monitoring of inmates was instituted.

                        In commenting on our report, BOP concurred with our report with one
Agency Comments and     exception. BOP noted that since our survey, it changed its procedures, and
Our Evaluation          no inmates in the BOP prison system have access to personal information.
                        Since our methodology was to report on the number of inmates who had
                        access to personal information on September 30, 1998, we did not
                        eliminate the 25 BOP inmates who we reported as having access to
                        personal information. (See app. X.)

                        The Correctional Industries Association, Inc., in its comments said that our
                        report was fair and thorough and presented the facts objectively. However,
                        it took two exceptions with the report. First, the Association said that the
                        information on inmates’ access to personal information is presented
                        largely out of context. We disagree. Our draft report said that of
                        approximately 1.2 million inmates, about 1,400 in BOP and 19 state prison
                        systems had access to personal information through correctional industry
                        work programs. We noted that less than one-hundredth of 1 percent of
                        BOP’s and no more than 22 percent of any state’s fiscal year 1998 gross
                        correctional industry income was generated from contracts that resulted in
                        inmates having access to personal information. Further, we pointed out
                        that about a quarter of the contracts that resulted in inmates having access
                        to personal information had been in place from 10 to 19 years.

                        Second, the Association said that a benchmark is needed against which the
                        success or failure of correctional industries to control access issues can be
                        measured. We did not judge whether the correctional industries have
                        succeeded or failed in their attempt to prevent the misuse of personal
                        information to which inmates had access as the result of work programs
                        because we are not aware of criteria by which to make such a judgment.




                        Page 10                     GAO/GGD-99-146 Inmates’ Access to Personal Information
B-280467




However, given that the inmates with access to personal information are
individuals who have been incarcerated for crimes, and given that the
institutional settings permit work program officials to exercise close
scrutiny over the inmates and work places, breaches of security and
misuses of personal information are a cause for concern. (See app. XI.)

As agreed, unless you announce the contents of this report earlier, we plan
no further distribution until 30 days from the date of this letter. At that
time, we will send copies of this report to the Honorable Janet Reno,
Attorney General; the Honorable Kathleen Hawk Sawyer, Director, BOP;
Ms. Gwyn Smith Ingley, Executive Director, Correctional Industries
Association, Inc.; the states that responded to our survey; and other
interested parties. Copies will also be made available to others upon
request.

The major contributors to this report are acknowledged in appendix XII. If
you or your staff have any questions about the information in this report,
please contact me or Brenda Bridges on (202) 512-8777.

Sincerely yours,




Richard M. Stana
Associate Director, Administration
   of Justice Issues




Page 11                    GAO/GGD-99-146 Inmates’ Access to Personal Information
Contents



Letter                                                                                     1


Appendixes   Appendix I: Objectives, Scope, and Methodology                               14
             Appendix II: Number of Inmates With Access to Personal                       18
               Information Through Work Programs
             Appendix III: Safeguards Used in Work Programs in                            26
               Which Inmates Had Access to Personal Information
             Appendix IV: Procedures, Statutes, and Pending Bills                         31
             Appendix V: Income From Work Programs That Allowed                           35
               Inmates Access to Personal Information, Fiscal Year
               1998
             Appendix VI: Number of Inmates With Access to Only                           38
               Names and Addresses Through Work Programs
             Appendix VII: Type of Work Performed in Work                                 40
               Programs in Which Inmates Had Access to Only Names
               and Addresses
             Appendix VIII: Safeguards Used in Work Programs in                           44
               Which Inmates Had Access to Only Names and
               Addresses
             Appendix IX: Incidents of Misuse of Personal Information                     48
               by Inmates
             Appendix X: Comments From the Bureau of Prisons                              52
             Appendix XI: Comments From the Correctional                                  53
               Industries Association, Inc.
             Appendix XII: GAO Contacts and Staff Acknowledgments                         54


Tables       Table IV.1: Federal and State Prison Procedures,                             31
               Statutes, and Pending Bills That Address Limitations
               on Inmates Who Perform Work Involving Personal
               Information Where Inmates Had Access to Personal
               Information on September 30, 1998
             Table IV.2: Statutes and Pending Bills That Address Work                     34
               Programs Involving Access to Personal Information in
               States Where Questionnaire Respondents Reported
               That Inmates Did Not Have Access to Personal
               Information on September 30, 1998




             Page 12                   GAO/GGD-99-146 Inmates’ Access to Personal Information
Contents




Abbreviations

BOP         Bureau of Prisons
FPI         Federal Prison Industries


Page 13                    GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix I

Objectives, Scope, and Methodology


               The objectives of our study were to

             • determine the extent to which inmates in the BOP and state prison
               systems had access to personal information through correctional industry
               work programs;
             • identify prison safeguards and procedures, statutes and regulations, and
               proposed legislation that addressed correctional industry work programs
               involving personal information;
             • determine the extent to which contracts that provided inmates access to
               personal information contributed to BOP’s and states’ correctional
               industry income;
             • determine the extent to which inmates in the BOP and state prison
               systems had access to only names and addresses or telephone numbers
               through correctional industry work programs; and
             • identify incidents of inmates misusing information obtained through a
               correctional industry work program, including how safeguards failed and
               what, if any, changes were made as a result of the incidents.

               For our study, we defined correctional industry work programs as
               programs that produced products and services for sale to government
               agencies and/or to the private sector. We excluded institutional work
               programs, i.e., programs that would involve activities such as
               housekeeping, food services, day-to-day maintenance, and community
               service, as well as support programs in which an inmate may have
               inadvertently seen personal information. The scope of our study included
               work programs that were (1) overseen by BOP, a state government, or a
               state-appointed commission; (2) associated with federal, state, or privately
               run facilities; and (3) associated with secure, confined facilities—including
               youth authorities—but not programs associated with prerelease facilities
               or city or county jails.

               We defined “personal information” as information that could be used to
               threaten an individual’s physical, psychological, or financial well-being.
               This information would include (1) credit card numbers (personal or
               business); (2) Social Security numbers; or (3) names in combination with
               physical descriptions or financial, medical, or motor vehicle information.
               We also collected data on inmates’ access to “names and addresses or
               telephone numbers,” which included a name and one or more of the
               following: work or home address or telephone number, name of employer,
               or job title but no other item that we defined as personal information.




               Page 14                     GAO/GGD-99-146 Inmates’ Access to Personal Information
  Appendix I
  Objectives, Scope, and Methodology




  To meet the assignment objectives, we surveyed, by mail, correctional
  industry officials in BOP, all 50 states, and the District of Columbia. The
  questionnaire asked for information on the following:

• correctional industry work program contracts that involved personal
  information that were either orders-in-progress or that had been agreed to
                                                        1
  but had not yet been started on September 30, 1998;
• the number of inmates who had access to personal information or to
  names and addresses or telephone numbers through correctional industry
  work program contracts or support work;
• safeguards that were in place to prevent inmates from misusing the
  information;
• statutes, regulations, procedures, other guidelines, and proposed
  legislation that dealt with correctional industry work programs involving
  personal information;
• the gross income in the most recently completed fiscal year for the
  correctional industry work program overall and for those contracts that
  involved personal information; and
• incidents of misuse of information that occurred at any time as a result of
  inmate access to the information through a correctional industry work
  program.

  We asked questionnaire respondents for information on inmates who had
  access to (1) personal information or (2) names and addresses or
  telephone numbers, either through working on a correctional industry
  work program contract or through performing support work for the
  industry work program operations. We defined a contract as a formal or
  informal agreement to produce a specific product or perform a specific
  service. We defined inmates who were performing support work as
  inmates who were not associated with a specific correctional industry
  work program contract but who performed tasks—such as order taking,
  order fulfillment, manufacturing or customer support, complaint
  resolution, or shipping—that supported the industry work program
  operations.

  In designing our questionnaire, we received input from the Correctional
  Industries Association, Inc. (a nonprofit professional organization
  representing individuals and agencies engaged in and concerned with
  correctional industries) and federal and state correctional industry

  1
   We chose September 30, 1998, because it coincided with the last day of the federal and some states’
  fiscal years. We anticipated that quarterly or annual data would be collected and compiled at that time
  and that this would facilitate the questionnaire recipients’ ability to provide us with information.




  Page 15                               GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix I
Objectives, Scope, and Methodology




officials. We revised the questionnaire based on the feedback these
officials provided. We made further changes based on input from
correctional industry officials as a result of pilot testing the survey
instrument in Maryland and Virginia.

To identify questionnaire recipients, we called the contact point for each
state’s correctional industry program as identified in the 1998 Correctional
Industries Association, Inc., Directory. We informed them of our
assignment and asked whether they would be the proper recipients for the
questionnaire. We asked these officials if their state had any privately run
prisons that housed inmates from their state prison system or from other
states’ prison systems. If they had such facilities, we asked them to identify
the individual who had oversight responsibilities for work programs in
these facilities.

To further ensure that we had a respondent for each privately run facility
that met our criteria (i.e., the facility was a secure, confined facility—
including youth authorities—but not a prerelease facility or city or county
jail, and any work programs in the facility would be overseen by BOP, a
state government, or a state-appointed commission), we obtained a list of
privately run correctional facilities from the Private Corrections Project
                  2
Internet web site. We then contacted the individuals whom we had
identified as overseeing work programs at privately run facilities to ensure
that they had responsibility for each facility that met our criteria. If they
stated that they did not have responsibility, we asked them who did and
repeated this procedure until we reached the appropriate party.

We mailed a total of 63 questionnaires: 1 to BOP, 1 to each state and the
District of Columbia, 1 to a youth authority, 1 to a joint venture program,
and 1 each to 9 privately run facilities that had been identified by the
method described above. Representatives from two states, Arizona and
Tennessee, informed us that they would not be participating in our survey.
Ohio’s representative also indicated that he would not be completing the
questionnaire but told us that Ohio does not permit inmates involved in
data entry to have access to credit card numbers or Social Security
numbers. When we received the questionnaires, we followed-up by
telephone on missing or incomplete data, consolidated the data into the
tables displayed in this report, faxed the completed tables to all
questionnaire respondents for confirmation of the accuracy of the data
displayed, and made corrections as necessary. Questionnaire respondents
were provided only with compiled data concerning their individual states.
2
    The address for this web site is http://web.crim.ufl.edu/pcp.




Page 16                                  GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix I
Objectives, Scope, and Methodology




We also conducted literature and legal database searches to identify
published articles, reports, studies, statutes, proposed bills, and other
documents dealing with the assignment objectives. We contacted
representatives from various organizations to determine what information
they may have that related to our assignment objectives. These
organizations included the American Correctional Association;
Correctional Industries Association, Inc.; American Jail Association;
American Federation of Labor and Congress of Industrial Organizations;
and Union of Needletraders, Industrial and Textile Employees.

We contacted each state’s attorney general’s office and the District of
Columbia’s Corporation Counsel to identify any additional (1) incidents of
inmates misusing information obtained through correctional industry work
programs and (2) state statutes or regulations, proposed legislation, or
other guidance that dealt with correctional industry work programs
involving personal information. We did not verify the completeness of the
information provided.

We contacted various federal agencies with investigatory responsibilities
to determine if they were aware of instances of inmates misusing personal
information that they obtained through correctional industry work
programs. Within the Department of the Treasury, we contacted the
Internal Revenue Service’s Criminal Investigation Division and the U.S.
Secret Service. Within the Department of Justice, we contacted the Federal
Bureau of Investigation. Finally, we contacted the U.S. Postal Service and
the Social Security Administration.

We performed our work between June 1998 and June 1999 in accordance
with generally accepted government auditing standards.




Page 17                         GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix II

Number of Inmates With Access to Personal
Information Through Work Programs

              Totals in bold

              Jurisdiction/                                 Social security      Credit card
               Contractor             Number of inmates        number             number
              Federal
               Bureau of Prisons             25                   25
                Federal agency               25                   25

              State
               Alabama                         0
               Alaska                          0
               Arizona                       NR                   NR                 NR
               Arkansas                       13
                  State agency                13
               California                    426                 426
                  State agency               426                 426
               Colorado                        0
               Connecticut                     0
               Delaware                        0
               District of Columbia            0
               Florida                        55                  20
                  State agency 1              10                  10
                  State agency 2              10                  10
                  State agency 3               5
                  State agency 4               5
                  State agency 5              25
               Georgia                         0
               Hawaii                          0
               Idaho                          31                  31
                  State agency                31                  31
               Illinois                       86
                  State agency 1              38
                  State agency 2              48
               Indiana                         0
               Iowa                           20                  20
                  State agency                20                  20
               Kansas                         15                  15
                  State agency                15                  15
               Kentucky                       56                  56
                  State agency                56                  56
               Louisiana                       0
               Maine                           0
               Maryland                        0
               Massachusetts                   0
               Michigan                        0
               Minnesota                      15
                  Private company 1           10
                  Private company 2            5




              Page 18                      GAO/GGD-99-146 Inmates’ Access to Personal Information
                                     Appendix II
                                     Number of Inmates With Access to Personal Information Through Work Programs




                                              Name and
               Driver’s Home           Make and                                           Employee
Date of Home license telephone Name of model of Income or Place of Medical Prescription identification
                                                         a
 birth address number number employer vehicle     salary    birth  diagnosis information   number                  Other




 NR      NR      NR       NR        NR         NR        NR         NR        NR          NR            NR         NR
         13      13                                                                                                 13
                                                                                                                      b
         13      13                                                                                                13
 426                                                                                                               426
                                                                                                                       c
 426                                                                                                               426




  45      50      30      20        10         30                   5                                               55
                                                                                                                         d
          10              10        10                                                                              10
                                                                                                                         e
  10      10              10                                                                                        10
                                                                                                                       f
   5                                                                                                                 5
                                                                                                                       g
   5       5       5                            5                   5                                                5
                                                                                                                         h
  25      25      25                           25                                                                   25


  31      31      31                31         31                                                                   31
                                                                                                                       d
  31      31      31                31         31                                                                   31
  86      86      86                           86
  38      38      38                           38
  48      48      48                           48

  20                                                                20                                              20
                                                                                                                       f
  20                                                                20                                              20
  15      15      15      15                   15
  15      15      15      15                   15
  56                                56                    56                                                        56
                                                                                                                       d
  56                                56                    56                                                        56




          15              15                    5        10                                                          5
                                                            a
          10              10                             10
                                                                                                                         i
           5               5                    5                                                                    5




                                     Page 19                        GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix II
Number of Inmates With Access to Personal Information Through Work Programs




Totals in bold


Jurisdiction/                                   Social security       Credit card
 Contractor              Number of inmates         number              number
 Mississippi                     0
 Missouri                       48                     48
  State agency 1                 9                      9
  State agency 2                15                     15
  State agency 3                15                     15
  State agency 4                 9                      9
 Montana                         0
 Nebraska                        0
 Nevada                          0
 New Hampshire                  25
  State agency                  25
 New Jersey                      6                     3
  State agency 1                 2
  State agency 2                 3                     3
  State agency 3                 1
 New Mexico                     26                     26
  State agency 1                 1                      1
  State agency 2                25                     25
 New York                       23
  State agency 1                13
  State agency 2                10
 North Carolina                  0
 North Dakota                    0
 Ohio                          NR                      0                   0
 Oklahoma                      254                    221                 84
  State agency 1                 2                     2
  State agency 2                 4                     4
  State agency 3                 3                     3
  State agency 4                 3                     3
  State agency 5                 3                     3
  State agency 6                 3                     3
  State agency 7                 5                     5
  State agency 8                33
  State agency 9                27                     27
  State agency 10               41                     41
  State agency 11               41                     41
  State agency 12               27                     27
  State agency 13               41                     41
  State agency 14               41                     41
  State agency 15               46                     46
  State agency 16               46
  State agency 17               84                     84
  State agency 18               84                     84
  State agency 19               84                     84




Page 20                        GAO/GGD-99-146 Inmates’ Access to Personal Information
                                       Appendix II
                                       Number of Inmates With Access to Personal Information Through Work Programs




                                                   Name and
                    Driver’s  Home            Make and                                           Employee
Date of    Home     license telephone Name of model of Income or Place of Medical Prescription identification
                                                                a
 birth    address   number number employer vehicle       salary   birth diagnosis information     number      Other

  30        30        15       15         9                   15                 15                                   24
                                                                                                                        d
                                          9                                                                           9
  15        15        15       15                             15
                                                                                                                            j
  15        15                                                                   15                                   15




  25        25
  25        25
  1          3                  1                                       3                                             2
                                                                                                                        k
             2                                                                                                        2
                                                                        3
  1          1                  1
  25        25                           26                    1                 25          25           25          25
                                          1                    1
                                                                                                                            d
  25        25                           25                                      25          25           25         25
  13        10                           13                                                  13                      23
                                                                                                                        l
  13                                     13                                                  13                      13
                                                                                                                        m
            10                                                                                                       10


 NR        NR        NR        NR        NR        NR        NR        NR       NR          NR            NR         NR
 207       246       174       207       208       204       132       166      117         117           49         254
                                                                                                                        d
  2         2                   2         2                             2        2           2                        2
                                                                                                                        n
  4         4                   4                              4        4        4           4                        4
                                                                                                                        o
  3         3                   3                                       3                                             3
                                                                                                                        p
                                                                                                                      3
                                                                                                                        q
            3          3                                                                                              3
                                                                                                                        d
            3                             3                    3                                           3          3
                                                                                                                        d
                                          5                                                                5          5
                                                                                                                          r
            33                                     33                                                                33
                                                                                                                          s
  27        27                  27       27                             27       27          27                      27
                                                                                                                          t
                                         41                   41                                          41         41
  41        41
            27                           27
  41        41        41        41       41        41
  41        41
                                                                                                                            s
  46        46                  46       46                             46                                           46
                                                                                                                        u
            46        46                           46                                                                46
                                                                                                                        s
  84        84                  84       84                   84        84       84          84                      84
                                                                                                                        s
  84        84                  84       84                   84        84       84          84                      84
                                                                                                                        d
  84        84        84        84       84        84         84        84       84          84                      84




                                       Page 21                        GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix II
Number of Inmates With Access to Personal Information Through Work Programs




Totals in bold

Jurisdiction/                                   Social security       Credit card
 Contractor              Number of inmates         number              number
 Oklahoma (cont.)
    State agency 20               84                  84                  84
  Oregon                          75
    State agency 1                35
    State agency 2                40
 Pennsylvania                      0
 Rhode Island                      0
 South Carolina                    0
 South Dakota                     18                  18
  State agency                    18                  18
 Tennessee                       NR                   NR                  NR
 Texas                             0
 Utah                             60                  60
  State agency                    60                  60
 Vermont                           0
 Virginia                          0
 Washington                        0
 West Virginia                     0
 Wisconsin                        80                  80
  Private company                 80                  80
 Wyoming                           0
Total                           1,357                1,049                84




Page 22                        GAO/GGD-99-146 Inmates’ Access to Personal Information
                                         Appendix II
                                         Number of Inmates With Access to Personal Information Through Work Programs




                                                                 Name and

                     Driver’s  Home            Make and                                           Employee
Date of    Home      license telephone Name of model of Income or Place of Medical Prescription identification
                                                                 a
 birth    address    number number employer vehicle       salary   birth diagnosis information     number                              Other
                                                                                                                                            d
               84                84            84                       84                                                               84
  75           35      40                                   40          35                                                               40
  35           35                                                       35
                                                                                                                                              v
  40                   40                                   40                                                                           40




  18           18               18                                                                                                       18
                                                                                                                                            d
  18           18               18                                                                                                       18
  NR      NR           NR       NR            NR           NR          NR        NR         NR            NR               NR            NR

  60           60      60        60           60                                                                                         60
                                                                                                                                            f
  60           60      60        60           60                                                                                         60




               80                80                                                                                                      80
                                                                                                                                            d
               80                80                                                                                                      80

1,133          742    464       431           413          411         249      194         157           155              74           1,132
                                         Note 1: Personal information means information that can be used to threaten an individual’s physical,
                                         psychological, or financial well-being. This information would include (1) credit card numbers
                                         (personal or business); (2) Social Security numbers; or (3) names in combination with physical
                                         descriptions or financial, medical, or motor vehicle information. This table does not include inmates
                                         who had access to only names and one or more of the following: work or home address or telephone
                                         number, name of employer, or job title. For that information, see appendix VI.
                                         Note 2: States with “NR” in each category did not return a questionnaire. We received a
                                         questionnaire from Arizona’s privately run facilities. These facilities did not have any inmates who had
                                         access to names, addresses, telephone numbers, or other types of personal information. A
                                         representative from Ohio’s state-run facilities informed us that inmates involved in data entry work
                                         programs did not have access to credit card numbers or Social Security numbers. We did not receive
                                         any information from respondents in state-run correctional facilities in Arizona or Tennessee.
                                         Note 3: The numbers shown above represent the maximum numbers of inmates who would have had
                                         access to each type of personal information. Some inmates worked on more than one contract.
                                         Consequently, as in Oklahoma, totals are not the sum of the number of inmates shown for each
                                         contract. Also, we asked respondents for the types of personal information to which inmates had
                                         access. However, each inmate may not have had access to all of the types of personal information
                                         involved in a contract.
                                         Note 4: According to the questionnaire respondents, the data from Idaho represent the combined
                                         information from two contracts, and the data from New Hampshire were combined from five contracts.
                                         Illinois’ data represent one contract situated in two geographic locations.
                                         a
                                         Income or salary may refer to a range rather than a discreet number. In Minnesota, customers are
                                         prompted to refuse to respond at their discretion.
                                         b
                                             Physical description.
                                         c
                                             Optical prescription and gender.




                                         Page 23                                GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix II
Number of Inmates With Access to Personal Information Through Work Programs




d
    Work address and work telephone number.
e
    Physician’s name and date of incident.
f
    Mother’s maiden name.
g
    Vehicle identification number.
h
    Boat description.
i
Work telephone number, vehicle identification number, and license plate number.
j
Medical treatment information.
k
    Work address, federal identification number of business, or Social Security number.
l
Work address, work telephone number, Medicaid recipient number, and Medicaid provider number.
m
    Driver’s license plate number.
n
    Medical information.
o
    Mug shot.
p
    Name of payee, address, claim number, and amount of check.
q
    Amount of check.
r
    Lien information.
s
    Work address, work telephone number, and mother’s maiden name.
t
    Work address.
u
    Lien holder.
v
    License plate number, driver’s license suspension, and motor vehicle-related conviction.
Source: GAO survey of correctional industry officials.




Page 24                                 GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix II
Number of Inmates With Access to Personal Information Through Work Programs




Page 25                        GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix III

Safeguards Used in Work Programs in Which
Inmates Had Access to Personal Information


Jurisdiction/             Close          Selective   Confidentiality         Security check       Security check at
                                                                 a
 contractor             supervision       hiring      agreement                 at exit              entrance
Federal
 Bureau of Prisons
  Federal agency             •                  •           •

State
 Arkansas
    State agency             •                  •                                   •
 California
    State agency             •                  •                                   •                     •
 Florida
    State agency 1           •                  •           •                       •                     •
    State agency 2           •                  •           •                       •                     •
    State agency 3           •                  •           •                       •                     •
    State agency 4           •                  •           •                       •                     •
    State agency 5                              •
 Idaho
    State agency             •                              •                       •                     •
 Illinois
    State agency 1           •                  •                                   •                     •
    State agency 2           •                  •           •                       •                     •
 Iowa
    State agency             •                  •           •                       •                     •
 Kansas
    State agency             •                  •                                   •                     •
 Kentucky
    State agency             •                  •           •                       •
 Minnesota
    Private company 1        •                  •           •                       •                     •
    Private company 2        •                  •           •                       •                     •
 Missouri
    State agency 1           •                              •
    State agency 2           •                              •
    State agency 3           •                              •
    State agency 4           •                              •
 New Hampshire
    State agency             •                  •           •                       •                     •
 New Jersey
    State agency 1           •                  •           •                       •                     •
    State agency 2           •                  •                                   •                     •
    State agency 3           •                  •           •                       •                     •
 New Mexico
    State agency 1           •                  •           •                       •                     •
    State agency 2           •                  •           •                       •                     •




                                      Page 26                   GAO/GGD-99-146 Inmates’ Access to Personal Information
                                     Appendix III
                                     Safeguards Used in Work Programs in Which Inmates Had Access to Personal Information




                                   Computer                            Personal
                                 program with                        information         No paper or
No photocopy      Monitored         privacy          Incoming         segmented             writing
  machines     telephone calls    safeguards         calls only     among inmates        instruments           Other


     •                                                                                                           •
                                                                                                                   b




     •

     •                                                   •                                                       •
                                                                                                                     c




     •                                •
     •                                                                                                           •
                                                                                                                   d


     •                                •
     •                                •


                      •               •                  •                                                       •
                                                                                                                   e




     •                •                                                                        •                  •
                                                                                                                     f


     •                •                                                                        •                  •
                                                                                                                   f




     •                •               •                                                        •                 •
                                                                                                                   d




                      •               •

     •

     •                •
     •                •




     •                                •                                     •                                    •
                                                                                                                   g




     •                •               •                  •
     •                                •                                                                          •
                                                                                                                   h


     •                                                                                                           •
                                                                                                                   i




     •                                •
                                      •




                                     Page 27                         GAO/GGD-99-146 Inmates’ Access to Personal Information
                                   Appendix III
                                   Safeguards Used in Work Programs in Which Inmates Had Access to Personal Information




Jurisdiction/           Close           Selective          Confidentiality       Security check        Security check
                                                                       a
 contractor          supervision         hiring             agreement               at exit             at entrance
 New York
    State agency 1        •                  •
    State agency 2        •                  •
 Oklahoma
   State agency 1         •                  •                    •
   State agency 2         •                  •                    •
   State agency 3         •                  •                    •
   State agency 4         •                  •                    •
   State agency 5         •                  •                    •
   State agency 6         •                  •                    •
   State agency 7         •                  •                    •
   State agency 8         •                  •                    •
   State agency 9         •                  •                    •                     •                     •
   State agency 10        •                  •                    •                     •                     •
   State agency 11        •                  •                    •                     •                     •
   State agency 12        •                  •                    •                     •                     •
   State agency 13        •                  •                    •                     •                     •
   State agency 14        •                  •                    •                     •                     •
   State agency 15        •                  •                    •                     •                     •
   State agency 16        •                  •                    •                     •                     •
   State agency 17        •                  •                    •                     •
   State agency 18        •                  •                    •                     •
   State agency 19        •                  •                    •                     •
   State agency 20        •                  •                    •                     •
 Oregon
  State agency 1          •                  •                    •                     •                     •
  State agency 2          •                  •                                          •                     •
 South Dakota
  State agency            •                  •                    •                     •                     •
 Utah
  State agency            •                  •                    •                     •                     •
 Wisconsin
  Private company         •                  •                                          •                     •




                                   Page 28                         GAO/GGD-99-146 Inmates’ Access to Personal Information
                                     Appendix III
                                     Safeguards Used in Work Programs in Which Inmates Had Access to Personal Information




                                   Computer                                  Personal
                                 program with                              information            No paper or
No photocopy      Monitored         privacy            Incoming             segmented                writing
  machines     telephone calls    safeguards           calls only         among inmates           instruments              Other


                                                                                                                              •
                                                                                                                               j




                                                            •
                      •                                     •
                      •                                     •
                      •                                     •
                      •                                     •
                      •                                     •
                      •                                     •
                      •                                     •
                      •                  •                                        •
                      •                  •                                        •
                      •                  •                                        •
                      •                  •                                        •
                      •                  •                                        •
                      •                  •                                        •
                      •                  •                                        •
                      •                  •                                        •
     •                                                      •
     •                                                      •
     •                                                      •
     •                                                      •

     •                •                  •                  •                                                                 •
                                                                                                                               k


     •                •                  •                  •                                                                 •
                                                                                                                               k




     •                •                  •                                        •

     •                •                                                                                 •

     •                                                                                                                        •
                                                                                                                               l


                                     Note 1: Personal information means information that can be used to threaten an individual’s physical,
                                     psychological, or financial well-being. This information would include (1) credit card numbers
                                     (personal or business); (2) Social Security numbers; or (3) names in combination with physical
                                     descriptions or financial, medical, or motor vehicle information.
                                     Note 2: A blank means that the questionnaire respondent did not report using the safeguard in the
                                     work program.
                                     Note 3: According to the questionnaire respondents, the data from Idaho represent the combined
                                     information from two contracts, and the data from New Hampshire were combined from five contracts.
                                     Illinois’ data represent one contract situated in two geographic locations.
                                     a
                                     Confidentiality agreements were agreements signed by the inmates not to release information
                                     obtained through a work program.
                                     b
                                     Prison staff conducted random inspections of work and housing areas.




                                     Page 29                              GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix III
Safeguards Used in Work Programs in Which Inmates Had Access to Personal Information




c
    Security cameras were located in the work area.
d
    Inmates were not allowed to make telephone calls in the work area.
e
    Telephones located in the work area were auto-dialed.
f
Records could not enter or leave secure area at work site except in custody of civilian state employee
or bonded courier.
g
    Inmates signed shop rules and procedures.
h
    No telephones were located in the work area.
i
No telephones or computers were located in the work area.
j
Inmates could not take paper or writing instruments into or out of the work area.
k
    Prison staff searched inmates’ desks.
l
Prison staff prescreened documents to ensure that they did not contain certain types of information.
Inmates were subject to pat searches.
Source: GAO survey of correctional industry officials.




Page 30                                 GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix IV

Procedures, Statutes, and Pending Bills



Table IV.1: Federal and State Prison Procedures, Statutes, and Pending Bills That Address Limitations on Inmates Who
Perform Work Involving Personal Information Where Inmates Had Access to Personal Information on September 30, 1998
Jurisdiction        Prison procedures                                        Statutes and pending bills
Federal
 Bureau of Prisons Inmates who were convicted of counterfeiting or           Pending Bill H.R. 369 (1999): would prohibit the use of
                    computer fraud offenses or had extensive computer        prison inmate labor for, among other tasks, data
                    knowledge were excluded                                  processing of personal information about children
State
 Arkansas           Inmates must meet requirements for minimum security;
                    inmates convicted of rape or who had life sentences were
                    excluded


 California         Inmates are screened by type of offense as per California California Penal Code, Section 5071: in general,
                    Penal Code, Section 5071                                  prohibits prison inmates convicted of offenses involving,
                                                                              for example, misuse of a computer, misuse of
                                                                              personal/financial information of another person, or a
                                                                              sex offense from performing prison employment
                                                                              functions that provide such inmates with access to
                                                                                                                   a
                                                                              certain types of personal information

                                                                               See also California Welfare Institutions Code, Section
                                                                               219.5: (language similar to above code section--
                                                                                                        a
                                                                               applicable to juveniles)
 Florida            Inmates were screened for disciplinary actions and
                    appropriate education level
 Illinois           Inmates were referred to the program by an institutional   Pending House Bill 70 (1999): would, in general, prohibit
                    committee and must have had a good institutional record    the use of inmates to enter any personally identifiable
                                                                               information in a computer processible medium or any
                                                                               other medium
                                   b
 Iowa               Selective hiring                                           Iowa Code, Section 904.801: a statement of intent that
                                                                               outlines various objectives to be met through the
                                                                                                                                      c
                                                                               provision of meaningful work opportunities to inmates

                                                                               Iowa Code, Section 904.809(1)(g): with respect to
                                                                               private industry employment of inmates of correctional
                                                                               institutions, various conditions shall apply to all
                                                                               agreements for such employment, including that the
                                                                               state director shall implement a system for screening
                                                                               and security of inmates to protect the safety of the public
 Kansas             Inmates must have had a good work record and no
                    disciplinary reports




                                             Page 31                           GAO/GGD-99-146 Inmates’ Access to Personal Information
                                                Appendix IV
                                                Procedures, Statutes, and Pending Bills




Jurisdiction     Prison procedures                                                Statutes and pending bills
 Kentucky        Inmates who had violated the correctional institutions’          Kentucky revised statutes, Section 97.120: in general,
                 rules were excluded                                              prohibits certain state agencies from entering into any
                                                                                  contract for the use or employment of prisoners in any
                                                                                  capacity that allows prisoners access to certain types of
                                                                                  information, including, but not limited to, taxpayer
                                                                                  information, Social Security numbers, telephone
                                                                                  numbers, and addresses

 Minnesota       Program review committee identified high-risk inmates
                 and prevented their employment


 Mississippi     All inmates were screened by the Dept. of Corrections
                 Internal Audit Division for security clearance. No one was
                 hired with a forgery, counterfeit, or document fraud
                 conviction.
                                 b
 New Hampshire   Selective hiring


 New Jersey      Institutional classification                                     New Jersey Pending Assembly Bill 603 (1998): would
                                                                                  prohibit inmates at the Adult Diagnostic and Treatment
                                                                                  Center from being employed in a data entry position or
                                                                                  any other capacity that would provide the inmate access
                                                                                  to certain types of personal information
 New Mexico      Inmates’ conduct while incarcerated was considered;
                 inmates with a history of sex crimes, hate crimes, or
                 violent behavior were excluded
 New York        Depending on contract, inmates who committed                     New York Pending Assembly Bill 4753 (1999): in
                 insurance, motor vehicle, credit card fraud, or extortion        general, inmates involved in correctional institution work
                 were excluded                                                    would be prohibited from accessing, collecting, or
                                                                                  processing certain types of personal information

                                                                                  See also New York Pending Assembly Bill 4842 (1999):
                                                                                  (language similar to the above bill)


                                                          th
 Oklahoma        Inmates must have had at least 8 grade math and
                 reading skills; other factors, such as attitude, were
                 considered also


 Oregon          Security screening, including conviction type, was
                 employed. Inmates convicted of computer fraud, crimes
                 with a high degree of violence, and some sex crimes, or
                 inmates that were considered to be high security risks by
                 the institution or Department of Corrections were not
                 employed


                                  b
 South Dakota    Selective hiring




                                                Page 32                          GAO/GGD-99-146 Inmates’ Access to Personal Information
                                       Appendix IV
                                       Procedures, Statutes, and Pending Bills




Jurisdiction   Prison procedures                                                Statutes and pending bills
 Utah          Inmates were screened for suitability for employment
               based on factors such as previous employment and
               prison record


 Wisconsin                                                                      Wisconsin Pending Assembly Bill 31 (1999): would
                                                                                prohibit the Department of Corrections from entering into
                                                                                any contract or other agreement if, in the performance of
                                                                                the contract or agreement, a prisoner would have
                                                                                access to any personal information of individuals who
                                                                                are not prisoners

                                       Note: We did not independently verify the completeness of the data provided by the questionnaire
                                       respondents.
                                       a
                                       This section also was identified by the state as requiring that such persons in prison work programs
                                       disclose that fact before taking any personal information from anyone.
                                       b
                                           The criterion by which inmates were selected was not specified.
                                       c
                                        This statute also was identified by the state as containing provisions that related to preventing
                                       inmates from retaining personal information or transferring it to unauthorized inmates or other
                                       persons.
                                       Source: GAO survey of correctional industry officials, state attorneys general, and legal database
                                       searches.




                                       Page 33                                 GAO/GGD-99-146 Inmates’ Access to Personal Information
                                              Appendix IV
                                              Procedures, Statutes, and Pending Bills




Table IV.2: Statutes and Pending Bills That Address Work Programs Involving Access to Personal Information in States Where
Questionnaire Respondents Reported That Inmates Did Not Have Access to Personal Information on September 30, 1998
State          Statutes and pending bills
Colorado       Colorado Revised Statutes, Section 17-24-104: the Correctional Industries Advisory Board, among other things, is to
               consider the feasibility of proposed prison industries that would utilize the services of prisoners
Maryland       Annotated Code of Maryland, Article 27, Section 681C(3)(ii): authorizes the Board of Public Works to suspend certain
               requirements that state agencies utilize correctional industry services when data entry services would involve certain
               types of protected information
Michigan       Michigan Statutes Annotated, Section 28.1540(7a)(1)(a): prohibits inmates assigned to work in a private manufacturing
               or service enterprise from being granted access to certain types of employee; customer; or client information; including,
               but not limited to, personal addresses, telephone numbers, E-mail addresses, credit card information, other financial
               information, and health records
Texas          Texas Government Code, Section 497.098: in general, prohibits inmates who have previously misused information
               gained through a work program from participating in work programs that provide inmates with access to personal
               information about persons who are not confined in the institutional division

                Texas Pending House Bill 812 (1999): in general, would prohibit the Department of Criminal Justice from entering into
                contracts that would require or permit certain sex offenders to have access to personal information about persons who
                                                                                 a
                are not confined in facilities operated by or for the department

                Texas Pending Senate Bill 420 (1999): in general, would prohibit the Department of Criminal Justice from entering into
                contracts that would require or permit an inmate confined in a correctional facility operated by or for the department to
                have access to personal information about persons who are not confined in facilities operated by or for the department
Vermont         Vermont Pending Bill H.88 (1999): would require offenders engaged in a work activity involving the solicitation of
                confidential information from the general public to disclose such offender status and to obtain the consent of the
                members of public concerned before proceeding
Washington      Revised Code of Washington, Section 72.09: in general, requires work program administrators to ensure that no inmate
                convicted of certain sex offenses obtains access to names, addresses, or telephone numbers of private individuals while
                performing his or her duties in an inmate work program
                                              Note: We did not independently verify the completeness of the data provided by the questionnaire
                                              respondents.
                                              a
                                               This bill also was identified as containing provisions that related to preventing inmates from physically
                                              retaining personal information or transferring it to unauthorized inmates or other persons, i.e., inmates
                                              having access to certain personal information would be personally searched upon entering or leaving
                                              the work area.
                                              Source: GAO survey of correctional industry officials, state attorneys general, and legal database
                                              searches.




                                              Page 34                               GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix V

Income From Work Programs That Allowed
Inmates Access to Personal Information,
Fiscal Year 1998
                          Income from     Total income                                     Percentage of FY 1998
                             individual            from                               correctional industry gross
                          contracts for   contracts for     FY 1998 correctional           income from personal
Jurisdiction/Contractor        FY 1998         FY 1998    industry gross income             information contracts
Federal
 Bureau of Prisons
  Federal agency                $6,000
   Total                                        $6,000             $568,000,000                             <0.1

State
 Arkansas
    State agency               135,000
      Total                                    135,000                5,600,000                               2.4
 California
    State agency            11,962,000
     Total                                   11,962,000             150,865,000                               7.9
 Florida
                                      a
    State agency 1                N/A
                                     a
    State agency 2                N/A
                                     a
    State agency 3                N/A
                                     a
    State agency 4                N/A
                                     a
    State agency 5                N/A
                                                      a
     Total                                         N/A               81,000,000
 Idaho
    State agency               144,000
                                                                                  b
      Total                                    144,000                 652, 000                             22.1
 Illinois
    State agency 1              15,000
    State agency 2             278,000
     Total                                     293,000               47,435,000                               0.6
 Iowa
    State agency                   N/A
     Total                                         N/A                  120,000
 Kansas
    State agency                70,000
     Total                                      70,000               10,600,000                               0.7
 Kentucky
    State agency               294,000
     Total                                     294,000               12,400,000                               2.4
 Minnesota
    Private company 1           73,000
    Private company 2            3,000
      Total                                     76,000               17,820,000                               0.4




                                   Page 35                  GAO/GGD-99-146 Inmates’ Access to Personal Information
                                    Appendix V
                                    Income From Work Programs That Allowed Inmates Access to Personal Information, Fiscal
                                    Year 1998




                           Income from     Total income                                           Percentage of FY 1998
                              individual            from                                     correctional industry gross
                           contracts for   contracts for           FY 1998 correctional           income from personal
Jurisdiction/ Contractor        FY 1998         FY 1998          Industry gross income             information contracts
 Missouri
  State agency 1                 23,000
  State agency 2                 13,000
  State agency 3                 15,000
                                       c
  State agency 4
   Total                                         51,000                      36,268,000                               0.1
 New Hampshire
  State agency                  130,000
   Total                                        130,000                       2,500,000                               5.2
 New Jersey
  State agency 1                  3,000
  State agency 2                  3,000
  State agency 3                  1,000
   Total                                          8,000                      17,199,000                               <.1
 New Mexico
                                       d
  State agency 1
                                       d
  State agency 2
   Total                                        698,000                       4,400,000                              15.9
 New York
  State agency 1              2,300,000
  State agency 2                500,000
   Total                                      2,800,000                      60,800,000                               4.6
 Oklahoma
                                       c
  State agency 1
                                       c
  State agency 2
  State agency 3                  6,000
  State agency 4                  9,000
  State agency 5                 20,000
  State agency 6                  2,000
   State agency 7                28,000
  State agency 8                220,000
  State agency 9                  8,000
  State agency 10               200,000
  State agency 11                 1,000
  State agency 12                47,000
  State agency 13                13,000
  State agency 14                 1,000
  State agency 15                 2,000
  State agency 16               150,000
  State agency 17                 7,000
  State agency 18                17,000
  State agency 19                84,000
  State agency 20                 2,000
   Total                                        817,000                      16,754,000                               4.9




                                    Page 36                        GAO/GGD-99-146 Inmates’ Access to Personal Information
                                   Appendix V
                                   Income From Work Programs That Allowed Inmates Access to Personal Information, Fiscal
                                   Year 1998




                          Income from          Total income                                                   Percentage of FY 1998
                             individual                 from                                             correctional industry gross
                          contracts for        contracts for              FY 1998 correctional                income from personal
Jurisdiction/Contractor        FY 1998              FY 1998             industry gross income                  information contracts
 Oregon
  State agency 1               320,000
  State agency 2               250,000
   Total                                            570,000                           15,000,000                                        3.8
 South Dakota
                                           e
  State agency                         0
                                                               e
   Total                                                   0                             261,000
 Utah
  State agency                 360,000
   Total                                            360,000                           12,000,000                                        3.0
 Wisconsin
  Private company              170,000
   Total                                            170,000                           22,844,000                                        0.7
                                   Note 1: Personal information means information that can be used to threaten an individual’s
                                   physical, psychological, or financial well-being. This information would include (1) credit card
                                   numbers (personal or business); (2) Social Security numbers; or (3) names in combination with
                                   physical descriptions or financial, medical, or motor vehicle information.
                                   Note 2: Dollar amounts were rounded to the nearest thousand. Totals may not add due to rounding.
                                   Percentages were rounded to the nearest tenth.
                                   a
                                    PRIDE Enterprises, a private, not-for-profit corporation that operates industries in correctional
                                   institutions throughout Florida, stated that it contributes over $1 million annually toward incarceration
                                   costs to the state of Florida and 15 percent of total inmate wages to victim restitution.
                                   b
                                       Net income was provided.
                                   c
                                       Less than $1,000.
                                   d
                                       State does not have a breakdown by individual contract.
                                   e
                                       Contract started in June 1998.
                                   Source: GAO survey of correctional industry officials.




                                   Page 37                                 GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix VI

Number of Inmates With Access to Only
Names and Addresses Through Work
Programs
                                                    Number of inmates
                        Through contracts with   Through general support
                       government agencies or        work for correctional
Jurisdiction                private companies          industry programs                              Total
Federal
 Bureau of Prisons                         80                       3,109                             3,189

State
Alabama                                     0                           0                                   0
Alaska                                      0                           3                                   3
Arizona                                   NR                          NR                                NR
Arkansas                                    7                           1                                   8
California                                  0                          75                                 75
Colorado                                   11                          21                                 32
Connecticut                                 0                           0                                   0
Delaware                                    0                          20                                 20
District of Columbia                        0                           0                                   0
Florida                                    41                         465                               506
Georgia                                     0                           0                                   0
Hawaii                                      0                           0                                   0
Idaho                                      31                          30                                 61
Illinois                                    8                           0                                   8
Indiana                                     0                           0                                   0
Iowa                                        0                           0                                   0
Kansas                                     10                           0                                 10
Kentucky                                    0                           0                                   0
Louisiana                                   0                           0                                   0
Maine                                       0                           0                                   0
                                                                                                             a
Maryland                                   30                          30                                30
Massachusetts                              80                           0                                 80
Michigan                                    0                          26                                 26
Minnesota                                  33                          30                                 63
Mississippi                                19                           0                                 19
Missouri                                   15                          60                                 75
                                                                                                             a
Montana                                     8                           4                                  8
                                                                                                             a
Nebraska                                  112                          43                              112
Nevada                                     26                          12                                 38
New Hampshire                               0                           0                                   0
New Jersey                                 58                           0                                 58
New Mexico                                 90                          36                               126
New York                                    6                           0                                   6
North Carolina                              0                           0                                   0
North Dakota                                0                           0                                   0
Ohio                                      NR                          NR                                NR
Oklahoma                                  255                         116                               371
Oregon                                    145                           8                               153
Pennsylvania                                0                           0                                   0
Rhode Island                                0                           0                                   0
South Carolina                             10                           0                                 10
South Dakota                                8                           6                                 14
Tennessee                                 NR                          NR                                NR




                            Page 38                   GAO/GGD-99-146 Inmates’ Access to Personal Information
                      Appendix VI
                      Number of Inmates With Access to Only Names and Addresses Through Work Programs




                                                        Number of inmates
                  Through contracts with             Through general support
                 government agencies or                  work for correctional
Jurisdiction          private companies                    industry programs                                         Total
 Texas                                 0                                     0                                           0
 Utah                                100                                     0                                         100
 Vermont                               0                                     0                                           0
 Virginia                              0                                    45                                          45
                                                                                                                          b
 Washington                           42                                   109                                        151
 West Virginia                        28                                     6                                          34
 Wisconsin                           105                                     0                                         105
 Wyoming                               3                                     0                                           3
                                                                                                                          a
Total                              1,361                                4,255                                       5,539
                      Note 1: Names and addresses mean names and one or more of the following: work or home
                      addresses or telephone numbers, names of employer, or job titles but no other item that we defined
                      as personal information.
                      Note 2: States with “NR” in each category did not return a questionnaire. We received a questionnaire
                      from Arizona’s privately run facilities. These facilities did not have any inmates who had access to
                      names, addresses, telephone numbers, or other types of personal information. A representative from
                      Ohio’s state-run facilities informed us that inmates involved in data entry work programs did not have
                      access to credit card numbers or Social Security numbers. We did not receive any information from
                      respondents in state-run correctional facilities in Arizona or Tennessee.
                      a
                       Columns do not add across to the total column because the same inmate may have had access to
                      names and addresses or telephone numbers through both contracts and support work. Totals indicate
                      the maximum number of inmates with access.
                      b
                       Inmates had access to names, work addresses, and work telephone numbers only; they did not have
                      access to home addresses or home telephone numbers.
                      Source: GAO survey of correctional industry officials.




                      Page 39                               GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix VII

Type of Work Performed in Work Programs in
Which Inmates Had Access to Only Names
and Addresses

                                                                              Manufacturing
                       Order                                                   or customer
Jurisdiction         fulfillment   Data entry        Shipping   Printing         support    Order taking Telemarketing
Federal
 Bureau of Prisons      C/S            C                S                            S              S

State
 Alaska                  S                              S                            S              S
 Arkansas                                                          C
 California              S                                                           S              S
 Colorado                S
 Delaware                                                          S
 Florida                 S             C                S          C                 S              S
 Idaho                   S            C/S               S                            S              S
 Illinois                C                                                                                          C
 Kansas
 Maryland                             C/S                         C/S
 Massachusetts           C             C                           C                                C
 Michigan
 Minnesota                             C                                             S                              C
 Mississippi             C                                         C
 Missouri                S             C                S                            S              S
 Montana                 S                              S          C                 S              S               C
 Nebraska               C/S            C                S          C                                S               C
 Nevada                  S                              S                            S              S               C
 New Jersey                            C
 New Mexico             C/S            C                S          C                 S                              C
 New York                C
 Oklahoma               C/S            C                S          C                 S              S              C/S
 Oregon                  C             C                S          C                 S              S               C
 South Carolina
 South Dakota           C/S                             S          C
 Utah                                  C                                                                            C
 Virginia                                               S
             r
 Washington              C             C               C/S         C                C
 West Virginia                                          S          C
 Wisconsin                             C
           s
 Wyoming




                                           Page 40                     GAO/GGD-99-146 Inmates’ Access to Personal Information
                               Appendix VII
                               Type of Work Performed in Work Programs in Which Inmates Had Access to Only Names and
                               Addresses




                                                                                             Geographic
               Complaint    Document          Computer-aided           Document              information
Bulk mailing   resolution   duplication          design                scanning                system                  Other
                                                                                                                           a
     C             S                                                                                                     S


                                                                                                                           b
                   S                                                                                                     S
                                                                                                                           c
                                                                                                                         S
                                                                                                                           d
                                                                                                                         S
                                                                                                                         e   f
                                                                                                                        C /S
                                                                                                                           g
                                                                                                                         S
                                                                                                                           d
     C             S            C                     C                      C                     C                     S
                   S            C
     C
                                                                                                                             h
                                                                                                                         C
    C/S
                                                                                                                             i
                                                                                                                         S


                                                                                                                             j
                                                                                                                         C
                                C                     C
                                                                                                                             f
     C                                                                                                                   S
                   S
                                                                                                                             k
     C                                                                                                                   C
     C             S            C
                                                                                                                             l
                                                                                                                         C
                                                                                                                          m
                   S                                  C                      C                                           C
                                                                                                                           n
     C                          C                     C                      C                     C                     S
                                                                                                                           o
                                                                                                                         C
                                                                                                                           d
                                C                                                                                        S
                                                                                                                           p
                                C                                                                                        C
                                                                                                                           q
                                                                                                                         S
                   S                                  C




                               Legend
                               C = Type of work performed by inmates who had access to information through work program
                               contracts, which is a formal or informal agreement to produce a specific product or perform a specific
                               service.
                               S = Type of work performed by inmates who had access to information through support work, which is
                               not associated with a specific contract, but tasks such as order taking or shipping that supported
                               overall industry work program operations.
                               C/S = Inmates performed this type of work both on contracts and through support work.
                               Note: Names and addresses mean names and one or more of the following: work or home
                               addresses or telephone numbers, names of employer, or job titles but no other item that we defined
                               as personal information.




                               Page 41                              GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix VII
Type of Work Performed in Work Programs in Which Inmates Had Access to Only Names and
Addresses




a
    Customer billing.
b
    Installation.
c
    Sending invoices to agencies.
d
    Clerical work.
e
 Response to public inquiry regarding corporate information from Secretary of State database via
telephone.
f
    Delivery.
g
    Furniture refurbishing and auto maintenance.
h
    Telephone answering.
i
Purchasing regulations.
j
Coding.
k
    Telephone (incoming calls only).
l
Providing information via telephone.
m
    Production of various signs.
n
    Calling for quotes, prices, and availability.
o
    Travel reservations.
p
    Sales and purchasing.
q
    Truck loading.
r
Inmates working in Washington’s correctional facilities have access to names, work addresses, and
work telephone numbers only.
s
    Wyoming failed to designate type of work performed by inmates.
Source: GAO survey of correctional industry officials.




Page 42                                    GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix VII
Type of Work Performed in Work Programs in Which Inmates Had Access to Only Names and
Addresses




Page 43                        GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix VIII

Safeguards Used in Work Programs in Which
Inmates Had Access to Only Names and
Addresses


                                         Security check   Selective          Security check at   Monitored telephone
Jurisdiction         Close supervision      at exit        hiring               entrance                calls
Federal
 Bureau of Prisons         C/S                              C/S                                            S

State
 Alaska                                                      S
 Arkansas                   S                  C/S                                   S
 California                 S                   S            S
 Colorado                  C/S                 C/S          C/S                     C/S                    C
 Delaware                   S                   S            S                       S
 Florida                   C/S                 C/S          C/S                     C/S                   C/S
 Idaho                     C/S                 C/S                                  C/S                   C/S
 Illinois                   C                   C            C                       C                     C
 Kansas                     C                                C                                             C
 Maryland                  C/S                 C/S          C/S                     C/S                   C/S
 Massachusetts              C                   C            C                       C                     C
 Michigan                   S                   S                                                          S
 Minnesota                 C/S                 C/S          C/S                     C/S                   C/S
 Mississippi                C                   C            C                       C                     C
 Missouri                  C/S                  S            S                       S
 Montana                   C/S                 C/S          C/S                     C/S                   C/S
 Nebraska                  C/S                 C/S          C/S                     C/S                   C/S
 Nevada                    C/S                 C/S          C/S                      S                    C/S
 New Jersey                 C                   C            C                       C                     C
 New Mexico                C/S                 C/S          C/S                     C/S                   C/S
 New York                   C                                C                                             C
 Oklahoma                  C/S                 C/S          C/S                     C/S                   C/S
 Oregon                    C/S                 C/S          C/S                     C/S                   C/S
 South Carolina             C                   C            C                       C                     C
 South Dakota              C/S                 C/S          C/S                     C/S                   C/S
 Utah                       C                   C            C                       C                     C
 Virginia                                       S                                    S
             n
 Washington                C/S                 C/S          C/S                     C/S                   C/S
 West Virginia             C/S                 C/S                                  C/S                   C/S
 Wisconsin                  C                   C            C                       C
 Wyoming                                        C            C                       C                     C




                                         Page 44                 GAO/GGD-99-146 Inmates’ Access to Personal Information
                                Appendix VIII
                                Safeguards Used in Work Programs in Which Inmates Had Access to Only Names and
                                Addresses




  Computer                                                           Personal
program with                                                    information given             No paper or
   privacy     Incoming     No photocopy        Confidentiality       only to                    writing
                                                            a
 safeguards    calls only     machines           agreement         noninmates                 instruments                Other
                                                                                                                           b       c
                                 C                      C                                                                C /S


                   S
                                                                                                                               d
                                 S                                                                                         S
     S             S                                                          S
     C             C             C                                                                   C
                                                                                                                               e
                                 S                                                                                         S
                                                                                                                             f
    C/S          C/S             C                                           C/S                     C                     C
                                                        C
                                 C                      C                                            C
     C            C
                 C/S            C/S                                          C/S                   C/S
     C            C              C                                            C
                                                                                                                               g
                                 S                                                                                         S
                                                                                                                            h
     C                           C                      C                     S                                            S
                                                                                                                             i
     C                                                                        C                                            C
                   S                                    C
                                                                                                                               j
    C/S           S                                   C/S                                            C                     S
                  S              C
     C            C              C                     C
    C/S          C/S             S                    C/S                                            S
                  C                                                                                  C
                                                                                                                           k       k
    C/S           C                                   C/S                    C/S                                         C /S
                                                                                                                            l
    C/S          C/S            C/S                    C                      S                                           C
     C            C              C                                            C
     S
                                                                                                                               m
     C                                                  C                     C                      C                    C
                                                                                                                               l
    C/S           S              C                      C                                                                 C
                                                                                                                          o   o
                 C/S                                                                                                     C /S
                                                                                                                            p
     C                           C                                                                   C                    C
     C                           C
                                Legend
                                C = Safeguard applied to inmates who had access to types of information through a contract, which is
                                a formal or informal agreement to produce a specific product or perform a specific service.
                                S = Safeguard applied to inmates who had access to types of information through performing support
                                work, which is not associated with a specific contract, but tasks such as order taking or shipping that
                                supported overall industry work program operations.
                                C/S = Safeguard applied to inmates who had access to types of information as a result of employment
                                on both contracts and through support work.




                                Page 45                               GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix VIII
Safeguards Used in Work Programs in Which Inmates Had Access to Only Names and
Addresses




Note 1: Names and addresses mean names and one or more of the following: work or home
addresses or telephone numbers, names of employer, or job titles but no other item that we defined
as personal information.
Note 2: A blank means that the questionnaire respondent did not report using the safeguard.
Note 3: This table does not include inmates who had access to names and addresses or telephone
numbers and any other item(s) that we defined as personal information. See appendix III for a list of
safeguards that respondents reported using for inmates who had access to personal information.
a
Confidentiality agreements were agreements signed by the inmates not to release information
obtained through a work program.
b
    Prison staff conducted random inspections of work and housing areas.
c
Prison staff conducted random inspections of work and housing areas. Prison staff screened
outgoing business documents. Telephones in work area were auto-dialed.
d
    No telephones or computers were used by inmates in work area.
e
    Inmates were required to make uniform changes in work area.
f
Inmates had access to telephones, computers, and fax machines connected to network only under
direct supervision. Personal information was segmented among inmates. All documents in and out
are monitored.
g
Information was screened by prison staff before being accessed by inmates. Inmates were subject to
body and cell searches.
h
    Inmates did not have access to telephones in work area.
I
Personal information was segmented among inmates. Surveillance mirrors, security cameras,
restricted work area, raw materials/supplies control, and random strip searches were employed.
j
Prison staff conducted area shakedowns. Personal information was segmented among inmates.
k
    Personal information was segmented among inmates.
l
Telephones in work area were auto-dialed.
m
    Telephones located in the work area were auto-dialed. Telephone calls were monitored and taped.
n
Inmates working in Washington’s correctional facilities had access to names, work addresses, and
work telephone numbers only.
o
    Inmates were not allowed to take anything except tobacco into or out of the work area.
p
    Prison staff prescreened documents, and inmates were subject to pat searches.
Source: GAO survey of correctional industry officials.




Page 46                                 GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix VIII
Safeguards Used in Work Programs in Which Inmates Had Access to Only Names and
Addresses




Page 47                        GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix IX

Incidents of Misuse of Personal Information
by Inmates


State                          Date and description of incident                  Safeguards reported
California (Youth Authority)   In 1991, while on parole an inmate used credit    •Selective hiring
                               card numbers previously obtained from a prison    •Security check at entrance to work area
                               telemarketing work program.                       •Security check at exit from work area
                                                                                 •Monitored telephone calls
                                                                                 •Incoming calls only to work area
                                                                                 •No photocopy machines in work area
                                                                                 •Close supervision while working
New Mexico                     In 1995, an inmate wrote a letter to a Medicare •Selective hiring
                               patient identified from information obtained in a •Computer programs with privacy safeguards
                               data entry work program.                          •Close supervision while working
                                                                                 •Confidentiality agreement signed by inmates
New York                       In the mid-90s, an inmate participating in a work •Selective hiring
                               program provided another inmate with a name       •Monitored telephone calls
                               and address obtained through the work             •Incoming calls only to work area
                               program. The second inmate wrote a letter to      •Close supervision while working
                               the individual whose name and address were        •Personal information given only to non-
                               provided.                                         inmates
Oklahoma                       In about 1990, an inmate obtained information, •Selective hiring
                               through participating in a data entry work        •Security check at entrance to work area
                               program, about an individual’s medical            •Security check at exit from work area
                               expenses and wrote the individual a letter.       •Computer programs with privacy safeguards
                                                                                 •Monitored telephone calls
                                                                                 •Close supervision while working
                                                                                 •Confidentiality agreement signed by inmates
                                                                                 •Personal information segmented among
                                                                                 different inmates
Oklahoma                       In 1995, two inmates attempted to smuggle         •Selective hiring—no misconduct for 6
                               copies of birth certificates obtained through a   months
                               work program out of prison through the U.S.       •Security check at exit from work area
                               mail system. The birth certificates were sent     •Computer programs with privacy safeguards
                               back to the prison via return mail.               •Incoming calls only to work area
                                                                                 •No photocopy machines in work area
                                                                                 •Close supervision while working
                                                                                 •Confidentiality agreement signed by inmates
                                                                                 •Personal information segmented among
                                                                                 different inmates
South Carolina                 In 1995, an inmate continued to call a particular •Selective hiring—interviews and previous
                               individual identified through a work program that work history
                               telemarketed local newspaper subscriptions.       •Computer programs with privacy safeguards
                                                                                 •Monitored telephone calls
                                                                                 •Close supervision while working
                                                                                 •Personal information given only to non-
                                                                                 inmates




                                    Page 48                          GAO/GGD-99-146 Inmates’ Access to Personal Information
                                               Appendix IX
                                               Incidents of Misuse of Personal Information by Inmates




                                                                       Program continued after
                                                                              incident
How safeguards failed             Sanctions against inmate                Yes          No          Changes to safeguards
                                                                           •
                                                                            a
Unknown                           Inmate charged and convicted




Inmate was not searched when      Inmate was given disciplinary                            •       N/A
leaving work area                 segregation time and was not
                                  allowed to work for Correctional
                                  Industries
Inmate left the premises with the Inmate was removed from the               •                      Existing securities were reviewed
information                       work program                                                     and reinforced




Inmate memorized the address      Inmate was given a written                •
                                  reprimand, placed in restrictive
                                  housing, and barred from future
                                  employment in industry work
                                  programs




Despite the fence around the      Both inmates were given written           •                      Monitors were placed on the gate to
work area and pat down            reprimands, fired from the work                                  watch the area
procedures, these papers were     program, and transferred from
removed                           this particular area of the prison




Inmate was not monitored while Inmate was given a written                                  •       N/A
making telephone calls         reprimand for disobeying orders




                                               Page 49                          GAO/GGD-99-146 Inmates’ Access to Personal Information
                  Appendix IX
                  Incidents of Misuse of Personal Information by Inmates




State          Date and description of incident                   Safeguards reported
South Dakota   In 1990 or 1991, an inmate used a credit card      •Unknown to questionnaire respondent
               number, obtained from a work program making
               motel reservations, for personal purchases.
Texas          In the early 1990’s, an inmate wrote a letter to   Unknown to questionnaire respondent
               an individual identified through a data entry
               work program and included personal
               information also obtained through the work
               program.
Washington     In 1997, an inmate sent a Christmas card to an     •Selective hiring—offense history
               individual identified through a 1-800              •Security check at entrance to work area
               information line. The individual had called for    •Security check at exit from work area
               information on state parks.                        •No photocopy machines in work area
                                                                  • Monitored telephone calls




                  Page 50                           GAO/GGD-99-146 Inmates’ Access to Personal Information
                                              Appendix IX
                                              Incidents of Misuse of Personal Information by Inmates




                                                                           Program continued after
                                                                                  incident
How safeguards failed            Sanctions against inmate                    Yes           No               Changes to safeguards
Unknown                          Inmate was prosecuted                                      •               N/A


Unknown                          Case is in litigation                                            •         N/A




                                                                                                 •
                                                                                                  b
Lack of supervision; failed to use Inmate was disciplined and                                               N/A
available technology               terminated from work program;
                                   manager was demoted and
                                   subsequently reassigned

                                              Note: Incidents of misuse of personal information means any action that had threatened or caused
                                              injury to the physical, psychological, or financial well-being of any member of the public. Some of
                                              these incidents involved only names and addresses or telephone numbers, not “personal information”
                                              as we defined it for this report.
                                              a
                                                  Program was discontinued in 1998.
                                              b
                                               Telemarketing activities were eliminated as a correctional industries business.
                                              Source: GAO survey of correctional industry officials.




                                              Page 51                                 GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix X

Comments From the Bureau of Prisons




              Page 52   GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix XI

Comments From the Correctional Industries
Association, Inc.




              Page 53   GAO/GGD-99-146 Inmates’ Access to Personal Information
Appendix XII

GAO Contacts and Staff Acknowledgments


                  Brenda Bridges, (202) 512-8777
GAO Contacts
                  Mary Lane Renninger
Acknowledgments   Nancy A. Briggs
                  Geoffrey R. Hamilton
                  David P. Alexander
                  Stuart M. Kaufman
                  Michael H. Little




                  Page 54                   GAO/GGD-99-146 Inmates’ Access to Personal Information
Page 55   GAO/GGD-99-146 Inmates’ Access to Personal Information
Page 56   GAO/GGD-99-146 Inmates’ Access to Personal Information
Ordering Information

The first copy of each GAO report and testimony is free. Additional
copies are $2 each. Orders should be sent to the following address,
accompanied by a check or money order made out to the
Superintendent of Documents, when necessary. VISA and
MasterCard credit cards are accepted, also. Orders for 100 or more
copies to be mailed to a single address are discounted 25 percent.

Order by mail:

U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013

or visit:

Room 1100
     th                  th
700 4 St. NW (corner of 4 and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000 or by using fax
number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and testimony.
To receive facsimile copies of the daily list or any list from the past
30 days, please call (202) 512-6000 using a touch-tone phone. A
recorded menu will provide information on how to obtain these
lists.

For information on how to access GAO reports on the INTERNET,
send e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov
United States                       Bulk Rate
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                Permit No. G100
Official Business
Penalty for Private Use $300

Address Correction Requested




(182833)