Pursuant to a congressional request, GAO provided information on: (1)
the extent to which inmates in the Bureau of Prisons (BOP) and state
prison systems had access to personal information through correctional
industry work programs; (2) prison safeguards and procedures, statutes
and regulations, and proposed legislation that addressed correctional
industry work programs involving personal information; (3) the extent to
which contracts that provided inmates access to personal information
contributed to BOP's and states' correctional industry income; (4) the
extent to which BOP and state prison inmates had access to only names
and addresses or telephone numbers through correctional industry work
programs; and (5) incidents of inmates misusing information obtained
through correctional industry work programs, including how safeguards
failed and what, if any, changes were made as a result of the incidents.
GAO noted that: (1) on September 30, 1998, of approximately 1.2 million
inmates, about 1,400 in BOP and 19 state prison systems had access to
personal information through correctional industry work programs, based
on the questionnaire responses from correctional industry officials; (2)
of these 1,400 inmates, about 1,100 had access to names and dates of
birth or Social Security numbers; (3) these inmates were performing
work, such as data entry, for the federal, state, or local governments;
(4) BOP and all the 19 states reported using a variety of safeguards to
prevent inmates from misusing the information; (5) the safeguards cited
by the largest number of states were close supervision, selective hiring
(e.g., excluding inmates convicted of sex offenses or fraud),
confidentiality agreements, and security checks at the exits from the
work areas; (6) the federal government and seven states in which inmates
had access to personal information were identified as having either
enacted statutes or had bills pending that related to limiting which
inmates could perform work involving personal information; (7) less than
one-hundredth of 1 percent of BOP's and no more than 22 percent of any
state's fiscal year 1998 gross correctional industry income was
generated from contracts that resulted in inmates having access to
personal information; (8) six states reported that less than 1 percent
of their gross correctional industry income was earned from these
contracts; (9) about 5,500 inmates in BOP and 31 state prison systems
had access to only names and addresses or telephone numbers through
correctional industry work program contracts or support work; (10) the
three safeguards that the largest number of states and BOP reported
using were similar to those used when inmates had access to personal
information--close supervision, security checks at the exits from the
work areas, and selective hiring; (11) questionnaire respondents
described nine incidents in which inmates misused personal information
or names and addresses or telephone numbers obtained from correctional
industry work programs; (12) in four of the nine incidents, inmates
removed information from the work areas, either physically or by
memorization; and (13) in five of the incidents, the work programs were
discontinued.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: GGD-99-146
TITLE: Prison Work Programs: Inmates' Access to Personal
Information
DATE: 08/18/1999
SUBJECT: Correctional facilities
Offender rehabilitation
Confidential communication
Surveys
Internal controls
Prisoners
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. This text was extracted from a PDF file. **
** Delineations within the text indicating chapter titles, **
** headings, and bullets have not been preserved, and in some **
** cases heading text has been incorrectly merged into **
** body text in the adjacent column. Graphic images have **
** not been reproduced, but figure captions are included. **
** Tables are included, but column deliniations have not been **
** preserved. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** <info@www.gao.gov> **
** **
** with the message 'info' in the body. **
******************************************************************
United States General Accounting Office GAO Report
to the Honorable Charles F. Bass House of Representatives August
1999 PRISON WORK PROGRAMS Inmates' Access to Personal
Information GAO/GGD-99-146 United States General Accounting Office
General Government Division Washington, D.C. 20548 B-280467
August 18, 1999 The Honorable Charles F. Bass House of
Representatives Dear Mr. Bass: This report responds to your
request that we obtain information on correctional industry work
programs1 under the federal Bureau of Prisons (BOP) and in state
prison systems2 that allow inmates access to personal information.
For this assignment, we defined personal information as
information that can be used to threaten an individual's physical,
psychological, or financial well-being. This information would
include (1) credit card numbers (personal or business); (2) Social
Security numbers; or (3) names in combination with physical
descriptions or financial, medical, or motor vehicle information.
You also were interested in information on inmates who had access
to only names and addresses or telephone numbers.3 This type of
information tends to be more readily available to the public, such
as through telephone books, than personal information. More
specifically, you asked for information on * the extent to which
inmates in the BOP and state prison systems had access to personal
information through correctional industry work programs; * prison
safeguards and procedures, statutes and regulations, and proposed
legislation that addressed correctional industry work programs
involving personal information; * the extent to which contracts
that provided inmates access to personal information contributed
to BOP's and states' correctional industry income; * the extent
to which BOP and state prison inmates had access to only names and
addresses or telephone numbers through correctional industry work
programs; and 1For our study, we defined correctional industry
work programs as work programs that produce products and services
for sale to government agencies and/or to the private sector. 2For
this report, when we refer to state or states, we are including
the District of Columbia. 3When we use the phrase "names and
addresses or telephone numbers" we are referring to names and one
or more of the following: work or home addresses or telephone
numbers, names of employers, or job titles but no other item that
we defined as personal information. Page 1
GAO/GGD-99-146 Inmates' Access to Personal Information B-280467 *
incidents of inmates misusing information obtained through
correctional industry work programs, including how safeguards
failed and what, if any, changes were made as a result of the
incidents. To answer these questions, we surveyed BOP and state
correctional industry officials by mail.4 Although questionnaire
respondents provided us with data on the number of inmates with
access to personal information or only names and addresses or
telephone numbers, it should be noted that some officials told us
that these data were estimates. We also contacted states'
attorneys general and the special counsel for the District of
Columbia, interviewed officials from federal investigative
agencies, and conducted literature and database searches. On
September 30, 1998, of approximately 1.2 million5 inmates, about
1,4006 Results in Brief in BOP and 19 state prison systems
had access to personal information through correctional industry
work programs, based on the questionnaire responses from
correctional industry officials. * Of these 1,400 inmates, about
1,100 had access to names and dates of birth or Social Security
numbers. These inmates were performing work, such as data entry,
for the federal, state, or local governments. * BOP and all of
the 19 states reported using a variety of safeguards to prevent
inmates from misusing the information. The safeguards cited by the
largest number of states were close supervision; selective hiring
(e.g., excluding inmates convicted of sex offenses or fraud);
confidentiality agreements;7 and security checks at the exits from
the work areas. The federal government and seven states in which
inmates had access to personal information were identified as
having either enacted statutes or had bills pending that related
to limiting which inmates could perform work involving personal
information. 4Representatives from Arizona's state-run facilities,
Ohio, and Tennessee declined to respond to our questionnaire. The
representatives from Arizona and Ohio told us that they would not
respond due to limited staffing. The Ohio representative informed
us that inmates involved in data entry work programs did not have
access to credit card numbers or Social Security numbers. Arizona
provided information on work programs in privately run facilities,
which we included in our analyses. 5The latest date for which data
were available from the Bureau of Justice Statistics on the number
of inmates in custody in federal and state correctional facilities
was June 30, 1998. See Prison and Jail Inmates at Midyear 1998,
Bureau of Justice Statistics, March 1999, NCJ 173414. 6This number
is an estimate because, as noted previously, state-run facilities
in Arizona, Ohio, and Tennessee declined to respond to our survey.
7Confidentiality agreements are agreements signed by the inmates
not to release information obtained through a work program. Page 2
GAO/GGD-99-146 Inmates' Access to Personal Information B-280467 *
Less than one-hundredth of 1 percent of BOP's and no more than 22
percent of any state's fiscal year 1998 gross correctional
industry income was generated from contracts that resulted in
inmates having access to personal information. Six states reported
that less than 1 percent of their gross correctional industry
income was earned from these contracts. In addition, about 5,500
inmates in BOP and 31 state prison systems had access to only
names and addresses or telephone numbers through correctional
industry work program contracts or support work.8 The three
safeguards that the largest number of states and BOP reported
using were similar to those used when inmates had access to
personal information- close supervision, security checks at the
exits from the work areas, and selective hiring. Questionnaire
respondents described nine incidents in which inmates misused
personal information or names and addresses or telephone numbers
obtained from correctional industry work programs. In four of the
nine incidents, inmates removed information from the work areas,
either physically or by memorization. In five of the incidents,
the work programs were discontinued. In 1995, the latest year for
which complete data were available, about 65 Background
percent (or about 647,000) of the inmates in custody in federal
and state places of confinement9 participated in 1 or more types
of work programs.10 These work programs included prison industries
(e.g., involving the manufacture of license plates, wood products,
and textiles); facility support services (e.g., doing office and
administrative work, food service, laundry, and building
maintenance); farming/agriculture; and public works assignments
(i.e., inmates working outside the facility on road, park, or
other public maintenance work). Data entry was the type of work
that most often allowed inmates access to personal information.
8We defined a contract as a formal or informal agreement
(including purchase orders) to produce a specific product or
perform a specific service. By support work, we mean inmates who
were not associated with a specific correctional industry work
program contract but who had access to personal information by
performing tasks, such as order taking, order fulfillment,
manufacturing or customer support, complaint resolution, or
shipping, that supported the industry work program operations.
9Places of confinement included prisons; prison hospitals; prison
farms; boot camps; and centers for reception, classification, or
alcohol/drug treatment. 10The latest date for which these data
were available from the Bureau of Justice Statistics was June 30,
1995. See Census of State and Federal Correctional Facilities,
1995, Bureau of Justice Statistics, August 1997, NCJ-164266. Page
3 GAO/GGD-99-
146 Inmates' Access to Personal Information B-280467 One mission
of the Federal Prison Industries (FPI), a BOP component, is to
employ and provide skills training to the greatest practicable
number of inmates and to produce market priced quality goods in a
self-sustaining manner that minimizes potential impact on private
business and labor. FPI markets about 150 types of products and
services to federal agencies. Some states had similar programs and
provisions. For example, Alabama generally requires state
departments, institutions, and political subdivisions to purchase
their products and services from Alabama Correctional Industries,
to the extent to which they can be supplied. In addition, only
those entities can purchase Correctional Industries products.
According to the Alabama Correctional Industries purpose
statement, it exists primarily for the purpose of providing a
work-training program for inmates of the Department of
Corrections. Another important purpose is to assist all state
departments, institutions, and political sub- divisions of the
State to secure their requirements to the greatest possible
extent. To obtain information on the assignment objectives, we
surveyed BOP and Scope and state correctional industry
officials by mail. We asked the officials to Methodology
answer questions on correctional industry work programs in
federal, state, and privately run facilities for which the federal
or state government or state-appointed organizations had
oversight. We limited the questionnaire to work programs
associated with secure, confined facilities, including youth
authorities but excluding programs associated with prerelease
facilities and city and county jails. We asked * if on September
30, 1998, they had inmates who, through performing (1) work on
correctional industry work program contracts that were either in
progress or were agreed to but the work had not been started or
(2) support work for the industry work program operations, had
access to personal information or only names and addresses or
telephone numbers; * what prison procedures, statutes,
regulations, pending legislation, or other guidelines provided
guidance on (1) limiting which inmates perform work involving
access to personal information and (2) preventing personal
information from being retained by inmates or being transferred to
unauthorized inmates or other persons; * what the total gross
income was for the correctional industry work program and the
income generated by those contracts that resulted in inmates
having access to personal information in the most recently
completed fiscal year; and * what incidents of misuse occurred as
a result of inmates having access to the information through
correctional industry work programs. Page 4
GAO/GGD-99-146 Inmates' Access to Personal Information B-280467 We
received responses from BOP, 47 states, and the District of
Columbia. We did not independently verify the information provided
by questionnaire respondents. We did, however, compare the
questionnaire responses to the results of our current literature
and legal database searches. After we consolidated the data
received from the questionnaire respondents in the tables included
in this report, we faxed the compiled information to all of the
questionnaire respondents for confirmation of the accuracy of the
data displayed and made corrections as necessary. We interviewed
BOP and state officials. We also contacted states' attorneys
general to obtain information on (1) incidents of misuse of which
they were aware and (2) state statutes or regulations, pending
legislation, or other guidelines that provided guidance on work
programs involving personal information. We requested comments on
a draft of this report from BOP and the Correctional Industries
Association, Inc. They provided written comments that are
summarized at the end of this report and are reprinted in
appendixes X and XI. We performed our work from June 1998 to June
1999 in accordance with generally accepted government auditing
standards. Appendix I provides more details on our objectives,
scope, and methodology. On September 30, 1998, about 1,400 inmates
in BOP and 19 state prison Extent to Which systems
had access to personal information through correctional industry
Inmates Had Access to work programs, according to the
questionnaire respondents. This number accounts for (1) about one-
tenth of 1 percent of all inmates in custody as Personal
Information of June 30, 1998, (or approximately 1.2
million) and (2) about 2 percent of all inmates participating in
correctional industry work programs (approximately 61,500). Almost
all of the inmates who had access to personal information were
being held in federal or state-run facilities (1,332 inmates) as
opposed to privately run facilities (25 inmates). The number of
inmates with access to personal information in each of the 19
states ranged from 6 in New Jersey to 426 in California. The types
of information to which the largest number of inmates had access
were (1) names and dates of birth or (2) Social Security
numbers.11 About 30 11The numbers of inmates having access to
specific types of personal information are the maximum number that
would have had access to the information. Some inmates worked on
more than one contract. Also, we asked respondents for the number
of inmates on each contract and the types of information to which
inmates had access. However, each inmate may not have had access
to all the types of personal information involved in a contract.
Page 5 GAO/GGD-
99-146 Inmates' Access to Personal Information B-280467 percent of
the inmates had access to names and (1) drivers' license numbers
or (2) vehicle makes and models. Appendix II shows the number of
inmates in BOP and individual state prison systems that had access
to personal information on September 30, 1998, and the types of
information to which they had access. Most of the inmates who had
access to personal information were performing work for federal,
state, or local governments (93 percent) as opposed to private
sector companies (7 percent). Over half of the inmates with access
to personal information were involved in data entry work. Another
about 25 percent of the inmates were duplicating or scanning
documents. Types of information processed in these work programs
included * medical records; * state, county, or local licenses;
* automobile registrations; * unemployment records; * student
enrollment data; and * accident reports. The length of time the
contracts that resulted in inmates having access to personal
information had been in effect ranged from less than 1 year to 19
years. About 1 quarter of the contracts had been in place from 10
to 19 years; the remainder were more recent. The reasons BOP and
states most commonly identified for selecting the contracts that
resulted in inmates having access to personal information were the
contracts * provided valuable job skills training, * satisfied a
need or demand for a service, * were needed to provide work for
more inmates, * were profitable, and * provided work that was
relatively easy for training inmates. Questionnaire respondents
from 11 states said they planned to add and/or expand existing
correctional industry work programs that allow inmates access to
personal information. Respondents from 29 states said they did not
plan to add or expand existing work programs that would allow
inmates access to personal information, and respondents from 8
states said they did not know whether their states had plans to
add and/or expand existing correctional industry work programs
that would allow inmates access to personal information. Page 6
GAO/GGD-99-146 Inmates' Access to Personal Information B-280467 In
response to our survey, 29 states indicated that inmates did not
have access to personal information on September 30, 1998. The
more commonly stated reasons were that the opportunity had not
presented itself, the prisons prohibited such work programs, and
public opinion limited the feasibility of implementing such work
programs. BOP and each state that had work programs in which
inmates had access Safeguards Used When to personal information
reported that they had in place a variety of Inmates Had Access to
safeguards to prevent inmates from misusing personal information.
In addition, BOP and most of the states in which inmates had
access to Personal Information personal information
reported that they had prison procedures that limited which
inmates could perform work that would give them access to personal
information. The federal government and seven states in which
inmates had access to personal information were identified as
having either enacted statutes or had bills pending that related
to limiting which inmates could perform work involving personal
information. The safeguards most frequently reported as being used
when inmates had access to personal information were close
supervision; selective hiring (e.g., excluding inmates convicted
of sex offenses or fraud); confidentiality agreements; and
security checks at the work area exits. Other commonly used
safeguards included security checks at the work area entrances, no
photocopy machines in the work area, and monitored telephone
calls. Appendix III provides additional information on the
safeguards cited by questionnaire respondents. BOP and most of the
19 states in which inmates had access to personal information
reported that they had prison procedures that placed limitations
on which inmates could perform work that would give them access to
personal information. Questionnaire respondents from BOP and 18
states said that they screened inmates before hiring them for work
programs involving personal information. For example, one state
respondent said that inmates who were convicted of rape or who
have life sentences were ineligible to work on contracts where
they would have access to personal information. In addition, in
the course of our work, statutes or proposed legislation related
to this issue were identified in seven of the states as well as
the federal government in which inmates had access to personal
information. A brief summary of these provisions is provided in
appendix IV, table IV.1. Further, six states were identified in
which inmates did not have access to personal information that had
enacted statutes or introduced legislation Page 7
GAO/GGD-99-146 Inmates' Access to Personal Information B-280467
that related to this issue. For more information on these statutes
and pending bills, see appendix IV, table IV.2. Less than one-
hundredth of 1 percent of the BOP's annual gross Income Generated
correctional industry income of $568 million was generated from
its From Contracts That contract that allowed inmates
access to personal information. For those states in which inmates
had access to personal information, no more than Allowed Inmates
22 percent of any state's gross fiscal year 1998 correctional
industry Access to Personal income was generated
from these contracts; six states reported that less Information
than 1 percent of their gross correctional industry income was
earned from these contracts. In total, these states grossed about
$18 million in 1998 from correctional industry work program
contracts that allowed inmates access to personal information,
compared to an annual gross correctional industry income of about
$515 million. Appendix V provides information on the income
generated from these contracts. About 5,500 inmates, in BOP and 31
state prison systems, had access to Extent to Which
only names and addresses or telephone numbers through correctional
Inmates Had Access to industry work programs. Over half of these
inmates were in the custody of BOP. Appendix VI presents these
data by BOP and state. The types of work Only Names and
inmates were performing in the largest number of states in which
they had Addresses or this access were order
fulfillment, data entry, shipping, and printing. For Telephone
Numbers additional information on the types of work
performed by inmates with access to only names and addresses or
telephone numbers, see appendix VII. The safeguards that BOP and
most states reported using when inmates had access to only names
and addresses or telephone numbers were similar to those reported
being used when inmates had access to personal information. The
most commonly used safeguards reported by states included close
supervision while working, security checks at the exits from the
work areas, selective hiring, and security checks at the entrances
to the work areas. For additional information on safeguards that
BOP and states used when inmates had access to only names and
addresses or telephone numbers, see appendix VIII. Questionnaire
respondents from eight states reported a total of nine Incidents
of Inmates incidents in which inmates misused personal
information or names and Misusing Personal
addresses or telephone numbers that they obtained from a
correctional industry work program. We defined misuse of
information as any action Information or Names that threatened or
caused injury to the physical, psychological, or financial and
Addresses or well-being of any member of the
public. Each of these incidents was Telephone Numbers
associated with a different contract. Six of the incidents
involved inmates Page 8 GAO/GGD-99-146
Inmates' Access to Personal Information B-280467 contacting
individuals identified through a work program by telephone or by
mail (in one of these instances, the inmate in the work program
passed information on an individual to another inmate, who then
contacted the individual). Two incidents involved inmates using
credit card numbers that they obtained through participating in a
work program. The other incident involved two inmates' attempts to
smuggle copies of documents out of the prison through the U.S.
mail. Five of the contracts related to these incidents were
terminated after the incident occurred. In three of the four other
incidents, the prison responded by either adding new safeguards or
reinforcing existing safeguards used on the contract. In the
remaining incident, the prison's procedures remained the same. For
more information on these incidents, see appendix IX.
Questionnaire respondents also provided information on four
additional incidents that did not meet the previously described
criteria for misuse of personal information. On the basis of one
or more of the following reasons, these four incidents were not
included in appendix IX: no reported injury, a court finding of no
wrongdoing, or termination of the inmate from the work program on
the basis of an allegation or suspected wrongdoing. These
incidents, however, resulted in some type of program change. The
types of program changes ranged from adding or reinforcing
policies and safeguards to program termination. Briefly, these
incidents, as reported by the respondents, consisted of the
following: * An inmate was processing accident reports in a data
entry work program. He told another inmate, not in the work
program, about an individual involved in one of the accident
reports he processed. The other inmate contacted the individual
involved in the accident. The questionnaire respondent reported
that nobody was harmed, safeguards did not fail, and no sanctions
were taken. After this incident, the state reportedly reinforced
its policies and safeguards associated with this contract. * An
inmate working in a data entry work program saw, reportedly by
accident, a state document that had information about one of his
family members. He spoke with another member of his family about
the information he saw. A member of his family filed a lawsuit
claiming that the inmate should not have had access to this
information. The questionnaire respondent reported that the case
was dismissed because the information was covered by an open
record regulation whereby birth records are considered to be
public records. The state, however, canceled the contract for
processing this type of information. Page 9
GAO/GGD-99-146 Inmates' Access to Personal Information B-280467 *
An inmate working in a telemarketing work program was accused of
harassing a customer. The inmate was terminated and transferred to
maximum security on the basis of the allegation alone. The state
reportedly implemented additional safeguards after the alleged
incident was reported. * An inmate wrote a letter to an
individual, and it was suspected that the inmate obtained the
individual's name and address through the work program. According
to the survey response, the inmate was disciplined and terminated
from the work program, and a measure providing for the closer
monitoring of inmates was instituted. In commenting on our report,
BOP concurred with our report with one Agency Comments and
exception. BOP noted that since our survey, it changed its
procedures, and Our Evaluation no inmates in the
BOP prison system have access to personal information. Since our
methodology was to report on the number of inmates who had access
to personal information on September 30, 1998, we did not
eliminate the 25 BOP inmates who we reported as having access to
personal information. (See app. X.) The Correctional Industries
Association, Inc., in its comments said that our report was fair
and thorough and presented the facts objectively. However, it took
two exceptions with the report. First, the Association said that
the information on inmates' access to personal information is
presented largely out of context. We disagree. Our draft report
said that of approximately 1.2 million inmates, about 1,400 in BOP
and 19 state prison systems had access to personal information
through correctional industry work programs. We noted that less
than one-hundredth of 1 percent of BOP's and no more than 22
percent of any state's fiscal year 1998 gross correctional
industry income was generated from contracts that resulted in
inmates having access to personal information. Further, we pointed
out that about a quarter of the contracts that resulted in inmates
having access to personal information had been in place from 10 to
19 years. Second, the Association said that a benchmark is needed
against which the success or failure of correctional industries to
control access issues can be measured. We did not judge whether
the correctional industries have succeeded or failed in their
attempt to prevent the misuse of personal information to which
inmates had access as the result of work programs because we are
not aware of criteria by which to make such a judgment. Page 10
GAO/GGD-99-146 Inmates' Access to Personal Information B-280467
However, given that the inmates with access to personal
information are individuals who have been incarcerated for crimes,
and given that the institutional settings permit work program
officials to exercise close scrutiny over the inmates and work
places, breaches of security and misuses of personal information
are a cause for concern. (See app. XI.) As agreed, unless you
announce the contents of this report earlier, we plan no further
distribution until 30 days from the date of this letter. At that
time, we will send copies of this report to the Honorable Janet
Reno, Attorney General; the Honorable Kathleen Hawk Sawyer,
Director, BOP; Ms. Gwyn Smith Ingley, Executive Director,
Correctional Industries Association, Inc.; the states that
responded to our survey; and other interested parties. Copies will
also be made available to others upon request. The major
contributors to this report are acknowledged in appendix XII. If
you or your staff have any questions about the information in this
report, please contact me or Brenda Bridges on (202) 512-8777.
Sincerely yours, Richard M. Stana Associate Director,
Administration of Justice Issues Page 11
GAO/GGD-99-146 Inmates' Access to Personal Information Contents 1
Letter Appendix I: Objectives, Scope, and Methodology
14 Appendixes Appendix II: Number of Inmates With Access to
Personal 18 Information Through Work
Programs Appendix III: Safeguards Used in Work Programs in
26 Which Inmates Had Access to Personal Information Appendix IV:
Procedures, Statutes, and Pending Bills
31 Appendix V: Income From Work Programs That Allowed
35 Inmates Access to Personal Information, Fiscal Year 1998
Appendix VI: Number of Inmates With Access to Only
38 Names and Addresses Through Work Programs Appendix VII: Type of
Work Performed in Work 40
Programs in Which Inmates Had Access to Only Names and Addresses
Appendix VIII: Safeguards Used in Work Programs in
44 Which Inmates Had Access to Only Names and Addresses Appendix
IX: Incidents of Misuse of Personal Information
48 by Inmates Appendix X: Comments From the Bureau of Prisons
52 Appendix XI: Comments From the Correctional
53 Industries Association, Inc. Appendix XII: GAO Contacts and
Staff Acknowledgments 54 Table IV.1:
Federal and State Prison Procedures,
31 Tables Statutes, and Pending Bills That Address
Limitations on Inmates Who Perform Work Involving Personal
Information Where Inmates Had Access to Personal Information on
September 30, 1998 Table IV.2: Statutes and Pending Bills That
Address Work 34 Programs Involving Access to
Personal Information in States Where Questionnaire Respondents
Reported That Inmates Did Not Have Access to Personal Information
on September 30, 1998 Page 12 GAO/GGD-99-146
Inmates' Access to Personal Information Contents Abbreviations BOP
Bureau of Prisons FPI Federal Prison Industries Page 13
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix I
Objectives, Scope, and Methodology The objectives of our study
were to * determine the extent to which inmates in the BOP and
state prison systems had access to personal information through
correctional industry work programs; * identify prison safeguards
and procedures, statutes and regulations, and proposed legislation
that addressed correctional industry work programs involving
personal information; * determine the extent to which contracts
that provided inmates access to personal information contributed
to BOP's and states' correctional industry income; * determine
the extent to which inmates in the BOP and state prison systems
had access to only names and addresses or telephone numbers
through correctional industry work programs; and * identify
incidents of inmates misusing information obtained through a
correctional industry work program, including how safeguards
failed and what, if any, changes were made as a result of the
incidents. For our study, we defined correctional industry work
programs as programs that produced products and services for sale
to government agencies and/or to the private sector. We excluded
institutional work programs, i.e., programs that would involve
activities such as housekeeping, food services, day-to-day
maintenance, and community service, as well as support programs in
which an inmate may have inadvertently seen personal information.
The scope of our study included work programs that were (1)
overseen by BOP, a state government, or a state-appointed
commission; (2) associated with federal, state, or privately run
facilities; and (3) associated with secure, confined facilities-
including youth authorities-but not programs associated with
prerelease facilities or city or county jails. We defined
"personal information" as information that could be used to
threaten an individual's physical, psychological, or financial
well-being. This information would include (1) credit card numbers
(personal or business); (2) Social Security numbers; or (3) names
in combination with physical descriptions or financial, medical,
or motor vehicle information. We also collected data on inmates'
access to "names and addresses or telephone numbers," which
included a name and one or more of the following: work or home
address or telephone number, name of employer, or job title but no
other item that we defined as personal information. Page 14
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix I
Objectives, Scope, and Methodology To meet the assignment
objectives, we surveyed, by mail, correctional industry officials
in BOP, all 50 states, and the District of Columbia. The
questionnaire asked for information on the following: *
correctional industry work program contracts that involved
personal information that were either orders-in-progress or that
had been agreed to but had not yet been started on September 30,
1998;1 * the number of inmates who had access to personal
information or to names and addresses or telephone numbers through
correctional industry work program contracts or support work; *
safeguards that were in place to prevent inmates from misusing the
information; * statutes, regulations, procedures, other
guidelines, and proposed legislation that dealt with correctional
industry work programs involving personal information; * the
gross income in the most recently completed fiscal year for the
correctional industry work program overall and for those contracts
that involved personal information; and * incidents of misuse of
information that occurred at any time as a result of inmate access
to the information through a correctional industry work program.
We asked questionnaire respondents for information on inmates who
had access to (1) personal information or (2) names and addresses
or telephone numbers, either through working on a correctional
industry work program contract or through performing support work
for the industry work program operations. We defined a contract as
a formal or informal agreement to produce a specific product or
perform a specific service. We defined inmates who were performing
support work as inmates who were not associated with a specific
correctional industry work program contract but who performed
tasks-such as order taking, order fulfillment, manufacturing or
customer support, complaint resolution, or shipping-that supported
the industry work program operations. In designing our
questionnaire, we received input from the Correctional Industries
Association, Inc. (a nonprofit professional organization
representing individuals and agencies engaged in and concerned
with correctional industries) and federal and state correctional
industry 1We chose September 30, 1998, because it coincided with
the last day of the federal and some states' fiscal years. We
anticipated that quarterly or annual data would be collected and
compiled at that time and that this would facilitate the
questionnaire recipients' ability to provide us with information.
Page 15 GAO/GGD-
99-146 Inmates' Access to Personal Information Appendix I
Objectives, Scope, and Methodology officials. We revised the
questionnaire based on the feedback these officials provided. We
made further changes based on input from correctional industry
officials as a result of pilot testing the survey instrument in
Maryland and Virginia. To identify questionnaire recipients, we
called the contact point for each state's correctional industry
program as identified in the 1998 Correctional Industries
Association, Inc., Directory. We informed them of our assignment
and asked whether they would be the proper recipients for the
questionnaire. We asked these officials if their state had any
privately run prisons that housed inmates from their state prison
system or from other states' prison systems. If they had such
facilities, we asked them to identify the individual who had
oversight responsibilities for work programs in these facilities.
To further ensure that we had a respondent for each privately run
facility that met our criteria (i.e., the facility was a secure,
confined facility- including youth authorities-but not a
prerelease facility or city or county jail, and any work programs
in the facility would be overseen by BOP, a state government, or a
state-appointed commission), we obtained a list of privately run
correctional facilities from the Private Corrections Project
Internet web site.2 We then contacted the individuals whom we had
identified as overseeing work programs at privately run facilities
to ensure that they had responsibility for each facility that met
our criteria. If they stated that they did not have
responsibility, we asked them who did and repeated this procedure
until we reached the appropriate party. We mailed a total of 63
questionnaires: 1 to BOP, 1 to each state and the District of
Columbia, 1 to a youth authority, 1 to a joint venture program,
and 1 each to 9 privately run facilities that had been identified
by the method described above. Representatives from two states,
Arizona and Tennessee, informed us that they would not be
participating in our survey. Ohio's representative also indicated
that he would not be completing the questionnaire but told us that
Ohio does not permit inmates involved in data entry to have access
to credit card numbers or Social Security numbers. When we
received the questionnaires, we followed-up by telephone on
missing or incomplete data, consolidated the data into the tables
displayed in this report, faxed the completed tables to all
questionnaire respondents for confirmation of the accuracy of the
data displayed, and made corrections as necessary. Questionnaire
respondents were provided only with compiled data concerning their
individual states. 2 The address for this web site is
http://web.crim.ufl.edu/pcp. Page 16
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix I
Objectives, Scope, and Methodology We also conducted literature
and legal database searches to identify published articles,
reports, studies, statutes, proposed bills, and other documents
dealing with the assignment objectives. We contacted
representatives from various organizations to determine what
information they may have that related to our assignment
objectives. These organizations included the American Correctional
Association; Correctional Industries Association, Inc.; American
Jail Association; American Federation of Labor and Congress of
Industrial Organizations; and Union of Needletraders, Industrial
and Textile Employees. We contacted each state's attorney
general's office and the District of Columbia's Corporation
Counsel to identify any additional (1) incidents of inmates
misusing information obtained through correctional industry work
programs and (2) state statutes or regulations, proposed
legislation, or other guidance that dealt with correctional
industry work programs involving personal information. We did not
verify the completeness of the information provided. We contacted
various federal agencies with investigatory responsibilities to
determine if they were aware of instances of inmates misusing
personal information that they obtained through correctional
industry work programs. Within the Department of the Treasury, we
contacted the Internal Revenue Service's Criminal Investigation
Division and the U.S. Secret Service. Within the Department of
Justice, we contacted the Federal Bureau of Investigation.
Finally, we contacted the U.S. Postal Service and the Social
Security Administration. We performed our work between June 1998
and June 1999 in accordance with generally accepted government
auditing standards. Page 17 GAO/GGD-99-146
Inmates' Access to Personal Information Appendix II Number of
Inmates With Access to Personal Information Through Work Programs
Totals in bold Jurisdiction/
Social security Credit card Contractor Number of
inmates number number Federal Bureau of
Prisons 25 25 Federal agency
25 25 State Alabama 0
Alaska 0 Arizona
NR NR NR Arkansas
13 State agency 13 California
426 426 State agency 426
426 Colorado 0 Connecticut
0 Delaware 0 District of Columbia
0 Florida 55 20 State
agency 1 10 10 State agency 2
10 10 State agency 3 5 State
agency 4 5 State agency 5 25 Georgia
0 Hawaii 0 Idaho
31 31 State agency 31
31 Illinois 86 State agency 1
38 State agency 2 48 Indiana
0 Iowa 20 20 State
agency 20 20 Kansas
15 15 State agency 15
15 Kentucky 56 56 State
agency 56 56 Louisiana
0 Maine 0 Maryland
0 Massachusetts 0 Michigan
0 Minnesota 15 Private company 1
10 Private company 2 5 Page 18
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix II
Number of Inmates With Access to Personal Information Through Work
Programs Name and Driver's Home Make and
Employee Date of Home license telephone Name of model of Income
or Place of Medical Prescription identification birth address
number number employer vehicle salarya birth
diagnosis information number Other NR NR NR
NR NR NR NR NR NR
NR NR NR 13 13
13 13 13
13 b 426
426 426
426c 45 50 30 20 10 30
5 55 10
10 10
10d 10 10 10
10e 5
5f 5 5 5 5
5 5g 25 25
25 25
25h 31 31 31 31 31
31 31 31 31 31 31
31 d 86 86 86 86 38 38
38 38 48 48 48
48 20
20 20 20
20 20 f 15 15
15 15 15 15 15 15 15
15 56 56
56 56 56
56 56
56 d 15 15 5 10
5 10 10 10a 5
5 5
5i Page 19 GAO/GGD-99-146 Inmates'
Access to Personal Information Appendix II Number of Inmates With
Access to Personal Information Through Work Programs Totals in
bold Jurisdiction/ Social
security Credit card Contractor Number of
inmates number number Mississippi
0 Missouri 48 48 State
agency 1 9 9 State agency 2
15 15 State agency 3 15
15 State agency 4 9 9 Montana
0 Nebraska 0 Nevada
0 New Hampshire 25 State agency
25 New Jersey 6 3 State
agency 1 2 State agency 2 3
3 State agency 3 1 New Mexico
26 26 State agency 1 1
1 State agency 2 25 25 New York
23 State agency 1 13 State agency 2
10 North Carolina 0 North Dakota
0 Ohio NR 0
0 Oklahoma 254 221
84 State agency 1 2 2 State
agency 2 4 4 State agency 3
3 3 State agency 4 3
3 State agency 5 3 3 State
agency 6 3 3 State agency 7
5 5 State agency 8 33 State
agency 9 27 27 State agency 10
41 41 State agency 11 41
41 State agency 12 27 27 State
agency 13 41 41 State agency 14
41 41 State agency 15 46
46 State agency 16 46 State agency 17
84 84 State agency 18 84
84 State agency 19 84 84 Page 20
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix II
Number of Inmates With Access to Personal Information Through Work
Programs Name and Driver's Home Make and
Employee Date of Home license telephone Name of model of
Income or Place of Medical Prescription identification birth
address number number employer vehicle salarya
birth diagnosis information number Other 30 30
15 15 9 15
15 24 9
9d 15 15 15 15
15 15 15
15 15j 25 25 25
25 1 3 1
3 2 2
2k 3 1 1 1 25 25
26 1 25 25
25 25 1 1 25 25
25 25 25
25 25d 13 10 13
13 23 13
13 13
13l 10
10m NR NR NR NR NR NR
NR NR NR NR NR NR 207
246 174 207 208 204 132
166 117 117 49 254 2 2
2 2 2 2 2
2d 4 4 4
4 4 4 4 4n 3
3 3 3
3o 3p 3 3
3q 3 3 3
3 3d 5
5 5d 33 33
33r 27 27 27 27
27 27 27 27s 41
41 41 41t 41
41 27 27 41 41 41
41 41 41 41 41 46 46
46 46 46
46s 46 46 46
46u 84 84 84 84
84 84 84 84 84s 84
84 84 84 84 84
84 84 84s 84 84 84
84 84 84 84 84 84
84 84d Page 21
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix II
Number of Inmates With Access to Personal Information Through Work
Programs Totals in bold Jurisdiction/
Social security Credit card Contractor Number of
inmates number number Oklahoma (cont.) State
agency 20 84 84 84
Oregon 75 State agency 1 35
State agency 2 40 Pennsylvania 0
Rhode Island 0 South Carolina
0 South Dakota 18 18 State
agency 18 18 Tennessee
NR NR NR Texas
0 Utah 60 60 State
agency 60 60 Vermont
0 Virginia 0 Washington
0 West Virginia 0 Wisconsin
80 80 Private company 80
80 Wyoming 0 Total
1,357 1,049 84 Page 22
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix II
Number of Inmates With Access to Personal Information Through Work
Programs Name and Driver's Home Make and
Employee Date of Home license telephone Name of model
of Income or Place of Medical Prescription identification birth
address number number employer vehicle
salarya birth diagnosis information number
Other 84 84 84 84
84d 75 35 40 40
35
40 35 35
35 40 40 40
40v 18 18 18
18 18 18 18
18d NR NR NR NR NR NR
NR NR NR NR NR
NR 60 60 60 60 60
60 60 60 60 60 60
60f 80 80
80 80 80
80d 1,133 742 464 431 413
411 249 194 157 155
74 1,132 Note 1: Personal information means
information that can be used to threaten an individual's physical,
psychological, or financial well-being. This information would
include (1) credit card numbers (personal or business); (2)
Social Security numbers; or (3) names in combination with physical
descriptions or financial, medical, or motor vehicle information.
This table does not include inmates who had access to only names
and one or more of the following: work or home address or
telephone number, name of employer, or job title. For that
information, see appendix VI. Note 2: States with "NR" in each
category did not return a questionnaire. We received a
questionnaire from Arizona's privately run facilities. These
facilities did not have any inmates who had access to names,
addresses, telephone numbers, or other types of personal
information. A representative from Ohio's state-run facilities
informed us that inmates involved in data entry work programs did
not have access to credit card numbers or Social Security numbers.
We did not receive any information from respondents in state-run
correctional facilities in Arizona or Tennessee. Note 3: The
numbers shown above represent the maximum numbers of inmates who
would have had access to each type of personal information. Some
inmates worked on more than one contract. Consequently, as in
Oklahoma, totals are not the sum of the number of inmates shown
for each contract. Also, we asked respondents for the types of
personal information to which inmates had access. However, each
inmate may not have had access to all of the types of personal
information involved in a contract. Note 4: According to the
questionnaire respondents, the data from Idaho represent the
combined information from two contracts, and the data from New
Hampshire were combined from five contracts. Illinois' data
represent one contract situated in two geographic locations.
aIncome or salary may refer to a range rather than a discreet
number. In Minnesota, customers are prompted to refuse to respond
at their discretion. bPhysical description. cOptical prescription
and gender. Page 23 GAO/GGD-99-146
Inmates' Access to Personal Information Appendix II Number of
Inmates With Access to Personal Information Through Work Programs
dWork address and work telephone number. ePhysician's name and
date of incident. fMother's maiden name. gVehicle identification
number. hBoat description. iWork telephone number, vehicle
identification number, and license plate number. jMedical
treatment information. kWork address, federal identification
number of business, or Social Security number. lWork address, work
telephone number, Medicaid recipient number, and Medicaid provider
number. mDriver's license plate number. nMedical information. oMug
shot. pName of payee, address, claim number, and amount of check.
qAmount of check. rLien information. sWork address, work telephone
number, and mother's maiden name. tWork address. uLien holder.
vLicense plate number, driver's license suspension, and motor
vehicle-related conviction. Source: GAO survey of correctional
industry officials. Page 24 GAO/GGD-
99-146 Inmates' Access to Personal Information Appendix II Number
of Inmates With Access to Personal Information Through Work
Programs Page 25 GAO/GGD-99-146 Inmates'
Access to Personal Information Appendix III Safeguards Used in
Work Programs in Which Inmates Had Access to Personal Information
Jurisdiction/ Close Selective
Confidentiality Security check Security check at
contractor supervision hiring agreementa
at exit entrance Federal Bureau of Prisons Federal
agency * * * State Arkansas
State agency * *
* California State agency * *
* * Florida State agency 1 *
* * * * State
agency 2 * * *
* * State agency 3 *
* * * * State
agency 4 * * *
* * State agency 5
* Idaho State agency *
* * * Illinois State
agency 1 * *
* * State agency 2 *
* * * * Iowa
State agency * * *
* * Kansas State agency *
* * *
Kentucky State agency * *
* * Minnesota Private company 1 *
* * * *
Private company 2 * * *
* * Missouri State agency 1 *
* State agency 2 * *
State agency 3 * * State
agency 4 * * New
Hampshire State agency * *
* * * New Jersey State
agency 1 * * *
* * State agency 2 *
* * * State
agency 3 * * *
* * New Mexico State agency 1 *
* * * * State
agency 2 * * *
* * Page 26 GAO/GGD-99-146
Inmates' Access to Personal Information Appendix III Safeguards
Used in Work Programs in Which Inmates Had Access to Personal
Information Computer Personal program
with information No paper or No
photocopy Monitored privacy Incoming
segmented writing machines telephone calls
safeguards calls only among inmates
instruments Other *
*b * * *
*c * * *
*d * * *
* * * *
*e * *
* *f * *
* *f * * *
* *d * * * * * *
* * *
* *g * *
* * * *
*h *
*i * * * Page 27
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix
III Safeguards Used in Work Programs in Which Inmates Had Access
to Personal Information Jurisdiction/ Close
Selective Confidentiality Security check
Security check contractor supervision hiring
agreementa at exit at entrance New York
State agency 1 * * State agency 2
* * Oklahoma State agency 1 *
* * State agency 2 *
* * State agency 3 *
* * State agency 4 *
* * State agency 5 *
* * State agency 6 *
* * State agency 7 *
* * State agency 8 *
* * State agency 9 *
* * * *
State agency 10 * *
* * * State agency 11
* * * *
* State agency 12 * *
* * * State agency 13
* * * *
* State agency 14 * *
* * * State agency 15
* * * *
* State agency 16 * *
* * * State agency 17
* * * *
State agency 18 * *
* * State agency 19 *
* * * State agency 20
* * * *
Oregon State agency 1 * *
* * * State agency 2
* * *
* South Dakota State agency * *
* * * Utah State agency
* * * *
* Wisconsin Private company * *
* * Page 28 GAO/GGD-
99-146 Inmates' Access to Personal Information Appendix III
Safeguards Used in Work Programs in Which Inmates Had Access to
Personal Information Computer
Personal program with information
No paper or No photocopy Monitored privacy
Incoming segmented writing machines
telephone calls safeguards calls only among
inmates instruments Other *j * *
* * * *
* * * *
* * * *
* * * *
* * * *
* * * *
* * * *
* * * *
* * * *
* * * *
* * * *
* * * * *
*k * * * *
*k * * *
* * *
* *
*l Note 1: Personal information means information that can be
used to threaten an individual's physical, psychological, or
financial well-being. This information would include (1) credit
card numbers (personal or business); (2) Social Security numbers;
or (3) names in combination with physical descriptions or
financial, medical, or motor vehicle information. Note 2: A blank
means that the questionnaire respondent did not report using the
safeguard in the work program. Note 3: According to the
questionnaire respondents, the data from Idaho represent the
combined information from two contracts, and the data from New
Hampshire were combined from five contracts. Illinois' data
represent one contract situated in two geographic locations.
aConfidentiality agreements were agreements signed by the inmates
not to release information obtained through a work program.
bPrison staff conducted random inspections of work and housing
areas. Page 29 GAO/GGD-99-146
Inmates' Access to Personal Information Appendix III Safeguards
Used in Work Programs in Which Inmates Had Access to Personal
Information cSecurity cameras were located in the work area.
dInmates were not allowed to make telephone calls in the work
area. eTelephones located in the work area were auto-dialed.
fRecords could not enter or leave secure area at work site except
in custody of civilian state employee or bonded courier. gInmates
signed shop rules and procedures. hNo telephones were located in
the work area. iNo telephones or computers were located in the
work area. jInmates could not take paper or writing instruments
into or out of the work area. kPrison staff searched inmates'
desks. lPrison staff prescreened documents to ensure that they did
not contain certain types of information. Inmates were subject to
pat searches. Source: GAO survey of correctional industry
officials. Page 30 GAO/GGD-99-146
Inmates' Access to Personal Information Appendix IV Procedures,
Statutes, and Pending Bills Table IV.1: Federal and State Prison
Procedures, Statutes, and Pending Bills That Address Limitations
on Inmates Who Perform Work Involving Personal Information Where
Inmates Had Access to Personal Information on September 30, 1998
Jurisdiction Prison procedures
Statutes and pending bills Federal Bureau of Prisons Inmates who
were convicted of counterfeiting or Pending Bill H.R.
369 (1999): would prohibit the use of computer fraud offenses or
had extensive computer prison inmate labor for, among
other tasks, data knowledge were excluded
processing of personal information about children State Arkansas
Inmates must meet requirements for minimum security; inmates
convicted of rape or who had life sentences were excluded
California Inmates are screened by type of offense as per
California California Penal Code, Section 5071: in general, Penal
Code, Section 5071 prohibits
prison inmates convicted of offenses involving, for example,
misuse of a computer, misuse of personal/financial information of
another person, or a sex offense from performing prison employment
functions that provide such inmates with access to certain types
of personal informationa See also California Welfare Institutions
Code, Section 219.5: (language similar to above code section--
applicable to juveniles) a Florida Inmates were
screened for disciplinary actions and appropriate education level
Illinois Inmates were referred to the program by an
institutional Pending House Bill 70 (1999): would, in general,
prohibit committee and must have had a good institutional record
the use of inmates to enter any personally identifiable
information in a computer processible medium or any other medium
Iowa Selective hiringb
Iowa Code, Section 904.801: a statement of intent that outlines
various objectives to be met through the provision of meaningful
work opportunities to inmatesc Iowa Code, Section 904.809(1)(g):
with respect to private industry employment of inmates of
correctional institutions, various conditions shall apply to all
agreements for such employment, including that the state director
shall implement a system for screening and security of inmates to
protect the safety of the public Kansas Inmates must
have had a good work record and no disciplinary reports Page 31
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix IV
Procedures, Statutes, and Pending Bills Jurisdiction Prison
procedures
Statutes and pending bills Kentucky Inmates who had
violated the correctional institutions' Kentucky revised
statutes, Section 97.120: in general, rules were excluded
prohibits certain state agencies from entering into any contract
for the use or employment of prisoners in any capacity that allows
prisoners access to certain types of information, including, but
not limited to, taxpayer information, Social Security numbers,
telephone numbers, and addresses Minnesota Program review
committee identified high-risk inmates and prevented their
employment Mississippi All inmates were screened by the Dept.
of Corrections Internal Audit Division for security clearance. No
one was hired with a forgery, counterfeit, or document fraud
conviction. New Hampshire Selective hiringb New Jersey
Institutional classification
New Jersey Pending Assembly Bill 603 (1998): would prohibit
inmates at the Adult Diagnostic and Treatment Center from being
employed in a data entry position or any other capacity that would
provide the inmate access to certain types of personal information
New Mexico Inmates' conduct while incarcerated was
considered; inmates with a history of sex crimes, hate crimes, or
violent behavior were excluded New York Depending on
contract, inmates who committed New York
Pending Assembly Bill 4753 (1999): in insurance, motor vehicle,
credit card fraud, or extortion general, inmates involved
in correctional institution work were excluded
would be prohibited from accessing, collecting, or processing
certain types of personal information See also New York Pending
Assembly Bill 4842 (1999): (language similar to the above bill)
Oklahoma Inmates must have had at least 8th grade math and
reading skills; other factors, such as attitude, were considered
also Oregon Security screening, including conviction
type, was employed. Inmates convicted of computer fraud, crimes
with a high degree of violence, and some sex crimes, or inmates
that were considered to be high security risks by the institution
or Department of Corrections were not employed South Dakota
Selective hiringb Page 32 GAO/GGD-99-146
Inmates' Access to Personal Information Appendix IV Procedures,
Statutes, and Pending Bills Jurisdiction Prison procedures
Statutes and pending bills Utah Inmates were screened
for suitability for employment based on factors such as previous
employment and prison record Wisconsin
Wisconsin Pending Assembly Bill 31 (1999): would prohibit the
Department of Corrections from entering into any contract or other
agreement if, in the performance of the contract or agreement, a
prisoner would have access to any personal information of
individuals who are not prisoners Note: We did not independently
verify the completeness of the data provided by the questionnaire
respondents. aThis section also was identified by the state as
requiring that such persons in prison work programs disclose that
fact before taking any personal information from anyone. bThe
criterion by which inmates were selected was not specified. cThis
statute also was identified by the state as containing provisions
that related to preventing inmates from retaining personal
information or transferring it to unauthorized inmates or other
persons. Source: GAO survey of correctional industry officials,
state attorneys general, and legal database searches. Page 33
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix IV
Procedures, Statutes, and Pending Bills Table IV.2: Statutes and
Pending Bills That Address Work Programs Involving Access to
Personal Information in States Where Questionnaire Respondents
Reported That Inmates Did Not Have Access to Personal Information
on September 30, 1998 State Statutes and pending bills
Colorado Colorado Revised Statutes, Section 17-24-104: the
Correctional Industries Advisory Board, among other things, is to
consider the feasibility of proposed prison industries that would
utilize the services of prisoners Maryland Annotated Code of
Maryland, Article 27, Section 681C(3)(ii): authorizes the Board
of Public Works to suspend certain requirements that state
agencies utilize correctional industry services when data entry
services would involve certain types of protected information
Michigan Michigan Statutes Annotated, Section
28.1540(7a)(1)(a): prohibits inmates assigned to work in a
private manufacturing or service enterprise from being granted
access to certain types of employee; customer; or client
information; including, but not limited to, personal addresses,
telephone numbers, E-mail addresses, credit card information,
other financial information, and health records Texas
Texas Government Code, Section 497.098: in general, prohibits
inmates who have previously misused information gained through a
work program from participating in work programs that provide
inmates with access to personal information about persons who are
not confined in the institutional division Texas Pending House
Bill 812 (1999): in general, would prohibit the Department of
Criminal Justice from entering into contracts that would require
or permit certain sex offenders to have access to personal
information about persons who are not confined in facilities
operated by or for the departmenta Texas Pending Senate Bill 420
(1999): in general, would prohibit the Department of Criminal
Justice from entering into contracts that would require or permit
an inmate confined in a correctional facility operated by or for
the department to have access to personal information about
persons who are not confined in facilities operated by or for the
department Vermont Vermont Pending Bill H.88 (1999): would
require offenders engaged in a work activity involving the
solicitation of confidential information from the general public
to disclose such offender status and to obtain the consent of the
members of public concerned before proceeding Washington
Revised Code of Washington, Section 72.09: in general, requires
work program administrators to ensure that no inmate convicted of
certain sex offenses obtains access to names, addresses, or
telephone numbers of private individuals while performing his or
her duties in an inmate work program Note: We did not
independently verify the completeness of the data provided by the
questionnaire respondents. aThis bill also was identified as
containing provisions that related to preventing inmates from
physically retaining personal information or transferring it to
unauthorized inmates or other persons, i.e., inmates having access
to certain personal information would be personally searched upon
entering or leaving the work area. Source: GAO survey of
correctional industry officials, state attorneys general, and
legal database searches. Page 34
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix V
Income From Work Programs That Allowed Inmates Access to Personal
Information, Fiscal Year 1998 Income from Total income
Percentage of FY 1998 individual from
correctional industry gross contracts for contracts for FY
1998 correctional income from personal
Jurisdiction/Contractor FY 1998 FY 1998
industry gross income information contracts Federal
Bureau of Prisons Federal agency $6,000 Total
$6,000 $568,000,000 <0.1
State Arkansas State agency 135,000 Total
135,000 5,600,000 2.4
California State agency 11,962,000 Total
11,962,000 150,865,000
7.9 Florida State agency 1 N/Aa State agency 2
N/Aa State agency 3 N/Aa State agency 4
N/Aa State agency 5 N/Aa Total
N/Aa 81,000,000 Idaho State agency
144,000 Total 144,000
652, 000b 22.1 Illinois State agency 1
15,000 State agency 2 278,000 Total
293,000 47,435,000 0.6
Iowa State agency N/A Total
N/A 120,000 Kansas State agency
70,000 Total 70,000
10,600,000 0.7 Kentucky State agency
294,000 Total 294,000
12,400,000 2.4 Minnesota Private
company 1 73,000 Private company 2 3,000
Total 76,000
17,820,000 0.4 Page 35
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix V
Income From Work Programs That Allowed Inmates Access to Personal
Information, Fiscal Year 1998 Income from Total income
Percentage of FY 1998 individual from
correctional industry gross contracts for contracts for
FY 1998 correctional income from personal Jurisdiction/
Contractor FY 1998 FY 1998 Industry gross
income information contracts Missouri State agency 1
23,000 State agency 2 13,000 State agency 3
15,000 State agency 4 c Total
51,000 36,268,000
0.1 New Hampshire State agency 130,000 Total
130,000 2,500,000
5.2 New Jersey State agency 1 3,000 State agency
2 3,000 State agency 3 1,000
Total 8,000
17,199,000 <.1 New Mexico State
agency 1 d State agency 2
d Total 698,000
4,400,000 15.9 New York State agency
1 2,300,000 State agency 2 500,000
Total 2,800,000
60,800,000 4.6 Oklahoma State agency
1 c State agency 2 c
State agency 3 6,000 State agency 4
9,000 State agency 5 20,000 State agency 6
2,000 State agency 7 28,000 State agency 8
220,000 State agency 9 8,000 State agency 10
200,000 State agency 11 1,000 State agency 12
47,000 State agency 13 13,000 State agency 14
1,000 State agency 15 2,000 State agency 16
150,000 State agency 17 7,000 State agency 18
17,000 State agency 19 84,000 State agency 20
2,000 Total 817,000
16,754,000 4.9 Page 36
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix V
Income From Work Programs That Allowed Inmates Access to Personal
Information, Fiscal Year 1998 Income from Total income
Percentage of FY 1998 individual from
correctional industry gross contracts for contracts for
FY 1998 correctional income from personal
Jurisdiction/Contractor FY 1998 FY 1998
industry gross income information contracts
Oregon State agency 1 320,000 State agency 2
250,000 Total 570,000
15,000,000 3.8 South
Dakota State agency 0e Total
0e 261,000 Utah State agency
360,000 Total 360,000
12,000,000 3.0 Wisconsin
Private company 170,000 Total
170,000 22,844,000
0.7 Note 1: Personal information means information that can be
used to threaten an individual's physical, psychological, or
financial well-being. This information would include (1) credit
card numbers (personal or business); (2) Social Security numbers;
or (3) names in combination with physical descriptions or
financial, medical, or motor vehicle information. Note 2: Dollar
amounts were rounded to the nearest thousand. Totals may not add
due to rounding. Percentages were rounded to the nearest tenth.
aPRIDE Enterprises, a private, not-for-profit corporation that
operates industries in correctional institutions throughout
Florida, stated that it contributes over $1 million annually
toward incarceration costs to the state of Florida and 15 percent
of total inmate wages to victim restitution. bNet income was
provided. cLess than $1,000. dState does not have a breakdown by
individual contract. eContract started in June 1998. Source: GAO
survey of correctional industry officials. Page 37
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix VI
Number of Inmates With Access to Only Names and Addresses Through
Work Programs Number of inmates Through contracts with Through
general support government agencies or work for correctional
Jurisdiction private companies industry
programs Total Federal Bureau of
Prisons 80 3,109
3,189 State Alabama 0
0 0 Alaska
0 3 3
Arizona NR
NR NR Arkansas
7 1 8
California 0
75 75 Colorado
11 21 32
Connecticut 0
0 0 Delaware
0 20 20
District of Columbia 0
0 0 Florida
41 465 506
Georgia 0
0 0 Hawaii
0 0 0
Idaho 31
30 61 Illinois
8 0 8
Indiana 0
0 0 Iowa
0 0 0
Kansas 10
0 10 Kentucky
0 0 0
Louisiana 0
0 0 Maine
0 0 0
Maryland 30
30 30a Massachusetts
80 0 80
Michigan 0
26 26 Minnesota
33 30 63
Mississippi 19
0 19 Missouri
15 60 75
Montana 8
4 8a Nebraska
112 43 112a
Nevada 26
12 38 New Hampshire
0 0 0
New Jersey 58
0 58 New Mexico
90 36 126
New York 6
0 6 North Carolina
0 0 0
North Dakota 0
0 0 Ohio
NR NR NR
Oklahoma 255
116 371 Oregon
145 8 153
Pennsylvania 0
0 0 Rhode Island
0 0 0
South Carolina 10
0 10 South Dakota
8 6 14
Tennessee NR
NR NR Page 38
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix VI
Number of Inmates With Access to Only Names and Addresses Through
Work Programs Number of inmates Through contracts with
Through general support government agencies or
work for correctional Jurisdiction private companies
industry programs Total
Texas 0
0 0 Utah
100 0
100 Vermont 0
0 0 Virginia
0 45
45 Washington 42
109 151b West Virginia
28 6
34 Wisconsin 105
0 105 Wyoming
3 0
3 Total 1,361
4,255 5,539a Note 1: Names and
addresses mean names and one or more of the following: work or
home addresses or telephone numbers, names of employer, or job
titles but no other item that we defined as personal information.
Note 2: States with "NR" in each category did not return a
questionnaire. We received a questionnaire from Arizona's
privately run facilities. These facilities did not have any
inmates who had access to names, addresses, telephone numbers, or
other types of personal information. A representative from Ohio's
state-run facilities informed us that inmates involved in data
entry work programs did not have access to credit card numbers or
Social Security numbers. We did not receive any information from
respondents in state-run correctional facilities in Arizona or
Tennessee. aColumns do not add across to the total column because
the same inmate may have had access to names and addresses or
telephone numbers through both contracts and support work. Totals
indicate the maximum number of inmates with access. b Inmates had
access to names, work addresses, and work telephone numbers only;
they did not have access to home addresses or home telephone
numbers. Source: GAO survey of correctional industry officials.
Page 39 GAO/GGD-99-146 Inmates'
Access to Personal Information Appendix VII Type of Work Performed
in Work Programs in Which Inmates Had Access to Only Names and
Addresses Manufacturing Order
or customer Jurisdiction fulfillment Data entry
Shipping Printing support Order taking
Telemarketing Federal Bureau of Prisons C/S C
S S S State Alaska
S S S
S Arkansas
C California S
S S Colorado S Delaware
S Florida S C S
C S S Idaho S
C/S S S
S Illinois C
C Kansas Maryland C/S
C/S Massachusetts C C
C C Michigan Minnesota
C S
C Mississippi C
C Missouri S C S
S S Montana S
S C S S C
Nebraska C/S C S
C S C Nevada
S S S
S C New Jersey C New
Mexico C/S C S
C S C New York
C Oklahoma C/S C S
C S S C/S Oregon
C C S C S
S C South Carolina South Dakota C/S
S C Utah C
C Virginia S
Washingtonr C C C/S
C C West Virginia
S C Wisconsin C Wyomings
Page 40 GAO/GGD-99-146 Inmates' Access to
Personal Information Appendix VII Type of Work Performed in Work
Programs in Which Inmates Had Access to Only Names and Addresses
Geographic Complaint Document Computer-aided
Document information Bulk mailing resolution
duplication design scanning
system Other C S
Sa S
Sb Sc Sd Ce/Sf Sg C S C
C C C
Sd S C C
Ch C/S Si Cj C C C
Sf S C
Ck C S C
Cl S C C
Cm C C C
C C Sn Co C
Sd C
Cp Sq S C Legend C = Type of
work performed by inmates who had access to information through
work program contracts, which is a formal or informal agreement to
produce a specific product or perform a specific service. S = Type
of work performed by inmates who had access to information through
support work, which is not associated with a specific contract,
but tasks such as order taking or shipping that supported overall
industry work program operations. C/S = Inmates performed this
type of work both on contracts and through support work. Note:
Names and addresses mean names and one or more of the following:
work or home addresses or telephone numbers, names of employer, or
job titles but no other item that we defined as personal
information. Page 41 GAO/GGD-99-146
Inmates' Access to Personal Information Appendix VII Type of Work
Performed in Work Programs in Which Inmates Had Access to Only
Names and Addresses aCustomer billing. bInstallation. cSending
invoices to agencies. dClerical work. eResponse to public inquiry
regarding corporate information from Secretary of State database
via telephone. fDelivery. gFurniture refurbishing and auto
maintenance. hTelephone answering. iPurchasing regulations.
jCoding. kTelephone (incoming calls only). lProviding information
via telephone. mProduction of various signs. nCalling for quotes,
prices, and availability. oTravel reservations. pSales and
purchasing. qTruck loading. rInmates working in Washington's
correctional facilities have access to names, work addresses, and
work telephone numbers only. sWyoming failed to designate type of
work performed by inmates. Source: GAO survey of correctional
industry officials. Page 42
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix
VII Type of Work Performed in Work Programs in Which Inmates Had
Access to Only Names and Addresses Page 43
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix
VIII Safeguards Used in Work Programs in Which Inmates Had Access
to Only Names and Addresses Security check Selective
Security check at Monitored telephone Jurisdiction Close
supervision at exit hiring entrance
calls Federal Bureau of Prisons C/S
C/S S State Alaska
S Arkansas S C/S
S California S S S
Colorado C/S C/S C/S
C/S C Delaware S
S S S Florida
C/S C/S C/S C/S
C/S Idaho C/S C/S
C/S C/S Illinois C
C C C C Kansas
C C
C Maryland C/S C/S
C/S C/S C/S Massachusetts
C C C C
C Michigan S S
S Minnesota C/S C/S
C/S C/S C/S Mississippi
C C C C
C Missouri C/S S S
S Montana C/S C/S
C/S C/S C/S Nebraska
C/S C/S C/S C/S
C/S Nevada C/S C/S
C/S S C/S New Jersey
C C C C
C New Mexico C/S C/S
C/S C/S C/S New York
C C
C Oklahoma C/S C/S
C/S C/S C/S Oregon
C/S C/S C/S C/S
C/S South Carolina C C
C C C South Dakota
C/S C/S C/S C/S
C/S Utah C C
C C C Virginia
S S Washingtonn
C/S C/S C/S C/S
C/S West Virginia C/S C/S
C/S C/S Wisconsin C
C C C Wyoming
C C C C Page 44
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix
VIII Safeguards Used in Work Programs in Which Inmates Had Access
to Only Names and Addresses Computer
Personal program with
information given No paper or privacy Incoming
No photocopy Confidentiality only to
writing safeguards calls only machines
agreementa noninmates instruments
Other C C
Cb/Sc S S
Sd S S
S C C C
C S
Se C/S C/S C
C/S C Cf C C
C C C C
C/S C/S C/S
C/S C C C
C S
Sg C C C
S Sh C
C Ci S
C C/S S C/S
C Sj S C C C
C C C/S C/S S
C/S S C
C C/S C C/S
C/S Ck/Sk C/S
C/S C/S C S
Cl C C C
C S C C
C C Cm C/S S
C C
Cl C/S
Co/So C C
C Cp C C Legend
C = Safeguard applied to inmates who had access to types of
information through a contract, which is a formal or informal
agreement to produce a specific product or perform a specific
service. S = Safeguard applied to inmates who had access to types
of information through performing support work, which is not
associated with a specific contract, but tasks such as order
taking or shipping that supported overall industry work program
operations. C/S = Safeguard applied to inmates who had access to
types of information as a result of employment on both contracts
and through support work. Page 45
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix
VIII Safeguards Used in Work Programs in Which Inmates Had Access
to Only Names and Addresses Note 1: Names and addresses mean
names and one or more of the following: work or home addresses or
telephone numbers, names of employer, or job titles but no other
item that we defined as personal information. Note 2: A blank
means that the questionnaire respondent did not report using the
safeguard. Note 3: This table does not include inmates who had
access to names and addresses or telephone numbers and any other
item(s) that we defined as personal information. See appendix III
for a list of safeguards that respondents reported using for
inmates who had access to personal information. aConfidentiality
agreements were agreements signed by the inmates not to release
information obtained through a work program. bPrison staff
conducted random inspections of work and housing areas. cPrison
staff conducted random inspections of work and housing areas.
Prison staff screened outgoing business documents. Telephones in
work area were auto-dialed. dNo telephones or computers were used
by inmates in work area. eInmates were required to make uniform
changes in work area. fInmates had access to telephones,
computers, and fax machines connected to network only under direct
supervision. Personal information was segmented among inmates.
All documents in and out are monitored. gInformation was screened
by prison staff before being accessed by inmates. Inmates were
subject to body and cell searches. hInmates did not have access to
telephones in work area. IPersonal information was segmented among
inmates. Surveillance mirrors, security cameras, restricted work
area, raw materials/supplies control, and random strip searches
were employed. jPrison staff conducted area shakedowns. Personal
information was segmented among inmates. kPersonal information was
segmented among inmates. lTelephones in work area were auto-
dialed. mTelephones located in the work area were auto-dialed.
Telephone calls were monitored and taped. nInmates working in
Washington's correctional facilities had access to names, work
addresses, and work telephone numbers only. oInmates were not
allowed to take anything except tobacco into or out of the work
area. pPrison staff prescreened documents, and inmates were
subject to pat searches. Source: GAO survey of correctional
industry officials. Page 46 GAO/GGD-
99-146 Inmates' Access to Personal Information Appendix VIII
Safeguards Used in Work Programs in Which Inmates Had Access to
Only Names and Addresses Page 47 GAO/GGD-
99-146 Inmates' Access to Personal Information Appendix IX
Incidents of Misuse of Personal Information by Inmates State
Date and description of incident Safeguards
reported California (Youth Authority) In 1991, while on parole
an inmate used credit *Selective hiring card numbers
previously obtained from a prison *Security check at entrance to
work area telemarketing work program.
*Security check at exit from work area *Monitored telephone calls
*Incoming calls only to work area *No photocopy machines in work
area *Close supervision while working New Mexico
In 1995, an inmate wrote a letter to a Medicare *Selective
hiring patient identified from information obtained in a
*Computer programs with privacy safeguards data entry work
program. *Close supervision while
working *Confidentiality agreement signed by inmates New York
In the mid-90s, an inmate participating in a work *Selective
hiring program provided another inmate with a name
*Monitored telephone calls and address obtained through the work
*Incoming calls only to work area program. The second inmate wrote
a letter to *Close supervision while working the
individual whose name and address were *Personal
information given only to non- provided.
inmates Oklahoma In about 1990, an inmate
obtained information, *Selective hiring through
participating in a data entry work *Security check at
entrance to work area program, about an individual's medical
*Security check at exit from work area expenses and wrote the
individual a letter. *Computer programs with privacy
safeguards *Monitored telephone calls *Close supervision while
working *Confidentiality agreement signed by inmates *Personal
information segmented among different inmates Oklahoma
In 1995, two inmates attempted to smuggle *Selective
hiring-no misconduct for 6 copies of birth certificates obtained
through a months work program out of prison through the U.S.
*Security check at exit from work area mail system. The birth
certificates were sent *Computer programs with privacy
safeguards back to the prison via return mail.
*Incoming calls only to work area *No photocopy machines in work
area *Close supervision while working *Confidentiality agreement
signed by inmates *Personal information segmented among different
inmates South Carolina In 1995, an inmate
continued to call a particular *Selective hiring-interviews and
previous individual identified through a work program that work
history telemarketed local newspaper subscriptions.
*Computer programs with privacy safeguards *Monitored telephone
calls *Close supervision while working *Personal information given
only to non- inmates Page 48 GAO/GGD-
99-146 Inmates' Access to Personal Information Appendix IX
Incidents of Misuse of Personal Information by Inmates Program
continued after incident How safeguards failed Sanctions
against inmate Yes No Changes
to safeguards Unknown Inmate charged and
convicted *a Inmate was not searched when Inmate was
given disciplinary * N/A
leaving work area segregation time and was not
allowed to work for Correctional Industries Inmate left the
premises with the Inmate was removed from the *
Existing securities were reviewed information
work program
and reinforced Inmate memorized the address Inmate was given a
written * reprimand, placed in restrictive
housing, and barred from future employment in industry work
programs Despite the fence around the Both inmates were given
written * Monitors were placed on
the gate to work area and pat down reprimands, fired from
the work watch the area
procedures, these papers were program, and transferred from
removed this particular area of the prison
Inmate was not monitored while Inmate was given a written
* N/A making telephone calls reprimand for disobeying
orders Page 49 GAO/GGD-99-146 Inmates'
Access to Personal Information Appendix IX Incidents of Misuse of
Personal Information by Inmates State Date and
description of incident Safeguards reported
South Dakota In 1990 or 1991, an inmate used a credit card
*Unknown to questionnaire respondent number, obtained from a work
program making motel reservations, for personal purchases. Texas
In the early 1990's, an inmate wrote a letter to Unknown to
questionnaire respondent an individual identified through a data
entry work program and included personal information also obtained
through the work program. Washington In 1997, an inmate sent
a Christmas card to an *Selective hiring-offense history
individual identified through a 1-800 *Security
check at entrance to work area information line. The individual
had called for *Security check at exit from work area
information on state parks. *No photocopy
machines in work area * Monitored telephone calls Page 50
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix IX
Incidents of Misuse of Personal Information by Inmates Program
continued after incident How safeguards failed
Sanctions against inmate Yes
No Changes to safeguards Unknown
Inmate was prosecuted
* N/A Unknown Case is in litigation
* N/A Lack of supervision; failed to use Inmate was
disciplined and *b
N/A available technology terminated from work
program; manager was demoted and subsequently reassigned Note:
Incidents of misuse of personal information means any action that
had threatened or caused injury to the physical, psychological, or
financial well-being of any member of the public. Some of these
incidents involved only names and addresses or telephone numbers,
not "personal information" as we defined it for this report. a
Program was discontinued in 1998. bTelemarketing activities were
eliminated as a correctional industries business. Source: GAO
survey of correctional industry officials. Page 51
GAO/GGD-99-146 Inmates' Access to Personal Information Appendix X
Comments From the Bureau of Prisons Page 52 GAO/GGD-99-146
Inmates' Access to Personal Information Appendix XI Comments From
the Correctional Industries Association, Inc. Page 53 GAO/GGD-
99-146 Inmates' Access to Personal Information Appendix XII GAO
Contacts and Staff Acknowledgments Brenda Bridges, (202) 512-8777
GAO Contacts Mary Lane Renninger Acknowledgments Nancy A.
Briggs Geoffrey R. Hamilton David P. Alexander Stuart M. Kaufman
Michael H. Little Page 54 GAO/GGD-99-146
Inmates' Access to Personal Information Page 55 GAO/GGD-99-146
Inmates' Access to Personal Information Page 56 GAO/GGD-99-146
Inmates' Access to Personal Information Ordering Information The
first copy of each GAO report and testimony is free. Additional
copies are $2 each. Orders should be sent to the following
address, accompanied by a check or money order made out to the
Superintendent of Documents, when necessary. VISA and MasterCard
credit cards are accepted, also. Orders for 100 or more copies to
be mailed to a single address are discounted 25 percent. Order by
mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC
20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts.
NW) U.S. General Accounting Office Washington, DC Orders may also
be placed by calling (202) 512-6000 or by using fax number (202)
512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of
newly available reports and testimony. To receive facsimile copies
of the daily list or any list from the past 30 days, please call
(202) 512-6000 using a touch-tone phone. A recorded menu will
provide information on how to obtain these lists. For information
on how to access GAO reports on the INTERNET, send e-mail message
with "info" in the body to: info@www.gao.gov or visit GAO's World
Wide Web Home Page at: http://www.gao.gov United States General
Accounting Office Bulk Rate Washington, D.C. 20548-0001
Postage & Fees Paid GAO Permit No. G100 Official Business Penalty
for Private Use $300 Address Correction Requested (182833)
*** End of document. ***
|
