Supporting Statement--0632

Supporting Statement for

Request for Internet Services – Password Authentication (RISPA)

20 CFR 401.45

OMB No. 0960-0632

A. Justification

1. The Social Security Administration (SSA) collects this information by authority of the Privacy Act of 1974 at 5 U.S.C. Sub-section 552a(e)(10),which requires agencies to establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records. Also, 5 U.S.C. Sub-section 552a(f)(2)&(3) requires agencies to establish requirements for identifying an individual who requests a record or information pertaining to that individual and to establish procedures for disclosure of personal information. SSA promulgated Privacy Act rules in the Code of Federal Regulations, Subpart B. Procedures for verifying identity are at 20 CFR 401.45. Authority to collect this information is also contained in Section 205(a) of the Social Security Act.

2. SSA has established a Password infrastructure and process for verifying the identity of individuals who choose to use the Internet and the Automated Telephone Response System to conduct business with SSA in an electronic environment. Password Services are used for the convenience of SSA and its customers to provide electronic access to SSA's automated services and thereby reduce the number of contacts with teleservice and field staff. Electronic transactions cost mere pennies when compared to the high dollar cost associated with human intervention.

The information collected by Password Services is used to authenticate an individual prior to giving him or her access. SSA will continue to collect and use the information to establish a Password Data File. The file will continue to be used to allow customers to conduct electronic business with the Agency. Eventually, this Password Data file will become part of the Lightweight Directory Accessed Protocol (LDAP) Data File housed within the Access Control Utility (ACU).

Due to the conversion of our Individual Password Services to the ACU, we are adding some information to Password Authentication (PWA) and dropping some information from PWA. We must do this in order to successfully convert these services so that they fit into the approved ACU Authentication schema. The necessary changes to PWA are: add Name as an authentication data element and remove Confirmation Number, Payment Amount, and last 4 digits of the Direct Deposit Account Number. We will continue to request SSN, Date of Birth, and Password Request Code (PRC - a shared secret created by SSA and mailed or electronically sent to the requestor).

The User ID/Password process will continue to be used for access to SSA's online and automated telephone services. These services will be password-protected when SSA has determined either the information transmitted or the requestor requires a higher level of protection. The User ID/Password may also be used to access electronic services that require a lower level of protection. Some of the services that require password protection include, but are not limited to:

• Change of Address and Telephone Number;

• Direct Deposit Elections or Changes; and

• Account Status Inquiries.

The Password process will allow the requestor to establish his or her identity with SSA, to create a Password, and to use that password, along with a User ID (Social Security Number), to access or change his or her own personal information maintained by SSA. We will also allow customers to change their password, and for those who have lost or forgotten their Password, to re-establish their identity with us and create a new Password.

Prior to creating a Password, we will verify the requestor’s identity. Some examples of information we may ask for include:

• shared secret created by SSA and mailed to the requestor (the Password

Request Code or PRC);

• SSN;

• Date of Birth; and

• Name.

Answers to these questions are then compared to information contained in our records.

We are also introducing two new surveys into the Password Services process. These will help us to collect information about the process, itself. The surveys will help us to identify problems in the process and they will reinforce what works well for users. Survey responses will help us to improve our password process.

The information collected is to be used exclusively to verify the identity of the requester. The field for other last names is optional and is used to help us match the person in cases where the person has changed their name (e.g., marriage) and not notified Social Security. Once SSA establishes identity, the requester chooses a password and this password can be used by the requester to identify him/herself to SSA for future Internet/telephone transactions.

3. This information collection is automated. The requester keys in identifying information, transmits it over the Internet/telephone to SSA, and the information is compared to existing electronic records in real time. If the information keyed and transmitted matches with established SSA records, the requester is allowed to proceed to choose a password.

4. The information collected through these screens has already been collected and posted to SSA’s master electronic records, but is being asked again for comparison and verification. There currently is no existing alternative way for SSA to verify identity electronically when the request is user-initiated over the Internet or through the Automated Telephone Response System.

5. This collection does not have a significant impact on a substantial number of small businesses or other small entities.

6. Failure to be able to verify the requester’s identity would result in SSA’s not being able to respond to these requests. Making this service available electronically saves the requester the effort of phoning an SSA TeleService Center representative or visiting an SSA field office, and saves SSA staff time. Also, since this information is only collected on an as needed basis, it cannot be collected less frequently. There are no technical or legal obstacles that prevent burden reduction.

7. There are no special circumstances that would cause this information collection to be conducted in a manner that is not consistent with 5 CFR 1320.5.

8. The 60-day advance Federal Register Notice was published on May 26, 2006 at 71 FR 30464, and SSA has received no public comments. The second Notice was published on July 31, 2006, at 71 FR 43270, and SSA has received no public comments. There have been no outside consultations with members of the public.

9. SSA provides no payment or gifts to the respondents.

10. The information collected is protected by the Privacy Act of 1974. In addition, information collected by SSA is protected by our Privacy Policy for Internet Services that ensures the confidentiality of all information provided by the requester. Our Internet privacy policy is:

• You do not need to give us personal information to visit our site.

• We collect personally identifiable information (name, SSN, DOB or email) only if specifically and knowingly provided by you.

• Personally identifying information you provide will be used only in conjunction with services you request as described at the point of collection.

• We sometimes perform statistical analyses of user behavior in order to measure customer interest in the various areas of our site. We will disclose this information to third parties only in aggregate form.

• We do not give, sell, or transfer any personal information to a third party.

• We do not enable “cookies.” (A “cookie” is a file placed on your hard drive by a Web site that allows it to monitor your use of the site, usually without your knowledge.)

Additionally, SSA will ensure the confidentiality of the requester’s personal information in several ways:

• All electronic requests will be encrypted using the Secure Socket Layer (SSL) security protocol. SSL encryption prevents a third party from reading the transmitted data even if it is intercepted. This protocol is an industry standard and is used by banks such as Wells Fargo and Bank of America for Internet banking.

• The requester will be given adequate warnings that the Internet is an open system and there is no absolute guarantee that others will not intercept and decrypt the personal information they have entered. They will be advised of alternative methods of requesting personal information, i.e., a personal visit to a field office or a call to the 800 number.

Only upon verification of identity will the requester be allowed access to additional screens which allow requests for and changes to personal information from SSA records.

11. The information collection does not contain any questions of a sensitive nature.

12. We estimate that 1,630,771 requestors annually will use these screens to submit identification/verification information and that it will take 10 minutes to answer the questions and complete all of the web pages, resulting in an annual reporting burden of 271,795 burden hours. The total burden is reflected as burden hours, and no separate cost burden has been calculated.

13. There is no known cost burden to the respondents.

14. The cost burden to the Federal Government to convert SSA’s Password Services to the Access Control Utility (ACU) is estimated to be $725,000. We estimate that design, development, testing, and marketing of the identity verification screens requires 10 work years. We have also included an additional $25,000 in our estimate to cover the contractor costs to make the necessary changes to the automated telephone system

15. There has been a large increase in the burden associated with this service.

An increasing number of beneficiaries are choosing to use the Internet or telephone to conduct business with SSA. In addition, making the program available to any Title II beneficiary/applicant who wants to establish a password has increased the burden significantly. However, establishing a password is strictly an option that is available to beneficiary/applicants. We expect a proportionate decrease in SSA Field Office and Teleservice Center traffic.

16. The results of the information collection will not be published.

17. We are not requesting an exception to the requirement to display an expiration date.

18. SSA is not requesting an exception to the certification requirements at 5 CFR 1320.9 and related provisions at 5 CFR 1320.8(b)(3).

B. Collection of Information Employing Statistical Methods

Statistical methods are not used for this information collection.

5