ELECTRONIC FINGERPRINTING FOR GENERAL ASSISTANCE RECIPIENTS IN SAN FRANCISCO by Jim Davis BACKGROUND The San Francisco Department of Social Services (DSS), at the urging of the Mayor's office, wants to begin electronically fingerprinting everyone who receives General Assistance (GA) benefits, as a condition of their receiving aid. GA is a state- mandated, county-administered program for indigent adults. DSS wants to adopt the Automated Fingerprint Image Reporting and Match (AFIRM) system, developed by Electronic Data Systems (EDS).(1) Los Angeles County began using the AFIRM system in June, 1991 for their GA program; and Alameda County began using the same system in February of this year. Ostensibly, the system is intended to prevent a particular kind of fraud called "double-dipping," where someone receives aid under more than one name, or receives aid in more than county. At its April meeting, the San Francisco Social Services Commission, which oversees DSS, failed to endorse the plan due to a lack of a second on the motion to adopt the AFIRM program. (One commission member, who supported the program, was absent.) The Commission held a special meeting on May 13 to consider the matter a second time, and with a different mix of commissioners, endorsed the plan by a vote of 4-0. The San Francisco Board of Supervisors must change the ordinance overseeing General Assistance to begin requiring electronic fingerprinting, before the plan can go into effect. Electronic fingerprinting is a technology that allows fingerprint images to be stored on a computer system.(2) A digital fingerprint can be quickly matched against other fingerprints stored on the computer. Fingerprints are essentially photographed using a scanning device, and the computerized images are stored in a database. EDS functions as a "systems integrator" for the AFIRM system. That is, they have combined hardware and software from various vendors to create the system. For example, the AFIRM system uses Hewlett- Packard computers and workstations, Informix database software, and fingerprint-matching technology from Printrak. In LA, the county contracted with EDS to provide the service, and the service is priced according to the number of records to be maintained. That is, the county did not purchase equipment or software. Fingerprints are stored in a proprietary file format, meaning that the data cannot easily be used with other vendors' software. With the AFIRM system, the right and left index fingers are scanned. Within a few minutes, the system searches its existing database of prints for matches. In LA, if the system finds a match for a single print only (considered a "half-match"), benefits are not denied, but the incident is reported to the fraud investigation unit for follow-up. If both prints match (a "full- match"), benefits are denied. The client can challenge the decision, and have the fraud investigation unit confirm or reject the computer's assessment. Alameda County follows similar guidelines. During the implementation phase in Alameda County and Los Angeles County, all GA recipients were required to submit to fingerprinting. If they failed to appear for their appointments, their benefits could be terminated. If they refused to give their fingerprints, their benefits were terminated. All new applicants for GA are required to give their fingerprints, or else benefits are denied. THE ISSUES Requiring electronic fingerprinting as a condition of receiving benefits raises several questions, including: * Can the cost of the system be justified? * Is the system even necessary? * Will the system have other consequences not related to deterring fraud? * Is requiring fingerprinting, recognized as a law enforcement technology, appropriate for welfare programs? HOW EXTENSIVE IS THE PROBLEM OF "DOUBLE-DIPPING"? DSS has no idea how much "double-dipping" fraud occurs. DSS General Manager Brian Cahill told the mayor, "We believe that there is a substantial number of persons who are receiving duplicate aid because we have no way to determine an identification for clients." That is, since DSS doesn't know, there therefore must be a "substantial number." DSS has no _objective_ basis, only anecdotes and assumptions, for determining the scope of the problem, and therefore has no rational basis for justifying the cost. However, looking at Los Angeles County's experience, the extent of "double-dipping" would seem to be overstated. According to the _Los Angeles Times_, after three months of use, only _two_ cases of intentional "double-dipping" fraud were identified, where new applicants attempted to apply for benefits under two names.(3) By December, after six months of use, all of 11 cases had been closed because duplicate sets of prints were found on the system, although it is not known how many of those cases were considered fraudulent behavior.(4) Up to March 1993, Los Angeles County denied GA 434 times to new applicants due to fingerprint matches, and a cumulative total of 785 new applicants refused to be fingerprinted. New applications for GA in Los Angeles County over the past two years range between 15,000 and 19,000 each month; that is, approximately 350,000 applications were processed during the time the AFIRM system has been in place. Even assuming that _all_ of the people denied benefits because of the AFIRM system were trying to defraud the county, that still leaves an AFIRM-detected fraud incidence of _at most_ .34%; that is, about 1 in 300. Given the size of the San Francisco caseload, this would work out to three people a month being matched by the system, and maybe another five or six refusing to be fingerprinted.(5) It should be noted from the statistics that only a minority of fingerprint matches are actual fraud attempts. Alameda County, which began using the AFIRM system in early February, was about 80% done with fingerprinting of existing GA clients by mid-May. With approximately 9,000 GA cases processed, only _six_ matches had been found, and _none_ of those matches were cases of fraudulent behavior.(6) Mental illness (DSS estimates that one in seven GA recipients suffers from a mental health problem, and one in three suffers from drug or alcohol addiction) or just general confusion by the byzantine rules of the welfare system could be the cause of these attempts to apply for aid a second time. Finally, just because the AFIRM system is credited with picking out situations of duplicate aid, there is no way of knowing how many of the cases could have been picked out using existing computer matching and other identification systems already in place. HOW MUCH WILL THE SYSTEM COST? In his letter to Mayor Frank Jordan, DSS General Manager Brian Cahill wrote that the system "would cost in the neighborhood of $1 million over a 5 year period. Our costs would be based on hardware and the number of cases on GA."(7) Yet Alameda County estimates that the same system there will cost $1.3 million over a five year period. San Francisco's case load is 50% higher that Alameda's, and since the cost is directly related to caseload, the anticipated cost to San Francisco could be twice Cahill's estimate. Furthermore, there may be additional costs not included in Cahill's estimate. Electronic Data Systems sells a service, and prices it according to the number of records it processes and stores. The cost figures include, according to Cahill, "training, implementation, equipment, phone lines, installation and finger print processing." Not included in this list are DSS direct expenses like electricity, the cost of the space to house the equipment and operators, the labor associated with following up on half-matches or false-positive matches (where the system says that there is a match, when in fact there is not), etc. which must be absorbed by DSS elsewhere from its budget. Also not listed are the many hidden costs in establishing new systems: staff inefficiencies while adopting a new system, lost time due to re- processing cases that were erroneously closed, administrative overhead, etc. Such costs could further inflate a $2 million price tag. Once data-sharing begins with other counties, additional administrative resources may be required. Finally, since the system is priced on the number of records maintained, and as the California economy worsens and GA rolls increase, San Francisco may be looking at an escalating cost. The dollar costs need to be examined very carefully. These are additional expenditures of tax dollars and human resources in a time of serious budget difficulties. WHAT HAS BEEN THE EXPERIENCE OF LOS ANGELES COUNTY AND ALAMEDA COUNTY? The stated purpose of AFIRM is to _deter_ alleged fraud by driving away people who would "double-dip" in the GA program. The _LA Times_ report, written as LA was reaching the end of its changeover period, when one would expect most of the cases of existing fraud to be "weeded out", said that about 700 GA cases had been dropped. At the end of December, 1991, after its changeover was completed, LA County said that it had dropped 3,010 people who missed their fingerprinting appointment ("non- compliance"); and 11 duplicate cases had been found. Alameda County had dropped 147 cases by mid-May for "non-compliance." Cumulative totals for new applications denied by Los Angeles County are given above. DO THE DROPPED CASES CONFIRM THAT FRAUD IS BEING DETERRED? Without any data as to _why_ the caseload in Los Angeles and Alameda County dropped, it is spurious logic at best to assert that fraud has been rooted out. Much more likely reasons for the caseload drop are missed appointments, perhaps because of lost or missed mail; fears about being fingerprinted; concerns about privacy; or the inevitable problems of processing, in Alameda's case, 11,000 cases, or in the situation of Los Angeles, 59,000 cases. A 98.5% rate of success in processing would be admirable in most quality assurance managers' book; but the other 1.5% that are failures could still account for all of the dropped cases. In fact _any_ substantial change in case-handling could result in a drop in cases, of people _who are entitled to receive benefits_. No one has yet produced any data to substantiate the claim that AFIRM has deterred fraud. All that _can_ be said is that AFIRM is an expensive, additional obstacle to receiving GA, and that its use _coincides_ with a reduction in caseloads. However, the purpose of AFIRM is _not_ to reduce caseloads, and any other goals of using the system cannot be proven with currently available data. At best, AFIRM is an expensive shotgun approach to a specific problem of unknown size. HOW MUCH WILL THE SYSTEM SAVE? No one knows. Because no data exists as to _why_ caseloads drop as a result of installing the fingerprint system and changing department procedure, it is impossible to determine how much the system saves. That is, if cases are dropped in error, say as a result of lost mail or missed appointments, and the cases are re-opened, then in those instances the system has cost money by creating unnecessary work. If cases are dropped because people are afraid of the fingerprinting system, or believe that it is an invasion of their privacy, then those cases will show up as dollar costs elsewhere in the welfare system, and conceivably as social costs with a rise in homelessness and other problems. LA County, using the 3,021 cases closed figure, claims that the system saved it $5.4 million over the first six months. But because no figures exist that indicate how many of those cases were subsequently re-opened, the savings figure must be taken with a grain of salt. Yes, they closed cases, and yes, that probably saved the county those benefits for a month or two, but only because benefits were denied to people who were entitled to receive them. The percentage of those people who were actually "double-dipping" is just not known. It is also impossible to know if AFIRM "deterred fraud" (that is, people were aware of the system, so did not attempt to apply a second tme), based on available data. DSS has provided figures to the Mayor's Office and to the Social Services Commission that anticipate savings based on a seven percent savings (although they admit the figure may be too high). A May, 1993 DSS memo says that "Alameda County reported a drop in caseload of roughly 7-10 per cent from April 1992, to February 1993."(8) However, fingerprinting in Alameda County did not even begin until February, 1993, so that savings figure is useless for gauging the results of fingerprinting. Taking Alameda and Los Angeles County numbers at face value (i.e., not taking into consideration that some portion of those were dropped erroneously), Alameda has dropped about 1.7% of its cases, and Los Angeles dropped about 5% of its cases (LA had a caseload of about 59,000 when it started the program). It is not known how many of the cases were subsequently re-opened. Finally, the "savings" realized from the AFIRM system are mostly realized during the first six months, during the changeover period when most cases are closed. After that, the "savings" drop considerably. Based on the LA figures, the savings from cases denied because of matches are less than the cost of the system.(9) Over the long haul, AFIRM represents additional costs in GA administration, with no rise in the benefits pool. As such, it means that the ratio of administration-to-benefits has gone up; that is, new inefficiencies are built into the welfare system. Computers are not a magic solution, and additional infrastructure is required to install and maintain hardware and software, and train users and adjust office procedure. Inflating bureaucracy at the expense of services-provided is not a wise use of taxpayer money. The AFIRM system may indeed reduce welfare payments, by only by terminating benefits to people entitled to them. However, that is not the stated purpose of AFIRM. Implementing a system that may result in DSS failing to provide basic survival aid to people in need is legally and morally suspect. WILL THE AFIRM SYSTEM ELIMINATE DOUBLE-DIPPING FRAUD? Computer systems are not infallible. The system may miss actual cases of fraud (false-negatives). If people are truly intent on committing fraud, they will come up with ways to defeat the fingerprinting system (including self-mutilation, in the most desperate case). A computer system can create a false sense of security, when in fact it has just upped the ante in terms of technique and technology. IS THE AFIRM SYSTEM NECESSARY? AFIRM is intended to deter fraud by preventing GA recipients from signing up under more than one name. However, current DSS policy requires people to provide a social security number and a state ID card or driver's license to DSS before they can receive GA. According to Bill Madison, an information officer with the Department of Motor Vehicles, it is extremely difficult to obtain identification under more than one name. DMV personnel are trained to identify false documentation. Suspicious requests for ID are passed along to their security unit, which can utilize their database of digital fingerprints and photographs to determine if a duplicate request has been made. To obtain a second social security number means additionally circumventing procedures that the Social Security Administration (SSA) has in place. That is, the checks against maintaining more than one identity are already in place. The AFIRM system is redundant, and duplicates other government resources. DSS cannot justify AFIRM without calling into question the effectiveness of the DMV and the SSA systems. AFIRM is also intended to prevent people from signing up for benefits in more than one county. But San Francisco and Alameda currently exchange computer data to compare social security numbers of recipients, and DSS has an aggressive mix of rules to ensure that recipients reside in one location. Again, systems are in place to prevent the type of fraud alleged by DSS. WILL AFIRM MAKE THE GENERAL ASSISTANCE PROGRAM MORE ACCOUNTABLE? Because DSS has no way of accurately _accounting_ for the results of installing the AFIRM system, it is impossible to say that AFIRM has made anything more "accountable". "Accountability" implies a concrete basis for comparing costs and results. With no firm idea of the scope of the problem, or the nature of the results, DSS is throwing expensive technology at a problem of unknown size. The installation of a computer system, by itself, does not introduce "accountability." Nor does dodging the state mandated responsibility to provide aid to destitute people, by saying that "the computer did it" improve accountability. BESIDES THE COST AND QUESTIONABLE NEED, WHAT ARE SOME OTHER AREAS OF CONCERN WITH THE AFIRM SYSTEM? Because computer systems greatly enhance the ability to store and search personal data, privacy implications are always an issue. The system may also deter people from getting benefits to which they are entitled. WHAT ARE THE PRIVACY IMPLICATIONS FOR THE AFIRM SYSTEM? The AFIRM system means that more information will be stored on a computer system. Something is given up by individuals when they must surrender personal information to the government; as such, requiring fingerprinting is an erosion of one's right to privacy, which is guaranteed under the California state constitution. Obvious concerns are the security of the data, and that DSS fingerprint data will be shared with law enforcement agencies or other government agencies. HOW SECURE WILL THE FINGERPRINT DATA BE? Data stored on a computer is much more prone to unauthorized duplication, modification, and transmission than its low-tech counterparts. And such problems are even more likely in the absence of a thought-out policy regarding the security of computer records. AFIRM data resides on a computer system housed at an EDS facility. EDS is contractually responsible for maintaining a secure data facility, although direct control of that is removed from DSS. At the DSS end, only authorized personnel will be granted access to the system by DSS, the equipment will be housed in a secure area accessible only to operators, authorized users will have IDs and passwords, and a record will be kept of people who log onto the system. But does DSS have a comprehensive computer security policy? Will DSS keep an audit trail of changes to data on the system? How often will users be required to change their passwords? Is DSS taking into account where technology will be five years from now, as equipment costs will most assuredly drop, and computing search power will grow? Access issues will continue to grow in complexity. CAN THE FINGERPRINT DATA BE USED BY LAW ENFORCEMENT AGENCIES? The California Welfare and Institutions Code, section 17006.5, describes the conditions under which welfare data may be shared with law enforcement officials. When presented with a felony warrant and a signed letter from the head of the enforcement agency, the welfare agency may disclose certain information, including name, address, birthdate, social security number, and "physical description." It is entirely plausible that "physical description" could include fingerprints. Furthermore, since police agencies can currently ask DSS to search for a name in its database, it is not farfetched to have the law enforcement agency request to search the welfare database for a fingerprint, using FBI or other law enforcement fingerprint data. That is, it is not clear that current policy would forbid that use of the fingerprint data. In addition, any protestations to the contrary, nothing can guarantee that the law will not be changed in two, five or ten years, relaxing the search guidelines. This pool of fingerprint data, collected under the assumption of confidentiality, would then be stripped of its protected status. No official policy can guarantee against "unofficial" acts, which may or may not be quietly sanctioned by higher-ups. There are cases in recent history where zealous DSS employees have shared information with police, against stated department policy. Local newspapers have recently reported on police officers keeping duplicate sets of police data on their home computers, against policy. The current case of former police inspector Tom Gerard, who is charged with stealing confidential police files and suspected of selling the information to other agencies and even to other governments, is an even more extreme, but actual case. The point is that once data assumes a digital format, it tends to persist in computer systems, and to leak about. Unless there is some overriding need to collect the data, it is best left uncollected. IS AFIRM FINGERPRINT DATA COMPATIBLE WITH LAW ENFORCEMENT FINGERPRINT DATA? DSS has claimed that the prints taken by the AFIRM system are incompatible with the prints taken for law enforcement purposes. While the DSS data may be stored in a different format than police data, there are ways around this problem. Data is data, and software can be developed to translate data from one format to another. The FBI is reportedly moving towards digital fingerprinting storage standards, and once those are in place, this process should be streamlined. DSS also claims that "law enforcement requires thumb prints" while DSS uses index finger prints, adding another level of incompatibility. However, this just isn't so. During booking, the police take a full set of ten prints. WILL AFIRM DATA BE SHARED WITH OTHER NON-LAW ENFORCEMENT AGENCIES? San Francisco intends to share its data with Alameda County, and, according to John Vera, DSS Assistant General Manager, "[i]f other Bay Area counties opt in, the data base would be expanded to include them." Some type of matching may take place with Los Angeles County as well. Plans are underway to extend the system to other welfare programs (see below). DSS had made ambiguous statements about who they would be willing to share the data with, meaning that no clear policy has been set.(10) Widespread sharing of data leads to the possibility of the data taking on a certain life of its own, and any control of the data eventually is lost. WILL AFIRM INTIMIDATE PEOPLE FROM GETTING ASSISTANCE TO WHICH THEY ARE ENTITLED? The figures from LA County and Alameda County would indicate that yes, people are deterred from benefits to which they are entitled. Regardless of its unfortunate extension to other areas, fingerprinting historically has been a law enforcement technology, and this is a common public perception. With welfare agencies' emphasis on fraud detection, the boundary between law enforcement and social services has blurred. The choice of fingerprinting technology to verify identity further blurs that boundary between law enforcement and social service. In other areas, fingerprinting has been rejected, precisely because of the aura of law enforcement around it. Last year, for example, the _Wall Street Journal_ reported that airport officials, looking for a way to speed people through immigration at Kennedy Airport, decided _not_ to use fingerprinting technology to match people with their passports. "We didn't want to get into fingerprints because of law enforcement connotations," said Richard Norton, the Air Transport Association's senior director of facilitation. The law enforcement aura surrounding fingerprinting, when combined with the public perception of computers as infallible search engines capable of retrieving any data about a person, can create an intimidating presence. When one adds into the mix that a high percentage of GA recipients are mentally ill and/or substance abusers, then the possibility of intimidation increases, whether rightly or wrongly, from any number of fears: of the police, of computers, of public exposure, etc.(11) DOESN'T THE DEPARTMENT OF MOTOR VEHICLES REQUIRE FINGERPRINTS? DMV began requiring digital fingerprints in 1991. The purpose of this program is to ensure that the person renewing a license is the same person who originally applied for the license. As such, DMV claims it is a personal protection, in case one's license is lost or stolen.(12) DMV fingerprint data is not routinely matched against other fingerprint data. While similar privacy concerns have been raised of DMV's collection of fingerprint data, it's current use is relatively benign and of a restricted nature. Because, legally speaking, driving is a "privilege," and welfare is a matter of survival, requiring fingerprints of welfare recipients should be held to a higher test of need. DO ALTERNATIVES TO ELECTRONIC FINGERPRINTING EXIST? Alternatives do exist for recording unique information about a person, for the purpose of verifying identity or verifying uniqueness. Technology exists to scan the bone structure of a hand, or the vein patterns on the back of the hand, both of which are as unique as fingerprints, but have no possibility of tying-in with law enforcement fingerprint systems. WILL AFIRM BE EXTENDED TO OTHER FORMS OF AID? Los Angeles County plans to begin a pilot program on June 1 to extend use of the AFIRM system to Aid to Families with Dependent Children (AFDC) recipients in LA County. The $21 million program will quadruple the number of fingerprints stored on the Los Angeles system, from about 100,000 to 400,000. Alameda County is rumored to be considering extending the program to AFDC as well. San Francisco's DSS may also be discussing future expansion to other forms of aid. After the system extends to AFDC, it is conceivable that AFIRM will be extended to food stamps. If the problem can be as large as DSS can imagine it, where will fingerprinting stop? Will DSS require children to be fingerprinted as well? And how long will their fingerprints remain on the system? Jim Davis Western Regional Director Computer Professionals for Social Responsibility P.O. Box 717 Palo Alto, CA 94302 Local contact information: 414 Chestnut Street, San Francisco, CA 94133 (415) 398-2818 firstname.lastname@example.org [Computer Professionals for Social Responsibility is a national public-interest alliance of computer scientists, engineers, users and others interested in the impact of computer technology on society. We work to influence decisions regarding the development and use of computers because those decisions have far-reaching consequences and reflect basic values and priorities. CPSR has 500 members in the Bay Area.] ------------------------------- FOOTNOTES 1. EDS was founded by H. Ross Perot in 1962. General Motors bought EDS in 1984 for $2.55 billion in cash and stock. Probably the largest computer services company in the world, EDS had sales $8.2 billion in 1992. About 10 percent of EDS's revenues come from government contracts. EDS is also one of the world's largest private operators of data processing centers, operating 110 sites in North America, Europe and Asia in 1991. The rise in computer operations "outsourcing," where companies and government agencies contract with outside companies like EDS to handle their computer and data processing needs has fueled EDS's tremendous growth over the past 10 years. "The rapid growth of EDS and its biggest competitors raises the intriguing question of how much of the nation's computing capacity will one day end up in the hands of a few computer services giants." (_New York Times_, October 30, 1991.) 2. Details about the AFIRM System are from a conversation with Curtis Williams, Project Director for EDS in Los Angeles, and from the "AFIRM Fact Sheet," provided by the Los Angeles County Department of Public Social Services. 3. "County Welfare Recipients Prints Taken", _Los Angeles Times_. October 12, 1991. 4. Figures for LA County's General Relief program (their equivalent to San Francisco's General Assistance) were provided by the LA County DPSS Computer Services Division. 5. From May, 1992 to April, 1993, DSS received on average about 2,800 GA applications a month. That approximates LA's number of GA applications as a percentage of total caseload (around 17 - 20%). Either multiplying the .34% figure from LA's experience by the number of new San Francisco GA cases, or taking the relative size of San Francisco's caseload (15% of LA's) and multiplying it by the number of matches and refusals LA had, the results are about the same. 6. Alameda County data is taken from Alameda County Social Services Agency press releases, and information provided by Luanne DeWitt, public information officer with Alameda's SSA. 7. Letter from Cahill to Mayor Frank Jordan, March 31, 1993. 8. Memo from John Vera, Assistant General Manager of DSS, to the San Francisco Social Services Commission, May 12, 1993. 9. LA has denied 434 cases over the 21 month period from June, 1991 to March, 1993 (about 21 cases a month). Assuming someone would receive benefits of $350 per month for a year: 21 cases per month * $350/month GA benefit * 12 months = $88,200/month "savings" vs. $9.4 million system cost/5 years = $156,666/month cost. The actual system cost may be higher, and the actual GA benefit is a bit lower. 10. At the May 13 Social Services Commission meeting, Vera said that DSS would "share its data with anyone who shared their data with DSS." This could conceivably include welfare agencies in other states, or other state agencies. 11. "Privacy in Peril: How computers are making private life a thing of the past", a special report in the July, 1993 issue of _Macworld_ magazine is a very good summary of computers and privacy issues. 12. From a conversation with Bill Madison of DMV.