by Jim Davis


The San Francisco Department of Social Services (DSS), at the 
urging of the Mayor's office, wants to begin electronically 
fingerprinting everyone who receives General Assistance (GA) 
benefits, as a condition of their receiving aid. GA is a state-
mandated, county-administered program for indigent adults. DSS 
wants to adopt the Automated Fingerprint Image Reporting and Match 
(AFIRM) system, developed by Electronic Data Systems (EDS).(1) Los 
Angeles County began using the AFIRM system in June, 1991 for 
their GA program; and Alameda County began using the same system 
in February of this year. Ostensibly, the system is intended to 
prevent a particular kind of fraud called "double-dipping," where 
someone receives aid under more than one name, or receives aid in 
more than county. 

At its April meeting, the San Francisco Social Services 
Commission, which oversees DSS, failed to endorse the plan due to 
a lack of a second on the motion to adopt the AFIRM program. (One 
commission member, who supported the program, was absent.) The 
Commission held a special meeting on May 13 to consider the matter 
a second time, and with a different mix of commissioners, endorsed 
the plan by a vote of 4-0. The San Francisco Board of Supervisors 
must change the ordinance overseeing General Assistance to begin 
requiring electronic fingerprinting, before the plan can go into 

Electronic fingerprinting is a technology that allows fingerprint 
images to be stored on a computer system.(2) A digital fingerprint 
can be quickly matched against other fingerprints stored on the 
computer. Fingerprints are essentially photographed using a 
scanning device, and the computerized images are stored in a 

EDS functions as a "systems integrator" for the AFIRM system. That 
is, they have combined hardware and software from various vendors 
to create the system.  For example, the AFIRM system uses Hewlett-
Packard computers and workstations, Informix database software, 
and fingerprint-matching technology from Printrak.  In LA, the 
county contracted with EDS to provide the service, and the service 
is priced according to the number of records to be maintained. 
That is, the county did not purchase equipment or software. 
Fingerprints are stored in a proprietary file format, meaning that 
the data cannot easily be used with other vendors' software.

With the AFIRM system, the right and left index fingers are 
scanned. Within a few minutes, the system searches its existing 
database of prints for matches. In LA, if the system finds a match 
for a single print only (considered a "half-match"), benefits are 
not denied, but the incident is reported to the fraud 
investigation unit for follow-up. If both prints match (a "full-
match"), benefits are denied. The client can challenge the 
decision, and have the fraud investigation unit confirm or reject 
the computer's assessment. Alameda County follows similar 

During the implementation phase in Alameda County and Los Angeles 
County, all GA recipients were required to submit to 
fingerprinting. If they failed to appear for their appointments, 
their benefits could be terminated. If they refused to give their 
fingerprints, their benefits were terminated. All new applicants 
for GA are required to give their fingerprints, or else benefits 
are denied.


Requiring electronic fingerprinting as a condition of receiving 
benefits raises several questions, including:

* Can the cost of the system be justified?

* Is the system even necessary?

* Will the system have other consequences not related to deterring 

* Is requiring fingerprinting, recognized as a law enforcement 
technology, appropriate for welfare programs?


DSS has no idea how much "double-dipping" fraud occurs. DSS 
General Manager Brian Cahill told the mayor, "We believe that 
there is a substantial number of persons who are receiving 
duplicate aid because we have no way to determine an 
identification for  clients." That is, since DSS doesn't know, 
there therefore must be a "substantial number." DSS has no 
_objective_ basis, only anecdotes and assumptions, for determining 
the scope of the problem, and therefore has no rational basis for 
justifying the cost.

However, looking at Los Angeles County's experience, the extent of 
"double-dipping" would seem to be overstated.  According to the 
_Los Angeles Times_, after three months of use, only _two_ cases 
of intentional "double-dipping" fraud were identified, where new 
applicants attempted to apply for benefits under two names.(3) By 
December, after six months of use, all of 11 cases had been closed 
because duplicate sets of prints were found on the system, 
although it is not known how many of those cases were considered 
fraudulent behavior.(4) 

Up to March 1993, Los Angeles County denied GA 434 times to new 
applicants due to fingerprint matches, and a cumulative total of 
785 new applicants refused to be fingerprinted. New applications 
for GA in Los Angeles County over the past two years range between 
15,000 and 19,000 each month; that is, approximately 350,000 
applications were processed during the time the AFIRM system has 
been in place. Even assuming that _all_ of the people denied 
benefits because of the AFIRM system were trying to defraud the 
county, that still leaves an AFIRM-detected fraud incidence of _at 
most_ .34%; that is, about 1 in 300. Given the size of the San 
Francisco caseload, this would work out to three people a month 
being matched by the system, and maybe another five or six 
refusing to be fingerprinted.(5)

It should be noted from the statistics that only a minority of 
fingerprint matches are actual fraud attempts. Alameda County, 
which began using the AFIRM system in early February, was about 
80% done with fingerprinting of existing GA clients by mid-May. 
With approximately 9,000 GA cases processed, only _six_ matches 
had been found, and _none_ of those matches were cases of 
fraudulent behavior.(6) Mental illness (DSS estimates that one in 
seven GA recipients suffers from a mental health problem, and one 
in three suffers from drug or alcohol addiction) or just general 
confusion by the byzantine rules of the welfare system could be 
the cause of these attempts to apply for aid a second time.

Finally, just because the AFIRM system is credited with picking 
out situations of duplicate aid, there is no way of knowing how 
many of the cases could have been picked out using existing 
computer matching and other identification systems already in 


In his letter to Mayor Frank Jordan, DSS General Manager Brian 
Cahill wrote that the system "would cost in the neighborhood of $1 
million over a 5 year period. Our costs would be based on hardware 
and the number of cases on GA."(7) Yet Alameda County estimates 
that the same system there will cost $1.3 million over a five year 
period. San Francisco's case load is 50% higher that Alameda's, 
and since the cost is directly related to caseload, the 
anticipated cost to San Francisco could be twice Cahill's 

Furthermore, there may be additional costs not included in 
Cahill's estimate. Electronic Data Systems sells a service, and 
prices it according to the number of records it processes and 
stores. The cost figures include, according to Cahill, "training, 
implementation, equipment, phone lines, installation and finger 
print processing." Not included in this list are DSS direct 
expenses like electricity, the cost of the space to house the 
equipment and operators, the labor associated with following up on 
half-matches or false-positive matches (where the system says that 
there is a match, when in fact there is not), etc. which must be 
absorbed by DSS elsewhere from its budget. Also not listed are the 
many hidden costs in establishing new systems: staff 
inefficiencies while adopting a new system, lost time due to re-
processing cases that were erroneously closed, administrative 
overhead, etc. Such costs could further inflate a $2 million price 
tag.  Once data-sharing begins with other counties, additional 
administrative resources may be required. Finally, since the 
system is priced on the number of records maintained, and as the 
California economy worsens and GA rolls increase, San Francisco 
may be looking at an escalating cost. 

The dollar costs need to be examined very carefully.  These are 
additional expenditures of tax dollars and human resources in a 
time of serious budget difficulties.


The stated purpose of AFIRM is to _deter_ alleged fraud by driving 
away people who would "double-dip" in the GA program. The _LA 
Times_ report, written as LA was reaching the end of its 
changeover period, when one would expect most of the cases of 
existing fraud to be "weeded out", said that about 700 GA cases 
had been dropped. At the end of December, 1991, after its 
changeover was completed, LA County said that it had dropped 3,010 
people who missed their fingerprinting appointment ("non-
compliance"); and 11 duplicate cases had been found.  Alameda 
County had dropped 147 cases by mid-May for "non-compliance."

Cumulative totals for new applications denied by Los Angeles 
County are given above.


Without any data as to _why_ the caseload in Los Angeles and 
Alameda County dropped, it is spurious logic at best to assert 
that fraud has been rooted out. Much more likely reasons for the 
caseload drop are missed appointments, perhaps because of lost or 
missed mail; fears about being fingerprinted; concerns about 
privacy; or the inevitable problems of processing, in Alameda's 
case, 11,000 cases, or in the situation of Los Angeles, 59,000 
cases. A 98.5% rate of success in processing would be admirable in 
most quality assurance managers' book; but the other 1.5% that are 
failures could still account for all of the dropped cases. 

In fact _any_ substantial change in case-handling could result in 
a drop in cases, of people _who are entitled to receive benefits_. 
No one has yet produced any data to substantiate the claim that 
AFIRM has deterred fraud. All that _can_ be said is that AFIRM is 
an expensive, additional obstacle to receiving GA, and that its 
use _coincides_ with a reduction in caseloads. However, the 
purpose of AFIRM is _not_ to reduce caseloads, and any other goals 
of using the system cannot be proven with currently available 
data. At best, AFIRM is an expensive shotgun approach to a 
specific problem of unknown size.


No one knows.

Because no data exists as to _why_ caseloads drop as a result of 
installing the fingerprint system and changing department 
procedure, it is impossible to determine how much the system 
saves. That is, if cases are dropped in error, say as a result of 
lost mail or missed appointments, and the cases are re-opened, 
then in those instances the system has cost money by creating 
unnecessary work. If cases are dropped because people are afraid 
of the fingerprinting system, or believe that it is an invasion of 
their privacy, then those cases will show up as dollar costs 
elsewhere in the welfare system, and conceivably as social costs 
with a rise in homelessness and other problems.

LA County, using the 3,021 cases closed figure, claims that the 
system saved it $5.4 million over the first six months. But 
because no figures exist that indicate how many of those cases 
were subsequently re-opened, the savings figure must be taken with 
a grain of salt. Yes, they closed cases, and yes, that probably 
saved the county those benefits for a month or two, but only 
because benefits were denied to people who were entitled to 
receive them. The percentage of those people who were actually 
"double-dipping" is just not known. It is also impossible to know 
if AFIRM "deterred fraud" (that is, people were aware of the 
system, so did not attempt to apply a second tme), based on 
available data.

DSS has provided figures to the Mayor's Office and to the Social 
Services Commission that anticipate savings based on a seven 
percent savings (although they admit the figure may be too high). 
A May, 1993 DSS memo says that "Alameda County reported a drop in 
caseload of roughly 7-10 per cent from April 1992, to February 
1993."(8) However, fingerprinting in Alameda County did not even 
begin until February, 1993, so that savings figure is useless for 
gauging the results of fingerprinting. 

Taking Alameda and Los Angeles County numbers at face value (i.e., 
not taking into consideration that some portion of those were 
dropped erroneously), Alameda has dropped about 1.7% of its cases, 
and Los Angeles dropped about 5% of its cases (LA had a caseload 
of about 59,000 when it started the program). It is not known how 
many of the cases were subsequently re-opened.

Finally, the "savings" realized from the AFIRM system are mostly 
realized during the first six months, during the changeover period 
when most cases are closed. After that, the "savings" drop 
considerably. Based on the LA figures, the savings from cases 
denied because of matches are less than the cost of the system.(9)

Over the long haul, AFIRM represents additional costs in GA 
administration, with no rise in the benefits pool. As such, it 
means that the ratio of administration-to-benefits has gone up; 
that is, new inefficiencies are built into the welfare system. 
Computers are not a magic solution, and additional infrastructure 
is required to install and maintain hardware and software, and 
train users and adjust office procedure. Inflating bureaucracy at 
the expense of services-provided is not a wise use of taxpayer 

The AFIRM system may indeed reduce welfare payments, by only by 
terminating benefits to people entitled to them. However, that is 
not the stated purpose of AFIRM. Implementing a system that may 
result in DSS failing to provide basic survival aid to people in 
need is legally and morally suspect.


Computer systems are not infallible. The system may miss actual 
cases of fraud (false-negatives). If people are truly intent on 
committing fraud, they will come up with ways to defeat the 
fingerprinting system (including self-mutilation, in the most 
desperate case). A computer system can create a false sense of 
security, when in fact it has just upped the ante in terms of 
technique and technology.


AFIRM is intended to deter fraud by preventing GA recipients from 
signing up under more than one name. However, current DSS policy 
requires people to provide a social security number and a state ID 
card or driver's license to DSS before they can receive GA. 
According to Bill Madison, an information officer with the 
Department of Motor Vehicles, it is extremely difficult to obtain 
identification under more than one name. DMV personnel are trained 
to identify false documentation. Suspicious requests for ID are 
passed along to their security unit, which can utilize their 
database of digital fingerprints and photographs to determine if a 
duplicate request has been made. To obtain a second social 
security number means additionally circumventing procedures that 
the Social Security Administration (SSA) has in place. That is, 
the checks against maintaining more than one identity are already 
in place.  The AFIRM system is redundant, and duplicates other 
government resources. DSS cannot justify AFIRM without calling 
into question the effectiveness of the DMV and the SSA systems.

AFIRM is also intended to prevent people from signing up for 
benefits in more than one county. But San Francisco and Alameda 
currently exchange computer data to compare social security 
numbers of recipients, and DSS has an aggressive mix of rules to 
ensure that recipients reside in one location.  Again, systems are 
in place to prevent the type of fraud alleged by DSS.


Because DSS has no way of accurately _accounting_ for the results 
of installing the AFIRM system, it is impossible to say that AFIRM 
has made anything more "accountable". "Accountability" implies a 
concrete basis for comparing costs and results. With no firm idea 
of the scope of the problem, or the nature of the results, DSS is 
throwing expensive technology at a problem of unknown size. The 
installation of a computer system, by itself, does not introduce 
"accountability." Nor does dodging the state mandated 
responsibility to provide aid to destitute people, by saying that 
"the computer did it" improve accountability.

Because computer systems greatly enhance the ability to store and 
search personal data, privacy implications are always an issue. 
The system may also deter people from getting benefits to which 
they are entitled.


The AFIRM system means that more information will be stored on a 
computer system. Something is given up by individuals when they 
must surrender personal information to the government; as such, 
requiring fingerprinting is an erosion of one's right to privacy, 
which is guaranteed under the California state constitution. 
Obvious concerns are the security of the data, and that DSS 
fingerprint data will be shared with law enforcement agencies or 
other government agencies.


Data stored on a computer is much more prone to unauthorized 
duplication, modification, and transmission than its low-tech 
counterparts. And such problems are even more likely in the 
absence of a thought-out policy regarding the security of computer 
records. AFIRM data resides on a computer system housed at an EDS 
facility. EDS is contractually responsible for maintaining a 
secure data facility, although direct control of that is removed 
from DSS. At the DSS end, only authorized personnel will be 
granted access to the system by DSS, the equipment will be housed 
in a secure area accessible only to operators, authorized users 
will have IDs and passwords, and a record will be kept of people 
who log onto the system. But does DSS have a comprehensive 
computer security policy?  Will DSS keep an audit trail of changes 
to data on the system? How often will users be required to change 
their passwords?  Is DSS taking into account where technology will 
be five years from now, as equipment costs will most assuredly 
drop, and computing search power will grow? Access issues will 
continue to grow in complexity.


The California Welfare and Institutions Code, section 17006.5, 
describes the conditions under which welfare data may be shared 
with law enforcement officials. When presented with a felony 
warrant and a signed letter from the head of the enforcement 
agency, the welfare agency may disclose certain information, 
including name, address, birthdate, social security number, and 
"physical description." It is entirely plausible that "physical 
description" could include fingerprints. Furthermore, since police 
agencies can currently ask DSS to search for a name in its 
database, it is not farfetched to have the law enforcement agency 
request to search the welfare database for a fingerprint, using 
FBI or other law enforcement fingerprint data. That is, it is not 
clear that current policy would forbid that use of the fingerprint 

In addition, any protestations to the contrary, nothing can 
guarantee that the law will not be changed in two, five or ten 
years, relaxing the search guidelines. This pool of fingerprint 
data, collected under the assumption of confidentiality, would 
then be stripped of its protected status.

No official policy can guarantee against "unofficial" acts, which 
may or may not be quietly sanctioned by higher-ups. There are 
cases in recent history where zealous DSS employees have shared 
information with police, against stated department policy. Local 
newspapers have recently reported on police officers keeping 
duplicate sets of police data on their home computers, against 
policy. The current case of former police inspector Tom Gerard, 
who is charged with stealing confidential police files and 
suspected of selling the information to other agencies and even to 
other governments, is an even more extreme, but actual case. The 
point is that once data assumes a digital format, it tends to 
persist in computer systems, and to leak about. Unless there is 
some overriding need to collect the data, it is best left 


DSS has claimed that the prints taken by the AFIRM system are 
incompatible with the prints taken for law enforcement purposes. 
While the DSS data may be stored in a different format than police 
data, there are ways around this problem. Data is data, and 
software can be developed to translate data from one format to 
another. The FBI is reportedly moving towards digital 
fingerprinting storage standards, and once those are in place, 
this process should be streamlined. DSS also claims that "law 
enforcement requires thumb prints" while DSS uses index finger 
prints, adding another level of incompatibility. However, this 
just isn't so. During booking,  the police take a full set of ten 


San Francisco intends to share its data with Alameda County, and, 
according to John Vera, DSS Assistant General Manager, "[i]f other 
Bay Area counties opt in, the data base would be expanded to 
include them." Some type of matching may take place with Los 
Angeles County as well. Plans are underway to extend the system to 
other welfare programs (see below). DSS had made ambiguous 
statements about who they would be willing to share the data with, 
meaning that no clear policy has been set.(10) Widespread sharing 
of data leads to the possibility of the data taking on a certain 
life of its own, and any control of the data eventually is lost.


The figures from LA County and Alameda County would indicate that 
yes, people are deterred from benefits to which they are entitled. 
Regardless of its unfortunate extension to other areas, 
fingerprinting historically has been a law enforcement technology, 
and this is a common public perception. With welfare agencies' 
emphasis on fraud detection, the boundary between law enforcement 
and social services has blurred. The choice of fingerprinting 
technology to verify identity further blurs that boundary between 
law enforcement and social service.

In other areas, fingerprinting has been rejected, precisely 
because of the aura of law enforcement around it. Last year, for 
example, the _Wall Street Journal_ reported that airport 
officials, looking for a way to speed people through immigration 
at Kennedy Airport, decided _not_ to use fingerprinting technology 
to match people with their passports. "We didn't want to get into 
fingerprints because of law enforcement connotations," said 
Richard Norton, the Air Transport Association's senior director of 

The law enforcement aura surrounding fingerprinting, when combined 
with the public perception of computers as infallible search 
engines capable of retrieving any data about a person, can create 
an intimidating presence. When one adds into the mix that a high 
percentage of GA recipients are mentally ill and/or substance 
abusers, then the possibility of intimidation increases, whether 
rightly or wrongly, from any number of fears: of the police, of 
computers, of public exposure, etc.(11)


DMV began requiring digital fingerprints in 1991. The purpose of 
this program is to ensure that the person renewing a license is 
the same person who originally applied for the license. As such, 
DMV claims it is a personal protection, in case one's license is 
lost or stolen.(12) DMV fingerprint data is not routinely matched 
against other fingerprint data. While similar privacy concerns 
have been raised of DMV's collection of fingerprint data, it's 
current use is relatively benign and of a restricted nature. 
Because, legally speaking, driving is a "privilege," and welfare 
is a matter of survival, requiring fingerprints of welfare 
recipients should be held to a higher test of need.


Alternatives do exist for recording unique information about a 
person, for the purpose of verifying identity or verifying 
uniqueness. Technology exists to scan the bone structure of a 
hand, or the vein patterns on the back of the hand, both of which 
are as unique as fingerprints, but have no possibility of tying-in 
with law enforcement fingerprint systems.


Los Angeles County plans to begin a pilot program on June 1 to 
extend use of the AFIRM system to Aid to Families with Dependent 
Children (AFDC) recipients in LA County. The $21 million program 
will quadruple the number of fingerprints stored on the Los 
Angeles system, from about 100,000 to 400,000. Alameda County is 
rumored to be considering extending the program to AFDC as well. 
San Francisco's DSS may also be discussing future expansion to 
other forms of aid. After the system extends to AFDC, it is 
conceivable that AFIRM will be extended to food stamps. If the 
problem can be as large as DSS can imagine it, where will 
fingerprinting stop? Will DSS require children to be fingerprinted 
as well? And how long will their fingerprints remain on the 

Jim Davis
Western Regional Director
Computer Professionals for Social Responsibility
P.O. Box 717
Palo Alto, CA 94302

Local contact information:
414 Chestnut Street,
San Francisco, CA 94133
(415) 398-2818

[Computer Professionals for Social Responsibility is a national 
public-interest alliance of computer scientists, engineers, users 
and others interested in the impact of computer technology on 
society. We work to influence decisions regarding the development 
and use of computers  because those decisions have far-reaching 
consequences and reflect basic values and priorities. CPSR has 500 
members in the Bay Area.]


1. EDS was founded by H. Ross Perot in 1962. General Motors bought 
EDS in 1984 for $2.55 billion in cash and stock. Probably the 
largest computer services company in the world, EDS had sales $8.2 
billion in 1992. About 10 percent of EDS's revenues come from 
government contracts. EDS is also one of the world's largest 
private operators of data processing centers, operating 110 sites 
in North America, Europe and Asia in 1991. The rise in computer 
operations "outsourcing," where companies and government agencies 
contract with outside companies like EDS to handle their computer 
and data processing needs has fueled EDS's tremendous growth over 
the past 10 years. "The rapid growth of EDS and its biggest 
competitors raises the intriguing question of how much of the 
nation's computing capacity will one day end up in the hands of a 
few computer services giants." (_New York Times_, October 30, 

2.  Details about the AFIRM System are from a conversation with 
Curtis Williams, Project Director for EDS in Los Angeles, and from 
the "AFIRM Fact Sheet," provided by the Los Angeles County 
Department of Public Social Services.

3. "County Welfare Recipients Prints Taken", _Los Angeles Times_. 
October 12, 1991.

4. Figures for LA County's General Relief program (their 
equivalent to San Francisco's General Assistance) were provided by 
the LA County DPSS Computer Services Division.

5. From May, 1992 to April, 1993, DSS received on average about 
2,800 GA applications a month. That approximates LA's number of GA 
applications as a percentage of total caseload (around 17 -  20%). 
Either multiplying the .34% figure from LA's experience by the 
number of new San Francisco GA cases, or taking the relative size 
of San Francisco's caseload (15% of LA's) and multiplying it by 
the number of matches and refusals LA had, the results are about 
the same.

6. Alameda County data is taken from Alameda County Social 
Services Agency press releases, and information provided by Luanne 
DeWitt, public information officer with Alameda's SSA.

7. Letter from Cahill to Mayor Frank Jordan, March 31, 1993.

8. Memo from John Vera, Assistant General Manager of DSS, to the 
San Francisco Social Services Commission, May 12, 1993.

9. LA has denied 434 cases over the 21 month period from June, 
1991 to March, 1993 (about 21 cases a month). Assuming someone 
would receive benefits of $350 per month for a year: 21 cases per 
month * $350/month GA benefit * 12 months = $88,200/month 
"savings" vs. $9.4 million system cost/5 years = $156,666/month 
cost. The actual system cost may be higher, and the actual GA 
benefit is a bit lower.

10. At the May 13 Social Services Commission meeting, Vera said 
that DSS would "share its data with anyone who shared their data 
with DSS." This could conceivably include welfare agencies in 
other states, or other state agencies. 

11. "Privacy in Peril: How computers are making private life a 
thing of the past", a special report in the July, 1993 issue of 
_Macworld_ magazine is a very good summary of computers and 
privacy issues. 

12. From a conversation with Bill Madison of DMV.