ELECTRONIC FINGERPRINTING FOR GENERAL ASSISTANCE RECIPIENTS IN SAN
FRANCISCO
by Jim Davis
BACKGROUND
The San Francisco Department of Social Services (DSS), at the
urging of the Mayor's office, wants to begin electronically
fingerprinting everyone who receives General Assistance (GA)
benefits, as a condition of their receiving aid. GA is a state-
mandated, county-administered program for indigent adults. DSS
wants to adopt the Automated Fingerprint Image Reporting and Match
(AFIRM) system, developed by Electronic Data Systems (EDS).(1) Los
Angeles County began using the AFIRM system in June, 1991 for
their GA program; and Alameda County began using the same system
in February of this year. Ostensibly, the system is intended to
prevent a particular kind of fraud called "double-dipping," where
someone receives aid under more than one name, or receives aid in
more than county.
At its April meeting, the San Francisco Social Services
Commission, which oversees DSS, failed to endorse the plan due to
a lack of a second on the motion to adopt the AFIRM program. (One
commission member, who supported the program, was absent.) The
Commission held a special meeting on May 13 to consider the matter
a second time, and with a different mix of commissioners, endorsed
the plan by a vote of 4-0. The San Francisco Board of Supervisors
must change the ordinance overseeing General Assistance to begin
requiring electronic fingerprinting, before the plan can go into
effect.
Electronic fingerprinting is a technology that allows fingerprint
images to be stored on a computer system.(2) A digital fingerprint
can be quickly matched against other fingerprints stored on the
computer. Fingerprints are essentially photographed using a
scanning device, and the computerized images are stored in a
database.
EDS functions as a "systems integrator" for the AFIRM system. That
is, they have combined hardware and software from various vendors
to create the system. For example, the AFIRM system uses Hewlett-
Packard computers and workstations, Informix database software,
and fingerprint-matching technology from Printrak. In LA, the
county contracted with EDS to provide the service, and the service
is priced according to the number of records to be maintained.
That is, the county did not purchase equipment or software.
Fingerprints are stored in a proprietary file format, meaning that
the data cannot easily be used with other vendors' software.
With the AFIRM system, the right and left index fingers are
scanned. Within a few minutes, the system searches its existing
database of prints for matches. In LA, if the system finds a match
for a single print only (considered a "half-match"), benefits are
not denied, but the incident is reported to the fraud
investigation unit for follow-up. If both prints match (a "full-
match"), benefits are denied. The client can challenge the
decision, and have the fraud investigation unit confirm or reject
the computer's assessment. Alameda County follows similar
guidelines.
During the implementation phase in Alameda County and Los Angeles
County, all GA recipients were required to submit to
fingerprinting. If they failed to appear for their appointments,
their benefits could be terminated. If they refused to give their
fingerprints, their benefits were terminated. All new applicants
for GA are required to give their fingerprints, or else benefits
are denied.
THE ISSUES
Requiring electronic fingerprinting as a condition of receiving
benefits raises several questions, including:
* Can the cost of the system be justified?
* Is the system even necessary?
* Will the system have other consequences not related to deterring
fraud?
* Is requiring fingerprinting, recognized as a law enforcement
technology, appropriate for welfare programs?
HOW EXTENSIVE IS THE PROBLEM OF "DOUBLE-DIPPING"?
DSS has no idea how much "double-dipping" fraud occurs. DSS
General Manager Brian Cahill told the mayor, "We believe that
there is a substantial number of persons who are receiving
duplicate aid because we have no way to determine an
identification for clients." That is, since DSS doesn't know,
there therefore must be a "substantial number." DSS has no
_objective_ basis, only anecdotes and assumptions, for determining
the scope of the problem, and therefore has no rational basis for
justifying the cost.
However, looking at Los Angeles County's experience, the extent of
"double-dipping" would seem to be overstated. According to the
_Los Angeles Times_, after three months of use, only _two_ cases
of intentional "double-dipping" fraud were identified, where new
applicants attempted to apply for benefits under two names.(3) By
December, after six months of use, all of 11 cases had been closed
because duplicate sets of prints were found on the system,
although it is not known how many of those cases were considered
fraudulent behavior.(4)
Up to March 1993, Los Angeles County denied GA 434 times to new
applicants due to fingerprint matches, and a cumulative total of
785 new applicants refused to be fingerprinted. New applications
for GA in Los Angeles County over the past two years range between
15,000 and 19,000 each month; that is, approximately 350,000
applications were processed during the time the AFIRM system has
been in place. Even assuming that _all_ of the people denied
benefits because of the AFIRM system were trying to defraud the
county, that still leaves an AFIRM-detected fraud incidence of _at
most_ .34%; that is, about 1 in 300. Given the size of the San
Francisco caseload, this would work out to three people a month
being matched by the system, and maybe another five or six
refusing to be fingerprinted.(5)
It should be noted from the statistics that only a minority of
fingerprint matches are actual fraud attempts. Alameda County,
which began using the AFIRM system in early February, was about
80% done with fingerprinting of existing GA clients by mid-May.
With approximately 9,000 GA cases processed, only _six_ matches
had been found, and _none_ of those matches were cases of
fraudulent behavior.(6) Mental illness (DSS estimates that one in
seven GA recipients suffers from a mental health problem, and one
in three suffers from drug or alcohol addiction) or just general
confusion by the byzantine rules of the welfare system could be
the cause of these attempts to apply for aid a second time.
Finally, just because the AFIRM system is credited with picking
out situations of duplicate aid, there is no way of knowing how
many of the cases could have been picked out using existing
computer matching and other identification systems already in
place.
HOW MUCH WILL THE SYSTEM COST?
In his letter to Mayor Frank Jordan, DSS General Manager Brian
Cahill wrote that the system "would cost in the neighborhood of $1
million over a 5 year period. Our costs would be based on hardware
and the number of cases on GA."(7) Yet Alameda County estimates
that the same system there will cost $1.3 million over a five year
period. San Francisco's case load is 50% higher that Alameda's,
and since the cost is directly related to caseload, the
anticipated cost to San Francisco could be twice Cahill's
estimate.
Furthermore, there may be additional costs not included in
Cahill's estimate. Electronic Data Systems sells a service, and
prices it according to the number of records it processes and
stores. The cost figures include, according to Cahill, "training,
implementation, equipment, phone lines, installation and finger
print processing." Not included in this list are DSS direct
expenses like electricity, the cost of the space to house the
equipment and operators, the labor associated with following up on
half-matches or false-positive matches (where the system says that
there is a match, when in fact there is not), etc. which must be
absorbed by DSS elsewhere from its budget. Also not listed are the
many hidden costs in establishing new systems: staff
inefficiencies while adopting a new system, lost time due to re-
processing cases that were erroneously closed, administrative
overhead, etc. Such costs could further inflate a $2 million price
tag. Once data-sharing begins with other counties, additional
administrative resources may be required. Finally, since the
system is priced on the number of records maintained, and as the
California economy worsens and GA rolls increase, San Francisco
may be looking at an escalating cost.
The dollar costs need to be examined very carefully. These are
additional expenditures of tax dollars and human resources in a
time of serious budget difficulties.
WHAT HAS BEEN THE EXPERIENCE OF LOS ANGELES COUNTY AND ALAMEDA
COUNTY?
The stated purpose of AFIRM is to _deter_ alleged fraud by driving
away people who would "double-dip" in the GA program. The _LA
Times_ report, written as LA was reaching the end of its
changeover period, when one would expect most of the cases of
existing fraud to be "weeded out", said that about 700 GA cases
had been dropped. At the end of December, 1991, after its
changeover was completed, LA County said that it had dropped 3,010
people who missed their fingerprinting appointment ("non-
compliance"); and 11 duplicate cases had been found. Alameda
County had dropped 147 cases by mid-May for "non-compliance."
Cumulative totals for new applications denied by Los Angeles
County are given above.
DO THE DROPPED CASES CONFIRM THAT FRAUD IS BEING DETERRED?
Without any data as to _why_ the caseload in Los Angeles and
Alameda County dropped, it is spurious logic at best to assert
that fraud has been rooted out. Much more likely reasons for the
caseload drop are missed appointments, perhaps because of lost or
missed mail; fears about being fingerprinted; concerns about
privacy; or the inevitable problems of processing, in Alameda's
case, 11,000 cases, or in the situation of Los Angeles, 59,000
cases. A 98.5% rate of success in processing would be admirable in
most quality assurance managers' book; but the other 1.5% that are
failures could still account for all of the dropped cases.
In fact _any_ substantial change in case-handling could result in
a drop in cases, of people _who are entitled to receive benefits_.
No one has yet produced any data to substantiate the claim that
AFIRM has deterred fraud. All that _can_ be said is that AFIRM is
an expensive, additional obstacle to receiving GA, and that its
use _coincides_ with a reduction in caseloads. However, the
purpose of AFIRM is _not_ to reduce caseloads, and any other goals
of using the system cannot be proven with currently available
data. At best, AFIRM is an expensive shotgun approach to a
specific problem of unknown size.
HOW MUCH WILL THE SYSTEM SAVE?
No one knows.
Because no data exists as to _why_ caseloads drop as a result of
installing the fingerprint system and changing department
procedure, it is impossible to determine how much the system
saves. That is, if cases are dropped in error, say as a result of
lost mail or missed appointments, and the cases are re-opened,
then in those instances the system has cost money by creating
unnecessary work. If cases are dropped because people are afraid
of the fingerprinting system, or believe that it is an invasion of
their privacy, then those cases will show up as dollar costs
elsewhere in the welfare system, and conceivably as social costs
with a rise in homelessness and other problems.
LA County, using the 3,021 cases closed figure, claims that the
system saved it $5.4 million over the first six months. But
because no figures exist that indicate how many of those cases
were subsequently re-opened, the savings figure must be taken with
a grain of salt. Yes, they closed cases, and yes, that probably
saved the county those benefits for a month or two, but only
because benefits were denied to people who were entitled to
receive them. The percentage of those people who were actually
"double-dipping" is just not known. It is also impossible to know
if AFIRM "deterred fraud" (that is, people were aware of the
system, so did not attempt to apply a second tme), based on
available data.
DSS has provided figures to the Mayor's Office and to the Social
Services Commission that anticipate savings based on a seven
percent savings (although they admit the figure may be too high).
A May, 1993 DSS memo says that "Alameda County reported a drop in
caseload of roughly 7-10 per cent from April 1992, to February
1993."(8) However, fingerprinting in Alameda County did not even
begin until February, 1993, so that savings figure is useless for
gauging the results of fingerprinting.
Taking Alameda and Los Angeles County numbers at face value (i.e.,
not taking into consideration that some portion of those were
dropped erroneously), Alameda has dropped about 1.7% of its cases,
and Los Angeles dropped about 5% of its cases (LA had a caseload
of about 59,000 when it started the program). It is not known how
many of the cases were subsequently re-opened.
Finally, the "savings" realized from the AFIRM system are mostly
realized during the first six months, during the changeover period
when most cases are closed. After that, the "savings" drop
considerably. Based on the LA figures, the savings from cases
denied because of matches are less than the cost of the system.(9)
Over the long haul, AFIRM represents additional costs in GA
administration, with no rise in the benefits pool. As such, it
means that the ratio of administration-to-benefits has gone up;
that is, new inefficiencies are built into the welfare system.
Computers are not a magic solution, and additional infrastructure
is required to install and maintain hardware and software, and
train users and adjust office procedure. Inflating bureaucracy at
the expense of services-provided is not a wise use of taxpayer
money.
The AFIRM system may indeed reduce welfare payments, by only by
terminating benefits to people entitled to them. However, that is
not the stated purpose of AFIRM. Implementing a system that may
result in DSS failing to provide basic survival aid to people in
need is legally and morally suspect.
WILL THE AFIRM SYSTEM ELIMINATE DOUBLE-DIPPING FRAUD?
Computer systems are not infallible. The system may miss actual
cases of fraud (false-negatives). If people are truly intent on
committing fraud, they will come up with ways to defeat the
fingerprinting system (including self-mutilation, in the most
desperate case). A computer system can create a false sense of
security, when in fact it has just upped the ante in terms of
technique and technology.
IS THE AFIRM SYSTEM NECESSARY?
AFIRM is intended to deter fraud by preventing GA recipients from
signing up under more than one name. However, current DSS policy
requires people to provide a social security number and a state ID
card or driver's license to DSS before they can receive GA.
According to Bill Madison, an information officer with the
Department of Motor Vehicles, it is extremely difficult to obtain
identification under more than one name. DMV personnel are trained
to identify false documentation. Suspicious requests for ID are
passed along to their security unit, which can utilize their
database of digital fingerprints and photographs to determine if a
duplicate request has been made. To obtain a second social
security number means additionally circumventing procedures that
the Social Security Administration (SSA) has in place. That is,
the checks against maintaining more than one identity are already
in place. The AFIRM system is redundant, and duplicates other
government resources. DSS cannot justify AFIRM without calling
into question the effectiveness of the DMV and the SSA systems.
AFIRM is also intended to prevent people from signing up for
benefits in more than one county. But San Francisco and Alameda
currently exchange computer data to compare social security
numbers of recipients, and DSS has an aggressive mix of rules to
ensure that recipients reside in one location. Again, systems are
in place to prevent the type of fraud alleged by DSS.
WILL AFIRM MAKE THE GENERAL ASSISTANCE PROGRAM MORE ACCOUNTABLE?
Because DSS has no way of accurately _accounting_ for the results
of installing the AFIRM system, it is impossible to say that AFIRM
has made anything more "accountable". "Accountability" implies a
concrete basis for comparing costs and results. With no firm idea
of the scope of the problem, or the nature of the results, DSS is
throwing expensive technology at a problem of unknown size. The
installation of a computer system, by itself, does not introduce
"accountability." Nor does dodging the state mandated
responsibility to provide aid to destitute people, by saying that
"the computer did it" improve accountability.
BESIDES THE COST AND QUESTIONABLE NEED, WHAT ARE SOME OTHER AREAS
OF CONCERN WITH THE AFIRM SYSTEM?
Because computer systems greatly enhance the ability to store and
search personal data, privacy implications are always an issue.
The system may also deter people from getting benefits to which
they are entitled.
WHAT ARE THE PRIVACY IMPLICATIONS FOR THE AFIRM SYSTEM?
The AFIRM system means that more information will be stored on a
computer system. Something is given up by individuals when they
must surrender personal information to the government; as such,
requiring fingerprinting is an erosion of one's right to privacy,
which is guaranteed under the California state constitution.
Obvious concerns are the security of the data, and that DSS
fingerprint data will be shared with law enforcement agencies or
other government agencies.
HOW SECURE WILL THE FINGERPRINT DATA BE?
Data stored on a computer is much more prone to unauthorized
duplication, modification, and transmission than its low-tech
counterparts. And such problems are even more likely in the
absence of a thought-out policy regarding the security of computer
records. AFIRM data resides on a computer system housed at an EDS
facility. EDS is contractually responsible for maintaining a
secure data facility, although direct control of that is removed
from DSS. At the DSS end, only authorized personnel will be
granted access to the system by DSS, the equipment will be housed
in a secure area accessible only to operators, authorized users
will have IDs and passwords, and a record will be kept of people
who log onto the system. But does DSS have a comprehensive
computer security policy? Will DSS keep an audit trail of changes
to data on the system? How often will users be required to change
their passwords? Is DSS taking into account where technology will
be five years from now, as equipment costs will most assuredly
drop, and computing search power will grow? Access issues will
continue to grow in complexity.
CAN THE FINGERPRINT DATA BE USED BY LAW ENFORCEMENT AGENCIES?
The California Welfare and Institutions Code, section 17006.5,
describes the conditions under which welfare data may be shared
with law enforcement officials. When presented with a felony
warrant and a signed letter from the head of the enforcement
agency, the welfare agency may disclose certain information,
including name, address, birthdate, social security number, and
"physical description." It is entirely plausible that "physical
description" could include fingerprints. Furthermore, since police
agencies can currently ask DSS to search for a name in its
database, it is not farfetched to have the law enforcement agency
request to search the welfare database for a fingerprint, using
FBI or other law enforcement fingerprint data. That is, it is not
clear that current policy would forbid that use of the fingerprint
data.
In addition, any protestations to the contrary, nothing can
guarantee that the law will not be changed in two, five or ten
years, relaxing the search guidelines. This pool of fingerprint
data, collected under the assumption of confidentiality, would
then be stripped of its protected status.
No official policy can guarantee against "unofficial" acts, which
may or may not be quietly sanctioned by higher-ups. There are
cases in recent history where zealous DSS employees have shared
information with police, against stated department policy. Local
newspapers have recently reported on police officers keeping
duplicate sets of police data on their home computers, against
policy. The current case of former police inspector Tom Gerard,
who is charged with stealing confidential police files and
suspected of selling the information to other agencies and even to
other governments, is an even more extreme, but actual case. The
point is that once data assumes a digital format, it tends to
persist in computer systems, and to leak about. Unless there is
some overriding need to collect the data, it is best left
uncollected.
IS AFIRM FINGERPRINT DATA COMPATIBLE WITH LAW ENFORCEMENT
FINGERPRINT DATA?
DSS has claimed that the prints taken by the AFIRM system are
incompatible with the prints taken for law enforcement purposes.
While the DSS data may be stored in a different format than police
data, there are ways around this problem. Data is data, and
software can be developed to translate data from one format to
another. The FBI is reportedly moving towards digital
fingerprinting storage standards, and once those are in place,
this process should be streamlined. DSS also claims that "law
enforcement requires thumb prints" while DSS uses index finger
prints, adding another level of incompatibility. However, this
just isn't so. During booking, the police take a full set of ten
prints.
WILL AFIRM DATA BE SHARED WITH OTHER NON-LAW ENFORCEMENT AGENCIES?
San Francisco intends to share its data with Alameda County, and,
according to John Vera, DSS Assistant General Manager, "[i]f other
Bay Area counties opt in, the data base would be expanded to
include them." Some type of matching may take place with Los
Angeles County as well. Plans are underway to extend the system to
other welfare programs (see below). DSS had made ambiguous
statements about who they would be willing to share the data with,
meaning that no clear policy has been set.(10) Widespread sharing
of data leads to the possibility of the data taking on a certain
life of its own, and any control of the data eventually is lost.
WILL AFIRM INTIMIDATE PEOPLE FROM GETTING ASSISTANCE TO WHICH THEY
ARE ENTITLED?
The figures from LA County and Alameda County would indicate that
yes, people are deterred from benefits to which they are entitled.
Regardless of its unfortunate extension to other areas,
fingerprinting historically has been a law enforcement technology,
and this is a common public perception. With welfare agencies'
emphasis on fraud detection, the boundary between law enforcement
and social services has blurred. The choice of fingerprinting
technology to verify identity further blurs that boundary between
law enforcement and social service.
In other areas, fingerprinting has been rejected, precisely
because of the aura of law enforcement around it. Last year, for
example, the _Wall Street Journal_ reported that airport
officials, looking for a way to speed people through immigration
at Kennedy Airport, decided _not_ to use fingerprinting technology
to match people with their passports. "We didn't want to get into
fingerprints because of law enforcement connotations," said
Richard Norton, the Air Transport Association's senior director of
facilitation.
The law enforcement aura surrounding fingerprinting, when combined
with the public perception of computers as infallible search
engines capable of retrieving any data about a person, can create
an intimidating presence. When one adds into the mix that a high
percentage of GA recipients are mentally ill and/or substance
abusers, then the possibility of intimidation increases, whether
rightly or wrongly, from any number of fears: of the police, of
computers, of public exposure, etc.(11)
DOESN'T THE DEPARTMENT OF MOTOR VEHICLES REQUIRE FINGERPRINTS?
DMV began requiring digital fingerprints in 1991. The purpose of
this program is to ensure that the person renewing a license is
the same person who originally applied for the license. As such,
DMV claims it is a personal protection, in case one's license is
lost or stolen.(12) DMV fingerprint data is not routinely matched
against other fingerprint data. While similar privacy concerns
have been raised of DMV's collection of fingerprint data, it's
current use is relatively benign and of a restricted nature.
Because, legally speaking, driving is a "privilege," and welfare
is a matter of survival, requiring fingerprints of welfare
recipients should be held to a higher test of need.
DO ALTERNATIVES TO ELECTRONIC FINGERPRINTING EXIST?
Alternatives do exist for recording unique information about a
person, for the purpose of verifying identity or verifying
uniqueness. Technology exists to scan the bone structure of a
hand, or the vein patterns on the back of the hand, both of which
are as unique as fingerprints, but have no possibility of tying-in
with law enforcement fingerprint systems.
WILL AFIRM BE EXTENDED TO OTHER FORMS OF AID?
Los Angeles County plans to begin a pilot program on June 1 to
extend use of the AFIRM system to Aid to Families with Dependent
Children (AFDC) recipients in LA County. The $21 million program
will quadruple the number of fingerprints stored on the Los
Angeles system, from about 100,000 to 400,000. Alameda County is
rumored to be considering extending the program to AFDC as well.
San Francisco's DSS may also be discussing future expansion to
other forms of aid. After the system extends to AFDC, it is
conceivable that AFIRM will be extended to food stamps. If the
problem can be as large as DSS can imagine it, where will
fingerprinting stop? Will DSS require children to be fingerprinted
as well? And how long will their fingerprints remain on the
system?
Jim Davis
Western Regional Director
Computer Professionals for Social Responsibility
P.O. Box 717
Palo Alto, CA 94302
Local contact information:
414 Chestnut Street,
San Francisco, CA 94133
(415) 398-2818
jdav@well.sf.ca.us
[Computer Professionals for Social Responsibility is a national
public-interest alliance of computer scientists, engineers, users
and others interested in the impact of computer technology on
society. We work to influence decisions regarding the development
and use of computers because those decisions have far-reaching
consequences and reflect basic values and priorities. CPSR has 500
members in the Bay Area.]
-------------------------------
FOOTNOTES
1. EDS was founded by H. Ross Perot in 1962. General Motors bought
EDS in 1984 for $2.55 billion in cash and stock. Probably the
largest computer services company in the world, EDS had sales $8.2
billion in 1992. About 10 percent of EDS's revenues come from
government contracts. EDS is also one of the world's largest
private operators of data processing centers, operating 110 sites
in North America, Europe and Asia in 1991. The rise in computer
operations "outsourcing," where companies and government agencies
contract with outside companies like EDS to handle their computer
and data processing needs has fueled EDS's tremendous growth over
the past 10 years. "The rapid growth of EDS and its biggest
competitors raises the intriguing question of how much of the
nation's computing capacity will one day end up in the hands of a
few computer services giants." (_New York Times_, October 30,
1991.)
2. Details about the AFIRM System are from a conversation with
Curtis Williams, Project Director for EDS in Los Angeles, and from
the "AFIRM Fact Sheet," provided by the Los Angeles County
Department of Public Social Services.
3. "County Welfare Recipients Prints Taken", _Los Angeles Times_.
October 12, 1991.
4. Figures for LA County's General Relief program (their
equivalent to San Francisco's General Assistance) were provided by
the LA County DPSS Computer Services Division.
5. From May, 1992 to April, 1993, DSS received on average about
2,800 GA applications a month. That approximates LA's number of GA
applications as a percentage of total caseload (around 17 - 20%).
Either multiplying the .34% figure from LA's experience by the
number of new San Francisco GA cases, or taking the relative size
of San Francisco's caseload (15% of LA's) and multiplying it by
the number of matches and refusals LA had, the results are about
the same.
6. Alameda County data is taken from Alameda County Social
Services Agency press releases, and information provided by Luanne
DeWitt, public information officer with Alameda's SSA.
7. Letter from Cahill to Mayor Frank Jordan, March 31, 1993.
8. Memo from John Vera, Assistant General Manager of DSS, to the
San Francisco Social Services Commission, May 12, 1993.
9. LA has denied 434 cases over the 21 month period from June,
1991 to March, 1993 (about 21 cases a month). Assuming someone
would receive benefits of $350 per month for a year: 21 cases per
month * $350/month GA benefit * 12 months = $88,200/month
"savings" vs. $9.4 million system cost/5 years = $156,666/month
cost. The actual system cost may be higher, and the actual GA
benefit is a bit lower.
10. At the May 13 Social Services Commission meeting, Vera said
that DSS would "share its data with anyone who shared their data
with DSS." This could conceivably include welfare agencies in
other states, or other state agencies.
11. "Privacy in Peril: How computers are making private life a
thing of the past", a special report in the July, 1993 issue of
_Macworld_ magazine is a very good summary of computers and
privacy issues.
12. From a conversation with Bill Madison of DMV.