to find ways around that. So businesses need to be constantly alert to adjust the precautions that they take in order to deal with new and emerging threats and adjust their plans accordingly.

When we see a breach, and particularly if it is a credit bureau, it is something we are very interested in as to whether there may have been a law violation in that particular case or a violation of our rule. We work with other law enforcement authorities and determine, you know, who can best take appropriate action in any particular case.

Senator DOLE. Agent Caddigan, could you just give us an idea of the percentage of identity theft cases that are perpetrated from outside the country over the Internet?

Mr. CADDIGAN. I don't know that I can give an accurate percentage. I can say that we see more and more case examples of where we have traced the origin of the crime to overseas sources, all four corners. I cannot pick a country or a sector. But we do see a tremendous rise in Internet hacking activity that leads us overseas. Senator DOLE. Thank you. I believe that my time has expired, Mr. Chairman.

Chairman SHELBY. Senator Sarbanes.

Senator SARBANES. Gentlemen, we are pleased to have you here. I really want to get beyond where we are, telling about the problem and how it is expanding and all that, and find out what we can do about it. It seems to me the burden is on the two of you and your respective agencies to give us a list of things. I am going to ask you for that in a moment, but I want to run through some questions with you first.

Do you think a consumer getting their credit report is helpful in checking identity theft? Is that a helpful, preventive technique? Mr. CADDIGAN. Yes, sir, I do.

Senator SARBANES. Some States now require that the consumer get a free report, right?

Mr. CADDIGAN. Yes, sir.

Senator SARBANES. What would be the problem if the Federal law required everyone would be able to get a free report if they requested it?

Mr. CADDIGAN. From an enforcement perspective, I do not see a problem.

Senator SARBANES. Wouldn't that be a pretty common-sense thing to do?

Mr. CADDIGAN. Correct.

Senator SARBANES. Now it puts a little extra burden on the agencies, but it seems to me if we are going to be serious about doing something like this, that is a common-sense thing to do. Georgia actually, I think, is the one State that requires that you can get two free reports in a year. In a number of other States, including my own, you can get one every year. But we have left it to the States to do it. They want preemption from State law on the Federal credit reporting which we are now considering. We need some standards if we are going to preempt from the Federal level. It seems to me an obvious standard, just as a starter, would be a free credit report. Do you disagree with that?

Mr. CADDIGAN. I do not, no, sir.
Senator SARBANES. Mr. Beales.

Mr. BEALES. The Commission has not taken a position on free credit reports.

Senator SARBANES. Why not?

Mr. BEALES. The staff is continuing to analyze that and a variety of other suggestions that

Senator SARBANES. We are going to push the staff hard to get some suggestions up here.

Now, let me ask another question

Chairman SHELBY. Senator Sarbanes, our staff will not need to be pushed.

Senator SARBANES. No, not our staff. Their staff.

Chairman SHELBY. That is what I meant.

[Laughter.]

Our staff will be helping us with the legislation.

Senator SARBANES. All right. Now some have suggested that the practice of mailing out preapproved credit card solicitations may increase the incidence of identity theft, and also sending out these unsolicited credit card convenience checks. Does that increase the risk of identity theft?

Mr. CADDIGAN. I think over the years we have seen a change in those type of mailings, where it used to be basically an application was sent to you completed, you signed it and sent it back. So the mail theft or the dumpster diving or that type of activity made vulnerable to identity theft.

The later documents that we see, name and address, and the focal point would be if you signed it and sent it back and changed your address, that is an automatic decline. The product itself, if handled appropriately at both ends, does not lead to potential identity crime. I think the misuse of it or the mishandling of it has potential for identity crime.

Senator SARBANES. We are going to have to look at that because we are sympathetic to expanding commerce and so forth and so on, but it may be at some point this expansion opens up vulnerabilities. And then you have to trade off the question between curtailing the vulnerabilities and perhaps losing some expansion of

commerce.

Now, I know that is going to raise a problem to those who send out these preapproved credit card solicitations or these unsolicited credit card convenience checks. But we need to look at that and see how much it is contributing to the problem, whether this is something that can be checked.

There is a notion here that any technique can be used to kind of draw the consumer in, and then if they become a victim of identity theft, it is kind of, well, it is too bad for the consumer and maybe some way we will catch up with it or somehow or other and things will get corrected. But we may need to take steps up front to reduce the exposure to the identity theft happening.

Now let me ask you this question. A May 2003 survey conducted by the Harris Interactive Service Bureau of employees and managers with access to sensitive customer information-this raises a problem that I think is very difficult to deal with-shows that 66 percent say their coworkers, not hackers, pose the greatest risk to consumer privacy. The Washington Post had an article, "Identity

Theft More Often an Inside Job," and they are raising the question that it comes from insiders. What is your view of that?

Mr. CADDIGAN. I would agree wholeheartedly. The insider is the greatest threat to business today. One of the things that the Secret Service has undertaken over the last year, year and a half, is an insider threat study. We have gone to businesses, we have gone to financial institutions, we have gone to victims of that type activity in order to determine whether we can develop indicators to try to prevent that.

At the same time, we are working with those private sector enterprises and helping them design safeguards to their system that can better secure against the insider threat. So, I would agree wholeheartedly that that is a major problem in business today, the safeguard of that personal information from business to business, and there are no standards.

Senator SARBANES. Do you have proposals or suggestions that you make to businesses of measures they could take to guard against this. Is that right?

Mr. CADDIGAN. That is correct.

Senator SARBANES. And you seek their cooperation to do that on a voluntary basis.

Mr. CADDIGAN. That is correct.

Senator SARBANES. Is that right?

Mr. CADDIGAN. Yes, sir.

Senator SARBANES. If the measures have been carefully vetted and thought through, and if it is the judgment of law enforcement and other objective people that these measures would be effective, should not thought be given to requiring that these measures be taken?

Mr. BEALES. Senator, if the business is a financial institution, under Gramm-Leach-Bliley there is a requirement that they take security steps, either under FTC rules or under the corresponding

Senator SARBANES. Do you have rules that would implement what Mr. Caddigan just told me he is trying to get them to do voluntarily on this issue?

Mr. BEALES. Our rule requires a process rather than specific approaches. The rule requires businesses to identify the risks they face and take appropriate steps to reduce those risks. The risks are different for different companies and in different circumstances. Senator SARBANES. We have to get at this problem. Mr. BEALES. I agree completely.

Senator SARBANES. We have to get at this problem. We cannot continue to pussyfoot around with it. And there is an opportunity here, as we shape this legislation, I think at least, to do something about this identity theft-this is ruining the lives of a fair number of people across the country. And it is a matter of growing concern in the public's mind.

You are on the battlefront. We need to hear from you. Let's go beyond the great divide and hear from you about things that you think should be done, requirements that we can put into the law. Otherwise, one of the pressures that will come up from the State level and the consumers not to extend this legislation and the preemption will be the argument that this issue is not being

addressed, and if you would just let us get at it, we will take measures to deal with this.

Now if you want the national system-and there are economic arguments for it that I recognize, then you have to give some thought to some national standards that bring this problem under control. And we need from you a list of possibilities. Maybe it is in your dream world, you never thought it would be possible. All of a sudden here you are, you have some Senators asking you to give us the list.

So, Mr. Chairman, I hope they will go away from here today and come back to us with some detailed suggestions in this regard. Chairman SHELBY. Senator Sarbanes, I think you are absolutely right. But I think rather than possible, I think it is probable. Senator SARBANES. Yes.

Chairman SHELBY. Senator Miller, I am going to recognize you. We would be interested in what Georgia does.

Senator MILLER. Senator Sarbanes has already stated it, and we have had that for some time.

I think I am asking the same question Senator Sarbanes was getting at, but I would phrase it this way. This is to Mr. Beales. Do you think any new legislation is needed on identity theft, or can it be handled with the current rules and regulations?

Mr. BEALES. The one piece of legislation that the Commission has taken a position on is the penalty enhancements. I think that would be appropriate and useful in attacking this problem.

We are looking, as I said, at a variety of possible proposals, and we will come back at some point with a list of possibilities that we think are good. But we are not ready to do that yet.

Senator MILLER. You are going to have to get in a hurry to get in front of this Committee. You realize that, don't you? Mr. BEALES. Yes, sir.

[Laughter.]

We actually left people behind to work on it, sir.
Senator MILLER. That is all I have.

Chairman SHELBY. Senator Sarbanes.

Senator SARBANES. I just want to make one comment about the penalty enhancement. The Commission has to get moving. The penalty enhancement is important but it is not enough, and I know there is-but I am reminded of John Coffee's statement when we were working on the securities issues, he is a Professor of Securities Law at Columbia University School of Law. And they asked him, "What about all these penalty enhancements that the Congress is doing?" He said, "Well, they are fine, but they need to do other things, preventive things in terms of the system that prevent it from happening in the first place." The penalty enhancement, the damage has been done. You are just coming along trying to punish the person and create a deterrent, and there is a certain effect from that, obviously. I do not deny, although Coffee told the story, that in 18th Century London the penalty for pickpocketing was hanging. That was the penalty. And, of course, the hangings were public in the public square, and huge crowds would assemble to see the hanging.

They caught this pickpocket, they tried him, they convicted him, and they sentenced him to hanging. So the day of the hanging,

thousands of people gathered to see the hanging of the pickpocket. And working the crowd of thousands of people were hundreds of pickpockets.

Chairman SHELBY. That is exactly right.

[Laughter.]

Senator SARBANES. So, I want to prevent it from happening in the first place.

Chairman SHELBY. Senator Sarbanes, I think you are very much on track, you and, I believe, people on both sides of the aisle here. One or two of the main objects here in the renewal of this legislation or to make it permanent, one is preemption, second is affiliate sharing. I agree with Senator Sarbanes. I think we would be derelict in our duty if we did not address the consumer problems in this bill, especially today, how to prevent and tighten up on identity theft. And I believe this Committee has already sent a message on both sides of the aisle that we are going to do this.

Mr. Beales, you mentioned the benefit of adverse action notices in making consumers aware of problems with their credit reports and possibly detecting identity theft. In light of the movement of our credit system to an automated risk-based pricing system, do consumers, all of us, still receive adverse action notices when there is negative information on their credit report? Or do they simply receive a counter-offer at a higher price of credit?

Mr. BEALES. In many instances, in the credit area, they receive a counter-offer at a higher price. Under the law, if the consumer accepts that counter-offer, there is no adverse action because the FCRA definition is coupled to the definition under the Equal Credit Opportunity Act. If the consumer rejects that counter-offer, then there is adverse action and the adverse action notice goes.

Chairman SHELBY. Okay. Do adverse action notices still effectively serve this purpose if creditors do not reject credit applicants but simply offer them credit at a higher rate? In other words, how would a consumer know to look at their credit report without the adverse action notice? They would not know, would they?

Mr. BEALES. They would not know that that was the source of the information that it was based on. I think that is right. Chairman SHELBY. That is a flaw here, is it not?

Mr. BEALES. It is a concern.

Chairman SHELBY. Wait a minute. It is a concern. It is something that should be correct, isn't it?

Mr. BEALES. Well, the difficulty-the balance of the adverse action notices

Chairman SHELBY. We will deal with the difficulties. Just say is it a concern, is it a concern, it is something that needs to be corrected?

Mr. BEALES. It is a problem, but like all problems, it has costs to fix it. And that is what the balance is.

Chairman SHELBY. We are not talking about that. We are talking about trying to prevent identity theft, trying to protect the consumer here. And you have been waffling here all morning.

Mr. BEALES. As I said, the Commission has not taken a position. I think that there is-adverse action notices have narrowed as we have moved to risk-based pricing. But, on the other hand, if you give notices too widely and in too many circumstances, then it no