March 21, 2008: Reporter Finds Passport Files Contain Wealth of Personal Information

A typical US passport. [Source: MSNBC]Reporter Jaikumar Vijayan explores the kind of information contained in passport files, in the wake of reports that Democratic presidential frontrunner Barack Obama’s passport files were repeatedly breached (see March 20, 2008). All passport records are maintained in a classified records system in the State Department’s Passport Services annex in Washington, DC.
Extent of Information - Passport files are protected by the Privacy Act of 1974, and contain all the information supplied on passport applications, including Social Security numbers, date and place of birth, family status, occupation, and physical characteristics. They do not, as has been widely reported, contain evidence of travel such as exit and entrance stamps, visas, or residence permits. The files also include investigative reports compiled as a part of the granting or denial of a passport, criminal records related to passports, court documents and administrative determinations related to passports and citizenship, copies of birth and baptismal certificates, medical, personal, and financial reports, and details of arrest warrants that may have been issued.
Origin of Information - The information comes from the applicants themselves as well as law enforcement agencies, investigative and intelligence sources, and officials of foreign governments.
Access to Information - The information is used not only by the State Department, the IRS, foreign governments, federal, state, and local authorities, attorneys representing a client in a passport case, and in some instances, members of Congress. Only State Department employees (or their contractors) who have valid identification cards and who have passed background checks may access the passport information database, and then only with passwords issued to them by their supervisors.
Access Logged - All access to the database is logged in a computer system, and potentially unauthorized or inappropriate access is flagged and brought to the attention of a supervisor. [Computerworld, 3/21/2008]