The statistics on identity theft are enough to scare anyone, so it's mystifying why progress in the battle against this crime seems to creep at a snail's pace.

The nonprofit Identity Theft Resource Center tracked 158 incidents of large data breaches at companies, universities and government organizations. The 2006 tally, still being compiled, stood at 192 cases through October.

In 2005, the theft of consumer files from the database giant ChoicePoint Inc. became national news, but nearly two years later, much of the legislation aimed at fixing some of these issues remains in limbo. Perhaps if the dollars-and-cents losses struck an immediate blow rather than lurking as a looming threat, people would whip up a more burning sense of urgency.

Last week, an episode in Hawai'i shifted the issue back to the front burner for state lawmakers. Personal data of 11,500 families enrolled in a program for low-income women and children were put at risk after a Health Department employee allegedly stole information from a client database.

Certainly, all thefts can't be prevented, but it's the information that agencies willingly releases that's most disturbing. The public shouldn't tolerate government negligence in security.

Across the country, municipal, county and state agencies have posted traffic tickets and other public records containing private information on the Web, valuable data for anyone to harvest.

Similar problems have not surfaced here — yet — but the sieve is porous enough, and the work of insulating data from theft has just begun.

One new Hawai'i law enables ID theft victims to freeze their consumer credit reports to prevent further exploitation. Another requires government and businesses to notify people if their confidential personal information is disclosed without authorization (a federal version of this law has been introduced in Congress).

A third law requires businesses and government to "take reasonable measures" when disposing of records containing personal information. In July, the fourth measure, restrictions on the release of Social Security numbers by businesses and government, goes into effect.

That's a good start, but there's much more to do. For example: Alternatives to Social Security numbers should be found as identification keys.

Secondly: Consumer protection officials here rightly point out that there's no central database in Hawai'i for all ID theft, and no consistency about when an ID theft is logged. For example, a stolen credit card might be recorded as identity theft, or it might not.

And this session, lawmakers likely will consider proposals to stiffen sentences for thieves who prey on the elderly, including ID thieves.

Other legislation is in the D.C. pipeline. U.S. Sen. Dianne Feinstein (D-Calif.), who sponsored the bill requiring notification of ID theft, also has proposed a limitation on the use of Social Security numbers.

And this is an issue without a partisan divide. The Bush administration formed a task force on ID theft, now working on a strategic plan. The panel's interim recommendation is already out, however, including the development of a common police report procedure for all ID theft victims, which could help improve consistency locally.

There's so much ground to cover in the campaign against identity theft, that the victims — that's all of us — need to keep the heat on.

Our local and federal governments need to be leaders in the charge to eliminate the problem, and not the worst offenders.