Federal agencies are not doing enough to protect citizens from identity theft, according to a report by the U.S. Government Accountability Office (GAO), the investigative arm of Congress.