Slashdot Mirror
Congress To Restrict Social Security Number Use
diverge_s writes "News.com.com has an article detailing a long overdue attempt Congress is making to restrict the use of Social Security Numbers. From the article: 'In both the House and the Senate, there are at least three pieces of pending legislation that propose different approaches to restricting the use and sale of SSNs. Politicians have expressed astonishment at what they see as a rising identity fraud problem, frequently pointing to a 2003 Federal Trade Commission survey that estimated nearly 10 million consumers are hit by such intrusions each year.'"
All the proposals mentioned in the article are merely band-aids on a system that is fundamentally broken. Any competently designed identification system consists of two parts: the public identifier, and the private key. The problem with SSNs is that you have a system where one number is simultaneously the public and private parts of the system, which dooms it to failure every time.
Making new rules limiting the sale and purchase of SSNs, or restricting the display of SSNs on reports, is just closing the barn door after the hore has already left.
____
~ |rip/\/\aster /\/\onkey
Many companies and government organizations use the SSN as some kind of shared secret for the purposes of establishing identity.
This law wants to prop up this model.
THIS IS A STUPID MODEL.
There are much better ways of establishing identity than using the SSN.
What we need to do is STOP USING SSN TO ESTABLISH IDENTITY!!!
Then it can be public, you can post it wherever you want, and we won't have to deal with the impossible problem of putting the cat back in the bag.
Government issued smartcards, with a simple PKI (and revocation system) would be a perfect method for establishing identity. We need to put the money in to that, not trying to keep some unchangable number secret.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
I was once reprimanded by an employer for standing my ground on the fact that a badgenumber+SSN was not a good idea for a login id. grumble grumble. I left the place soon after and have never listed it on my resume.
meh
...by requiring the use of a RealID number instead of an SS#. This is how they will force RealID down everyone's throat.
Go read the article. The proposed legislation sounds reasonable. It should have been done years ago.
Now, what sort of evil riders will be attached?
The obscure we see eventually. The completely obvious, it seems, takes longer. - Edward R. Murrow
I wonder why more companies/organizations don't realize this, and any step to educate them is a step in the right direction.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
Politicians have expressed astonishment at what they see as a rising identity fraud problem
You don't say. It took them long enough. Apparently MySpace is a bigger threat to consumers these days - after all, identity theft has been around longer than SNSs. Give me a break.
So far everything Congress is talking about is as effective as trying to put the toothpaste back in the tube.
I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
The restriction already exists. If you read the back of your card it says:
Improper used of this card and/or number by the number holder or any other person is punishable by fine, imprisonment or both.
The only proper use is for access to the social security funds. Which does not include identification for getting a minimart discount card. People at the minimart have no need and no right to the ssn. Unless of course you're employed there.
078-05-1120
It's a specimen number from the Eisenhower era. No need to give ur correct number to the cable or phone company. They don't need it. Period. Of course it's possible that someone else has used this number already, especialy if you live near me in upstate NY.
Otherwise use the "Fletch" approach on things like your customer loyalty cards. I keep mine under Harry S Truman, Ted Nugent and John Cocktosen. I have started using Igor Stravinsky lately.
Anyone want to give odds this legislation gets passed after elections?
Anyone want to give odds this legislation gets forgotten after elections?
Comment removed based on user account deletion
*NOT*
Wait... What's this printed on the back of my Social Security card? "Not to be used for identification purposes."
Having been the victim of identity theft and credit card fraud, I have to say this is probably too little too late. I've had over $20,000 in fraudulent charges made in my name -- items ranging from electronic equipment to beer and gasoline. The Social Security number is already the de facto citizen identification number, even if it is not de jure.
Some culpability lies in the lap of merchant businesses, as well. In one case, a company sent a credit card application issued in my name to an old address. The occupant filled it out and began making purchases. When the bill came due, the collections agency had no problem tracking me down to give notice. In my opinion, this merchant could have been more dilligent, because I had asked them to cancel my account years before this happened. They were certainly dilligent when it came to getting paid.
What, they haven't started this already ?
I just pulled out my teeth.
...right on the card. Just what is there about "Not for purposes of identification" that is hard for officials to understand?
Of course, when I was in the hospital emergency room and I said I didn't want to give them my social security number, they said they would treat me until I did. I backed down.
When I contacted the social security administration about this, and said "Am I required to give anybody but the government my SSN," their rather unhelpful reply was "No, you're not required to, but the hospital is not required to treat you without it."
"How to Do Nothing," kids activities, back in print!
Much of the debate on the 1974 Privacy Act revolved around the fact that the SSN was NOT to be used as a universal identifier. Paragraph 7 (if my memory serves) restricted the use of SSNs to those things either grandfathered (allowed by federal, state, or local law) before 1974 or explicitly named and allowed in a federal law; and in either case including a requirement that the requestor tell you the basis for the request. (Note that folks blanketly refusing to give the SSN are usually not on strong legal ground. Much better is to refuse until the requestor provides the legal basis for the request as provided for in the Privacy Act. IANAL etc...).
The loophole was that this act only restricted government not the private sector. Thus banks, insurance companies, universities, employers, local pizza joints, all ask for the SSN and can refuse service unless you provide it.
It would be a good start to debate if we could base a new law on the existing historical basis for the limitations in the 1974 privacy act, and then extend those restrictions to ALL use of the SSN by anyone.
Why TF are SSN's used to AUTHENTICATE a person's identity? A SSN should just be used for REFERENCE.
Or am I wrong?
They just don't care because the current system minimizes their financial losses by transfering those losses to the individual who has his/her identity "stolen".
Making any changes would cost money which reduces profits.
Any changes that improved the situation could be used to find them responsible when/if their new system is defrauded.
So, fixing the system is, from the individual company's point of view, all loss and no gain.
I take everything anyone (elected) says with a grain of salt at this point, because elections are looming just a few short months away. Because, as others have suggested, long since become a very real problem, any attempt to solve it (at least by the methods outlined in the article), are mere sprints along the PR highway. To go the distance will require some fundamental changes, few of which may be amenable to entrenched interests (Big Business, Inc.)
Unless they are providing some other way to authenticate people when they sign up for a service this doesn't seem to me like it will do much.
You mean something like "assign a pseudorandom 20-digit account number"? Yeah, real challenge there
After all, who wants to pay your taxes?
The problem here directly relates to that answer - No one.
You should ONLY ever need to give your SS# for the purpose of reporting taxable income to the SSA. Period. End of valid reasons.
You should not need it on your driver's license, you should not need it on non-interest-bearing financial accounts such as credit cards or most checking accounts. You should not need to give it to the phone, cable, gas, and electric companies. You shouldn't even need to give it to the town/city or possibly even the state (though, as far as the state goes, since the IRS disgustingly considers the state giving me back the excess of my withheld taxes as "income", they've done a definitional end-run around that exception). You shouldn't need to give it to your university if you don't receive any fincial aid. You shouldn't need to give it to your insurance company, since they only reimburse you for losses. You shouldn't need to give it to your doctor or pharmacist. You shouldn't need it on your marriage license (though again, we have a definitional end-run by the government for that one, by having special tax rules for married couples).
Personally, I find it telling that politicians "expressed astonishment" that every company and their dog asks for your SS#. How the hell do these guys live in the modern world? Do they actually have servant even for such rare tasks as signing up for a new long distance carrier or ISP? And can someone even legally let a servant sign up for credit cards or mortgages?
We need these assclowns out of office ASAP, and a maximum allowable income and assets cap for any future officeholders. Have over half a million in capital or make over 100k per year? See ya.
And NO... MORE... LAWYERS!
The only people who need your SS# is your employer because they have to make the contributions. Your bank doesn't need it - they, as well as your mortgage company , broker, etc., can use a Taxpayer ID # to create 1099s and such for the IRS. And health insurance companies have no shittin' business with your SS#, not to mentiion the galactic stupidity of putting it right on your ID card.
When someone asks me for the last 4 digits of my SS#, I ask them to use another secrity key. if they can't, I don't do business with them.
Research shows that 67% of those who use the term "research shows", are just making shit up.
Are they going to make it illegal, in the sense of large scale corporate fraud, where the perpetrator gets to keep his mansions and private islands and billions of dollars and so on? Or are they going to make it illegal in the sense of getting caught with a gram of marijuana where the perpetrator does a career of hard time behind bars with forced labor, and loses basic rights of citizenship for life?
-fb Everything not expressly forbidden is now mandatory.
I wonder if action would be quicker if somebody posted on a free website the SSN's and other personal information of congress members and the Bush administration, and their families.
But my father pointed out that years ago, you didn't need a social security card until you first got a job. Now, in order to claim your children on taxes, you have to get them a social security number.
Over here(Ireland), we used to have an RSI (Revenue and Social Insurance) number. Basically a fraternal twin of the social security number. Well not any more pal! These got "upgraded" to a PPS(Personal Public Service) number. You get them from birth and you need them for everything . If you do not have, or like me, constantly forget your number, you cannot apply for anything. Without this number, you do not exist.
Basically, it's your Number. The unique ID that indexes your name in the Government's databases. That is, if the Government has a database. Things are still a little behind the times over here.
Anyway my point is that this overtly and officially does what your SSN unofficially does, i.e. replaces your name as your most important indentification. For everything. Private companies ask me for this all the time, and probably have complete access to any verification database to check up on it. Who am I kidding. In this country, private companies probably have write access to the database.
To bring things heavily ontopic, no one, no one I know cares about this. "A shure, what's wrong with it?... Will you go 'way from me with your 'privacy'. What do you have to be private about, What?" is the typical, nay, universal response. Never mind that this country used to be a theocracy, one party state and under foreign rule not so long ago.
Admittedly, the odds of a dictatorship are extremely low, but I can tell you that there is an extreme level of corruption here. Most importantly, the police here are highly unaccountable and frequently unscrupulous. There are many well documented incidents of railroading amoung other things. How does the PPS number mix into all this? I'm not too sure, but I don't like the idea of it.
I don't think the issue is one of privacy. I think it's one of independance. Freedom in a sense. I should be able to be who I am, say who I am, without needing any official papers from the state. why should they have the right to grant and revoke some number or tag that in effect becomes my name? As a citizen, I should have the right to live my life free from interaction with the government, not bound to its whim by beaurcracy.
Consider the plight of people in China, who need papers to move from provence to provence. How dare the government tell them where they can and cannot live in their own country. My fear is that PPS and SSN may lead to a similar situation. You will need the governments approval, via a valid, unsuspect number, to do just about anything. Need to open a bank account. Sorry, your PPS came up red. Need to fly interstate? Sorry your SSN is on the do not fly list.
Try and tell this to anyone over here and they'll just give you funny looks. I'm one of the few people that disagreed with electronic voting, and I can tell you that was a struggle. So I'm not even going to waste my time going on about PPS numbers outside of this post.
May the Maths Be with you!
Data is a big business in this country. Buying and selling data on consumers is a multi-billion dollar industry. As such, they have huge lobbies in Congress to make sure that there aren't any laws passed that will have any impact on their precious profit margins.
Here's what an ideal law looks like:
1) All data collected belongs to the individual that it pertains to, not to the harvester of the data.
2) No data can be released to any entity but appropriate law enforcement with a valid search warrant without the express permission of the subject.
3) Social security numbers shall not be used by any entity but the social security administration, the IRS, or the US Military. If you are not an official representative of the social security administration, IRS or US Military acting in an official capacity which requires you to request the social security number of an individual, asking someone to provide a social security number shall be a felony punishable by no less than a 10 year mandatory jail sentence and $100,000 fine per incident.
4) Use of another person's social security number shall be a felony with no less than a mandatory 10 year jail sentence. Knowingly allowing someone to use your social security number shall be a felony with no less than a 20 year mandatory jail sentence and a fine no less than $100,000 per instance. Bankruptcy shall not clear this fine. Payment in full is the only method of disposal for this debt.
5) Any entity holding information on an individual must make every attempt available using whatever means is available (phone, fax, mail, or email) to contact that person. The notification must consist of an explicit listing of all the information on hand, an explanation of what the information is being used for and a means to correct any information that is in error. If the information is to be used, the entity must ask for and obtain the individual's permission to continue to use it. If permission to continue using information is not forth coming in a period sixty (60) days, the information pertaining must be purged from all records and data.
6) Credit reporting bureaus will henceforth assign an internal ID # beginning with the name of the company for use in tracking various customers. For example, your credit record ID at Experian will begin with Experian. (This will let consumers know who is holding the data).
7) If you hold data on an individual that you are unable to reach in order to obtain permission, you may contact the credit bureaus to see if they have a listing for that indivdual and can send a letter. You are still in the same sixty (60) day window listed above.
8) Failure to purge the data or continued use of the data after the 60 day expiration shall be deemed a felony punishable by $100,000 fine per incident and 10 year minimum mandatory jail sentence per incident.
9) Releasing data without the express permission of the individual in question shall be deemed a felony punishable by $100,000 fine per incident and 10 year minimum mandatory jail sentence per incident.
10) If you are an illegal immigrant using someone else's SSN, your government will be billed for all costs associated with your arrest, prosecution, trial, imprisonment, and deportation.
11) Knowingly hiring an individual who is using a falsified social security number (i.e. one that has not been issued to that individual by the Social Security Administration) shall be a felony with a 10 year mandatory jail sentence and minimum fine of $100,000 per incident.
I think that makes a rather nice start.
Just my 2 cents,
Queen B.
HDGary secures my bank
It's too late to start enforcing the us of SSN's, because they are already in place as an identification number, just like they told our parents and grandparents that they were NOT going to be used for. The national ID card could be used to solve this issue easily. For one, you could scrap the social security number as the main form of identification, and use it was it was meant for, Social Security benifit contributions. They screwed this system up years ago by giving every breathing thing that walked across the border, a SSN. By issuing a new card with a NEW number, and these cards are only issued to those that show PROOF of citizenship (Birth Certificat, Naturalization Papers), you convert all credit, medical, and employment info onto this new number. No number? No employment, no credit, no benifits, no STATE drivers license. And while you are at it, make it available as a passport also. The Department of State should handle this and is more then capable of it. If used in conjunction with the "fair" tax national sales tax...it would be a double pronged threat to illegals. For one, you couldn't receive your rebate check, and you now have to pay taxes on the benifits you use, the system becomes self sustaining. It's NOT that hard. The solutions are out there. These idiots in Washington are NOT doing their job. http://www.send-a-brick.com/
Now, in order to claim your children on taxes, you have to get them a social security number.
Not only that, but with my youngest kids, the paperwork to request and issue an SSN was processed by the hospital. We were told that if we didn't sign the request form, we wouldn't be allowed to take our child home. I didn't buy that, of course, but signed the form because I knew we'd need the number anyway. I'm sure that if you forced the issue, you could take your baby home without getting an SSN, but I doubt anyone does.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
They're changing. The Buckley Amendment (the law you refer to) stipulates no use of SSN for non tax purposes if you receive federal money (IIRC). Most universities are changing because of identity theft from food court receipts and the fact that they can probably be successfully sued under the law.
I suppose this law would cover the people who *don't* receive federal funds... like businesses.
At the state school everything was all about the SSN. One every test, you had to put your SSN...
In the early 1990s a group of students took Rutgers to court regarding SSN use as the student identifier. They won in federal court, and that case was considered precedence in this field. (Not to mention kinna cool because it was just a bunch of students going at the university pro se.)
That case specifically enumerated
*prohibitions using all or part of the SSN as an identifier on tests or assignments
*prohibitions using all or part of the SSN as an identifier en masse (such as posting grades by last four digits)
*prohibitions regarding using all or part of the SSN as an identifier on student ID cards
Universities damn well know of the Krebs v. Rutgers prohibitions but they have taken their time in implimenting them. Hell, even my university broke/still breaks the Privacy Act of 1974, by not disclosing how the SSN will be used and if its necessary to disclose, when applying for admission.