Congress To Restrict Social Security Number Use 280
diverge_s writes "News.com.com has an article detailing a long overdue attempt Congress is making to restrict the use of Social Security Numbers. From the article: 'In both the House and the Senate, there are at least three pieces of pending legislation that propose different approaches to restricting the use and sale of SSNs. Politicians have expressed astonishment at what they see as a rising identity fraud problem, frequently pointing to a 2003 Federal Trade Commission survey that estimated nearly 10 million consumers are hit by such intrusions each year.'"
Band-aid on a gunshot wound. (Score:5, Insightful)
All the proposals mentioned in the article are merely band-aids on a system that is fundamentally broken. Any competently designed identification system consists of two parts: the public identifier, and the private key. The problem with SSNs is that you have a system where one number is simultaneously the public and private parts of the system, which dooms it to failure every time.
Making new rules limiting the sale and purchase of SSNs, or restricting the display of SSNs on reports, is just closing the barn door after the hore has already left.
shared secret (Score:5, Insightful)
This law wants to prop up this model.
THIS IS A STUPID MODEL.
There are much better ways of establishing identity than using the SSN.
What we need to do is STOP USING SSN TO ESTABLISH IDENTITY!!!
Then it can be public, you can post it wherever you want, and we won't have to deal with the impossible problem of putting the cat back in the bag.
Government issued smartcards, with a simple PKI (and revocation system) would be a perfect method for establishing identity. We need to put the money in to that, not trying to keep some unchangable number secret.
They will fix this... (Score:3, Insightful)
It's About Time (Score:3, Insightful)
Now, what sort of evil riders will be attached?
Repeat after me... (Score:4, Insightful)
I wonder why more companies/organizations don't realize this, and any step to educate them is a step in the right direction.
Re:Band-aid on a gunshot wound. (Score:5, Insightful)
From the article: The SSN hasn't always had such broad applications. Back in 1935, Congress first directed the Social Security Administration to develop an accounting system to track payments to the fund. Out of that mandate came a unique identifier that has ultimately found applications in everything from issuing food stamps to tracking down money launderers.
This is what happens in the modern age, when previous devices are outstripped by new uses for them. The SSN number started out as simply an identifier for the purposes of calculating benefits and recording taxes. It has turned into a universal identifier, but has not fundamentally changed at all. It's very easy to forge a Social Security card, and the accessibility of SSN data tied to all sorts of other information makes it far too easy to compromise.
As an aside, other than the fact it doesn't contain a photo, the SS card is pretty much a national id card.
Restriction already exists (Score:2, Insightful)
Improper used of this card and/or number by the number holder or any other person is punishable by fine, imprisonment or both.
The only proper use is for access to the social security funds. Which does not include identification for getting a minimart discount card. People at the minimart have no need and no right to the ssn. Unless of course you're employed there.
Re:Sounds like an election year idea to me (Score:3, Insightful)
Anyone want to give odds this legislation gets forgotten after elections?
Just in the nick of time (Score:5, Insightful)
Wait... What's this printed on the back of my Social Security card? "Not to be used for identification purposes."
Having been the victim of identity theft and credit card fraud, I have to say this is probably too little too late. I've had over $20,000 in fraudulent charges made in my name -- items ranging from electronic equipment to beer and gasoline. The Social Security number is already the de facto citizen identification number, even if it is not de jure.
Some culpability lies in the lap of merchant businesses, as well. In one case, a company sent a credit card application issued in my name to an old address. The occupant filled it out and began making purchases. When the bill came due, the collections agency had no problem tracking me down to give notice. In my opinion, this merchant could have been more dilligent, because I had asked them to cancel my account years before this happened. They were certainly dilligent when it came to getting paid.
Election year politics (Score:3, Insightful)
Well, then *REALLY* limit the SS#'s use (Score:3, Insightful)
When someone asks me for the last 4 digits of my SS#, I ask them to use another secrity key. if they can't, I don't do business with them.
Post SSNs of Congress and the Bush Administration (Score:2, Insightful)
Re:Band-aid on a gunshot wound. (Score:3, Insightful)
Good point. The Government has had problems convincing Older Americans to use direct deposit for Social Security Benefits and the current Medicare system is not exactly been easy for them either. I was trying to come up with something a little more secure than a PIN while steering clear of biometrics since they cannot be changed (or someone may be missing that body part, etc). Of course, a change like this would take more investigating and planning since I'm sure there are other holes/problems that I did not think of which would need to be addressed.
I'm just trying to think of something that could work without requiring a National ID card or any other sort of token that could be lost or stolen.
Queen B's Privacy Law (Score:3, Insightful)
Here's what an ideal law looks like:
1) All data collected belongs to the individual that it pertains to, not to the harvester of the data.
2) No data can be released to any entity but appropriate law enforcement with a valid search warrant without the express permission of the subject.
3) Social security numbers shall not be used by any entity but the social security administration, the IRS, or the US Military. If you are not an official representative of the social security administration, IRS or US Military acting in an official capacity which requires you to request the social security number of an individual, asking someone to provide a social security number shall be a felony punishable by no less than a 10 year mandatory jail sentence and $100,000 fine per incident.
4) Use of another person's social security number shall be a felony with no less than a mandatory 10 year jail sentence. Knowingly allowing someone to use your social security number shall be a felony with no less than a 20 year mandatory jail sentence and a fine no less than $100,000 per instance. Bankruptcy shall not clear this fine. Payment in full is the only method of disposal for this debt.
5) Any entity holding information on an individual must make every attempt available using whatever means is available (phone, fax, mail, or email) to contact that person. The notification must consist of an explicit listing of all the information on hand, an explanation of what the information is being used for and a means to correct any information that is in error. If the information is to be used, the entity must ask for and obtain the individual's permission to continue to use it. If permission to continue using information is not forth coming in a period sixty (60) days, the information pertaining must be purged from all records and data.
6) Credit reporting bureaus will henceforth assign an internal ID # beginning with the name of the company for use in tracking various customers. For example, your credit record ID at Experian will begin with Experian. (This will let consumers know who is holding the data).
7) If you hold data on an individual that you are unable to reach in order to obtain permission, you may contact the credit bureaus to see if they have a listing for that indivdual and can send a letter. You are still in the same sixty (60) day window listed above.
8) Failure to purge the data or continued use of the data after the 60 day expiration shall be deemed a felony punishable by $100,000 fine per incident and 10 year minimum mandatory jail sentence per incident.
9) Releasing data without the express permission of the individual in question shall be deemed a felony punishable by $100,000 fine per incident and 10 year minimum mandatory jail sentence per incident.
10) If you are an illegal immigrant using someone else's SSN, your government will be billed for all costs associated with your arrest, prosecution, trial, imprisonment, and deportation.
11) Knowingly hiring an individual who is using a falsified social security number (i.e. one that has not been issued to that individual by the Social Security Administration) shall be a felony with a 10 year mandatory jail sentence and minimum fine of $100,000 per incident.
I think that makes a rather nice start.
Just my 2 cents,
Queen B.
SSN's....Too Late (Score:2, Insightful)
Comment removed (Score:4, Insightful)