Social Security Numbers Are Irreplaceable But Not Irreparable

What’s Washington’s worst-kept secret? Political jabs aside, it’s that Social Security numbers are crucially broken.

As recently as 2016, the Office of the Inspector General for the Social Security Administration estimated that it could implement changes to the Social Security system that “could save taxpayers over $3 billion.” Much of that delta is directly due to waste, fraud and abuse, and as a digital security professional, I often think about how we can prevent those latter two forces.

Here’s where I’ve landed: Yes, the SSN is fundamentally broken, and thankfully others are starting to take notice of that and gradually act. How could an archaic authentication technique consisting of a static number still be foolproof after the likes of the Equifax data breach, where millions of them were exposed? Even beyond the security implications, the Social Security Administration has frankly become a disaster of a triage unit, receiving and servicing something in the ballpark of 2 billion authentication inquiries from financial institutions, government agencies and others every year, rather than being able to focus its time and resources on applying and improving benefits. Through little fault of its own, the SSA has been paralyzed and turned into another ineffectual bureaucratic casualty.

But here’s the other integral conclusion from my musings: No, we cannot take the most obvious way out, abolish SSNs and somehow start from scratch. It’s too entrenched in our daily lives, digital identities and relationships with service providers, whether that be through applying for jobs, opening bank accounts or voting. It’s simply become too big to replace.

Thus, we have to find some suitable middle ground: a road to repairing a clearly shattered system and restoring its security and productivity. I see this as applying “Band-Aids” in a way that’s incremental enough to be practical and achievable but substantive enough to be effective and futureproofed. Much of this approach revolves around returning control of SSNs to the individuals, the citizens, the owners.

Let’s consider the real-world example of filing taxes with the IRS, which currently requires an SSN. If an SSN has been stolen or exposed through a data breach or otherwise, tax forms can be filed fraudulently on behalf of that citizen, with the refund being routed to the criminal’s pocket. Rather than dragging in the SSA, IRS, banks and law enforcement only once the defrauded party realizes it (which could be well after the fact), wouldn’t it be easier for the SSN owner to be proactively made aware that their number is being used to file taxes, then have them verify and validate whether they did or did not execute that action themselves?

The status quo in this scenario and many others is to just assume that the fraudster is checking all the proper boxes by having the correct SSN handy. That status quo is unacceptable when SSNs are not nearly as locked down as they used to be. A proposed alternative could be set up similar to two-factor authentication, which has become an industry best practice across corporate America. Why shouldn’t government services be protected by the same standard and surrounding technologies? It would certainly help restore trust in and value of the SSN, and would grant control back to the individual citizens who stand to be most impacted by malfeasance. It would also save the SSA from having to field so many authentication requests while cutting out opportunistic middlemen like the credit reporting agencies and identity theft monitoring firms that claim they can protect citizens’ personally identifiable data (until they’re found to be vulnerable themselves, of course).

If we’re being realistic, even the Band-Aid techniques will take two or three years to come to fruition. I’m personally looking forward to hearings scheduled by the House Committee on Ways and Means over the coming months that should address this very issue and would avidly encourage Congress to seriously consider making changes. The SSN might not be replaceable, but we crave a positive first step toward eventually repairing a fundamentally broken system.

Neville Pattinson is senior vice president of federal government programs at Gemalto has served on boards for the National Strategy for Trusted Identities in Cyberspace, Secure ID Coalition and Secure Technology Alliance.