It's Time For A Digital Universal ID

In the wake of the massive Equifax data breach, once again a spotlight has been shone on the overuse of the not-so-secret number that passes for a national ID in the United States—the Social Security Number (SSN).

- Ben Algaze

Perhaps we have become numb to these hacks and data breaches. What, my credit card number was compromised? The credit card company will cancel it and issue another one. My address information? My cell number? Well that’s already out there in many places. My bank account number? Whatever, I’ll change it.

Hold it—someone got my SSN? That’s not an easy one to change. And unfortunately, it’s overused for identity not just by government agencies but also by utilities, telecoms, and financial services companies to identify you and give you credit and access to their services.

ORIGINS OF THE SSN

The SSN was never designed to be a universal ID. It was designed to uniquely identify an individual, track their lifetime earnings, and enable them to collect their benefits upon retirement. The IRS and a host of other government agencies at all levels adopted it as an identifier. Private companies, given the lack of any other form of universal identification, adopted it as a form of establishing accounts unambiguously. And it has become a requirement for having a bank account and most any other financial service.

The SSN is the key to all the information major credit bureau companies such as Equifax hold about us—yet given how often you use it for identification, it can’t be considered a secret, like a password can. In 2009, researchers at Carnegie Mellon University found that they could develop an algorithm to guess SSNs from publicly available information. Part of the reason for that is the original structure of the SSN itself, which is based on the state of issue and is clustered around birth dates. Since the late 1980s, SSNs have been automatically issued at birth. Knowing where and when someone was born— something freely divulged by many on Facebook—can help a hacker derive a SSN with a guessing algorithm and a reasonably powerful laptop.