We’ve heard this story so many times that we already know how it will unfold. Giant company announces breach. CEO makes statement of contrition. Executive in charge of cybersecurity is publicly fired. Customers receive letters of apology and identity monitoring services. We go back to life as normal until another breach restarts the cycle.
Our current use of SSNs mixes two concepts: identification and authentication. Identification mechanisms allow us to uniquely identify an individual, while authentication mechanisms allow us to confirm an individual’s claim of identity. Think of it this way: When you walk up to the front desk of a hotel to check in, you might identify yourself by name, but then the desk clerk asks to see your driver’s license to authenticate your claimed identity. In the online world, you might identify yourself with an email address, but you authenticate that claim with your password.
We currently use Social Security numbers as both identifiers and authenticators. But Social Security numbers are, in fact, only identifiers since there’s no password or other authentication mechanism associated with them. When you share your number with a lender, landlord, potential employer or your dentist, there’s nothing stopping them from using it to impersonate you. And that’s where publishing all SSNs comes in. Making all SSNs available to the public would make it impossible to use them as authentication since everyone would know everyone else’s SSN. And they could then still be used for identification.
How many digital and paper files scattered around the world contain this nine-digit key to your identity?
Even if you haven’t already been the victim of identity theft, chances are good that hackers already have your SSN. It may be sitting in an illicit digital file somewhere, as hackers wait for the right opportunity to use it. If you weren’t affected by the AMCA breach, there were plenty of other opportunities for your data to fall into the wrong hands.
When we mistreat identifiers as authenticators, we facilitate identity theft. Anyone who has ever obtained your SSN, legitimately or illegitimately, can claim your identity as their own. And, worst of all, there isn’t much that you can do to thwart them. Unlike a password, it’s extremely difficult to change your SSN. It’s as if everyone you ever invited into your house kept a copy of the key and you’re unable to change the locks.
Secure authentication technology already exists. We use it every day to protect our social media accounts, email inboxes and the dozens of other mundane logins that are part of our everyday lives. Shouldn’t we cover our most sensitive financial information with at least that same minimum level of protection?
Unfortunately, implementing strong authentication is difficult and expensive, and there’s no incentive for credit reporting agencies, financial institutions or other bureaucracies to invest in the technology required to replace our current use of SSNs. Without a burning platform, nothing will change. But Congress can light the necessary fire by directing the publication of all SSNs in five years.
This is a drastic, but necessary, measure. Mandating the future publication of SSNs creates a digital time bomb that will force a fix to a fundamentally flawed system. While setting a time bomb may seem irresponsible, remember that the millions of SSNs already in the hands of hackers constitute millions of individual time bombs, waiting to throw off their shrapnel of identity theft. One of those bombs might have your name and Social Security number written on it. Let’s disarm them.