Re: Legacy use of partial SSNs as identifiers

[Kevin Shalla <kshalla () UIC EDU>]

Stretching this discussion far beyond what was intended...

Given the number of incidents where SSNs have been disclosed, the
number of databases where this is stored with no real national
oversight, the number of employees across the country that have
access to some set of SSNs (I would guess millions in the insurance,
education, banking, health care, and employment industries alone) and
the value that the SSN provides as a national unique identifier,
isn't it time we move beyond thinking that the knowledge of an SSN
authenticates you as the person who owns that SSN?

I know that could mean that you might not be able to apply for
instant credit and buy stuff immediately, but really that's not my
problem - that's the bank's problem, and people who "need" instant
credit probably don't need credit at all - they need to stop
spending.  The banks need to figure out better ways to authenticate
people who are opening up new accounts in ways that don't rely on SSN
as an authenticator.

In our university database, we have significant problems with
multiple records for one person or worse, one record for multiple
people, and they could be dramatically reduced by increasing the SSNs
that get populated in our database, and that could be achieved if we
as a society got away from using SSN as an authenticator, and instead
used it as an identifier.  If we could do this, people would be less
reluctant to providing us with SSNs, and that could make our
operation (and I'm sure that of other industries also) much smoother.

At 12:17 PM 6/2/2009, Martin Manjak wrote:
> Prior to legislation in many states prohibiting the use of SSNs and,
> and later, partial SSNs , a lot of schools were using these values
> to generate student IDs. While moving away from SSN related values
> to some form of unique, random identifier was a significant
> challenge, converting the old IDs--and all the records keyed on
> them-- into the new formats posed more formidable obstacles.
>
> I'm curious as to whether any institutions still have legacy
> identifiers that utilize partial SSNs, and what, if anything, you're
> considering doing with them. Presumably, the bulk of those records
> belong to individuals who are no longer active students.
>
> Feel free to reply off list if you prefer.
>
> --
> Martin Manjak
> Information Security Officer
> University at Albany
> CISSP, GIAC GSEC-G, GCIH, GCWN
> 518/437-3813
> mm376 () albany edu