According to the New York Times, 2006 ended with an infamous information security milestone. Last month, computer hackers obtained the Social Security numbers and other sensitive personal information of 800,000 U.C.L.A. employees and students. Aetna lost 130,000 employee computer records, and a thief stole a Boeing employee’s laptop containing the SSNs of over 382,000 former and current employees. One of the folks affected by those security breaches has the dubious distinction of standing as the 100 millionth person to lose their personal data in a security breach in the past 18 months. Unfortunately, experts predict that the state of information security will further degenerate this year, exposing even greater numbers of individuals to the threat of identity fraud.
As has been widely reported, individuals with pressed financial resources have great difficulty repairing their credit history after being struck by identity theft. The money lost and time spent trying to correct damaged credit histories ultimately could have a material adverse impact on the U.S. gross domestic product. At a more granular level, data leaks, and the identity theft they risk, pose other less publicized problems that will affect the legal community. State bars require law graduates to present their credit history as part of their character and fitness review. Students whose credit has been decimated by an identity thief now face additional hurdles beyond passing the bar to practice law–proving that a thief’s loans and unpaid mortgage bills are not their own. It appears that the information security problem will make nabbing a license to practice law even harder in 2007.
Posted by Danielle Citron on January 15, 2007 at 12:01 AM
Comments
Since stolen laptops are often the source of lost personal information, applying thin-client or server-based computing capabilities to laptops would be a real boon to security. The laptop becomes a dumb monitor. Steal it and all you’ve got is a typewriter with lights. No hard drive. No memory. No data to be disclosed.
Posted by: Kevin Linskey | Jan 23, 2007 5:26:55 PM
Bruce — SSNs are very easy for fraudsters to find out. User-generated passwords work much better. They are used for online accounts, but strangely not for other purposes. As for setting up new accounts, there’s always the possibility of fraud, but with many accounts, there are often better alternatives — if the account is created in person, identification could be required. The problem with using SSNs or dates of birth is that any fraudster can get them readily — anybody can simply purchase another’s SSN! Also, some simple techniques, such as checking the data on an application against a person’s credit report can reduce fraud in new applications. Or, if there’s a discrepancy in addresses or phone numbers between what’s on the credit report and the account, sending a notice to both so as to prevent fraud might be helpful. But relying on knowledge of SSNs to verify identity strikes me as irresponsible.
Posted by: Daniel Solove | Jan 16, 2007 5:28:41 PM
“There is absolutely no reason why banks, financial institutions, and other companies that do business with people should use SSNs to verify identity. The practice is irresponsible. Merely shifting to a password, which isn’t perfect by any means, will be a significant improvement.”
I think we need to distinguish here between new relationships and existing relationships. I don’t understand how getting rid of SSNs at the new relationship stage will improve security. In fact, of all the information the bank or whoever has on you to verify your identity, that one’s probably the *most* secret. I mean, SSNs are not *that* widely known. I certainly don’t know many people’s SSNs.
Obviously user-generated passwords and randomly assigned account numbers and the like are better for access to existing accounts, which is why just about everyone uses that system, at least for online transactions. (Perhaps telephone access is an exception, but I’m less familiar with both the security practices and the magnitude of the threat there.) But I’m not understanding what the alternative would be for new accounts — setting up a password will accomplish nothing if the person setting up the password is already a fraudster. You’ll just have very secure, but fraudulent, transactions. If there aren’t good alternatives, using SSNs (plus other biographical data) does not strike me as such a bad practice. Perhaps where the law can help is in making sure that companies cannot externalize the risks of such practices.
Posted by: Bruce Boyden | Jan 16, 2007 12:55:23 PM
Bruce — Yes, you need previous coordination between the parties to set up an account with non-SSN or public record info (such as date of birth or mother’s maiden names) as the way to verify identity. The reason why getting rid of SSNs will be an immediate benefit is that when they are used like passwords, they have several features that make them the worst kind of password: (1) they are widely known, so anybody, without any technical sophistication, can learn your “password” — SSNs are akin to using your user name as your password; (2) they are hard to change; at least with a regular password, you can change it quickly; and (3) they are used broadly in many different contexts. So you have a hard-to-change “password” for tons of different accountd that anybody can find out even without any degree of technical expertise.
There is absolutely no reason why banks, financial institutions, and other companies that do business with people should use SSNs to verify identity. The practice is irresponsible. Merely shifting to a password, which isn’t perfect by any means, will be a significant improvement. There are many companies, however, that will not be happy with getting rid of SSNs or some other form of public data (such as dates of birth, which also should not be used for the reasons stated above) to verify identity. Credit card applications, for example, don’t have a preexisting relationship with the consumer. Or credit reporting agencies, which report on you without a preexisting relationship. The structure of the credit reporting system strikes me as an immensely odd one — we depend upon accurate credit reporting yet such an important process takes place entirely behind our backs.
To Danielle’s point, yes, getting something through Congress on SSNs will be difficult, as is getting nearly anything through Congress. I’ve been quite involved in Congress’s wranglings over the data security breach legislation (I testified before Congress in 2005 and spoke to many staffers). But seeing the process unfold has really made me lose a lot of faith in Congress. So much so that I think it’s better left to the states at this point. The states have been quite responsive to the security breaches, and countless states have already passed new laws. True, state-by-state legislation is less efficient, but Congress does not seem capable of late to reach a fair balance between consumer interests and special interests. Ironically, it is industry pushing the hardest for Congressional legislation in order to preempt the state laws with a vague and weak data breach standard. There are some people in Congress who really do care about writing a good balanced thoughtful law, but thus far, there don’t seem to be enough.
It has been my theory for some time that the FTC could assert that the use of SSNs is an unreasonable security practice in violation of the requirements of the Gramm-Leach-Bliley Act. But it hasn’t done so.
So I’ve become quite cynical about Congress and about any federal solution. The most exciting privacy developments these days are coming out of the states. It has really changed my views on federalism in a significant way.
Posted by: Daniel J. Solove | Jan 15, 2007 7:33:10 PM
Ah, I get it now. I think the problem with any solution to the use of SSNs as identity authentication is that most alternatives are either not very secret either, not applicable to a substantial portion of people, not easy to remember, not easy to convey, or some combination of all that. You could ask multiple rotating questions, but this taxes both the abilities of the system (I’ve had CSRs using this sort of method get my past addresses wrong) and the memories of consumers (let’s see, what county was I in 15 years ago?). Made-up passwords place a similar burden on consumers — I use a small number of passwords for a large number of sites, and rarely change them, despite all the warnings, because I have better things to do with my time — and I feel pretty confident my security practices are better than most. You could use some sort of security key to authenticate identity, but that’s an extra thing (or 20, if every institution has a different one) to carry around, and may not work over the phone depending on how it’s implemented. So, SSNs may not be foolproof, but what’s the (efficient) alternative?
One line I think you could draw is between the procedures to access an account, and to establish a new one. Accessing an account easily, with a minimum of hassle, is a big plus for consumers — and in most cases, fraudulent access of the account results in a finite amount of harm (e.g., your card is cancelled unexpectedly and you have to pay $50). Much, much worse is having someone who can set up new accounts in your name. So if I had to go through 5 minutes of rigamarole every time I set up a new account, that wouldn’t be so bad, since I don’t do that that often. But I still think you’re going to face a problem of where to get the authenticating information from, in a way that’s both accurate and secure, without previous coordination between the two parties.
Posted by: Bruce Boyden | Jan 15, 2007 3:32:43 PM
I am looking forward to Dan’s response to Bruce’s question, but in the interim I thought I would chime into the discussion. Pension plans, banks, credit card companies, and other entities in the financial sector use SSNs to verify customers and plan participants. Private employers often require employees to use their SSNs as work IDs. And businesses use SSNs to verify clients and customers. (Not surprisingly, employees are currently pursuing negligence lawsuits against employers that used their SSNs as IDs and subsequently lost them in a security breach.)
Many thanks to Dan for his insight that SSNs should not be used to verify clients, customers, and employees. A legislative prohibition of the use of SSNs in certain circumstances would no doubt stem part of the leakage problem. A legislative solution in that order, however, seems unlikely given significant support by the financial services industry, pension planners, and others for the use of SSNs as a means to identify and verify individuals. But perhaps the new Congress might be more receptive to Dan’s persuasive arguments for a legislative/administrative approach to the pervasive use of digital dossiers and SSNs in the private sector.
Posted by: Danielle Citron | Jan 15, 2007 1:42:23 PM
By passwords, I’m using the term broadly to mean any way of verifying or authenticating identity. Many financial institutions and other companies ask callers or credit card applicants their SSN in order to verify that they are who they say they are. This is a use akin to a password, a word that provides access to accounts. Say the word (or SSN) and you’re given access.
People are not voluntarily using their SSNs as passwords; SSNs are used by countless institutions in order to determine if a caller is indeed the account holder. They are also used, in conjunction with dates of birth, as a way of verifying identity to open up a new credit card account, etc. There is little difference between this use and use as a password, which is why I equate the two. But to be more accurate, SSNs should never be used as a way to authenticate identity — knowledge of SSN should have no bearing on whether a person is who they say they are.
Posted by: Daniel J. Solove | Jan 15, 2007 1:28:06 PM
Dan, who’s using SSNs as passwords? I’ve seen it used as a user ID, mostly at financial services companies, but never as a password. Do you mean people are voluntarily using their own SSNs as passwords? That would certainly seem to be a bad idea.
Posted by: Bruce Boyden | Jan 15, 2007 12:20:10 PM
Good post. All these data leaks have turned the focus of legislatures on the data leakers, but there’s another set of culprits in all this that are perhaps more to blame and are not getting any attention — those that use SSNs as passwords to access accounts. It is my belief that most ID theft could be curtailed by banning the use of SSNs as passwords. This doesn’t mean banning all uses of SSNs. SSNs can be used to distinguish between people with the same name (they function well as an addendum to people’s names); but they are a lousy way of verifying that people are who they say they are. Using SSNs as passwords is one of the dumbest practices ever devised. Stop the use of SSNs as passwords, and leaking SSNs becomes relatively harmless. This shouldn’t let the data leakers off the hook, but it would go a long way toward addressing the problem.
Posted by: Daniel J. Solove | Jan 15, 2007 12:49:27 AM
Like this:
Like Loading...