See your link here
The Social Security Number debate - should your SSN be published for the public to see?
8 comments- IT TOPICS:Business Intelligence, Government & Regulation, Security
If you are a Texan or are just a general information junkie, you may have heard about the social security number debate going on in the Texas Legislature. I wrote a fairly lengthy diatribe about it on my personal blog the other day, but the basic issue is that the Texas House has voted to "de-privatize" the social security number in Texas. This means that county clerks can release forms that are publicly available (marriage license applications, etc.) without redacting the social security number of the person that filled out the form.
Martin McKeay first wrote about this on his personal blog, and it started somewhat of a blog storm with Cutaway and myself because we both live in Texas. Then Pete Lindstrom at his Spire Security Viewpoint blog wrote an opposing piece to Martin's post. While that post is significant in its arguments, it really points back to this post where Mr Lindstrom more fully explains his reasoning for disagreement. In this post, Mr. Lindstrom takes the position that all social security numbers should be published for all to see so as to "ensure that no organization has the opportunity to suggest that their secrecy can be maintained." All I can say is, "Wow." Actually, I can say more than that.
Mr. Lindstrom uses the following argument to prove his argument:
Quick, try this: Count the number of banks, credit card companies, insurance companies, mutual fund companies, mortgage companies, and utility companies that you have EVER done business with. Now, multiply that number by 1,000 average customer service representatives and information systems personnel. Add in about 20,000 IRS customer service reps (or 100,000 total employees if you are feeling really skeptical); 65,000 Social Security Administration employees; the total number of employees for every human resources department of every job you’ve ever had; employee counts for the admin department at all schools you’ve attended; and don’t forget the credit reporting agencies you love to hate.
My conservative estimate is that over 150,000 people have “defendable” access to a typical person’s Social Security Number (SSN) over his or her lifetime (a number of my colleagues suggest this number is much higher). And I’ve left out the use of your SSN on military service records, medical records, and local and state tax submissions, among others.
Mr. Lindstrom, I have a couple of issues with this argument. First, you call your estimate conservative while simultaneously attempting to inflate the numbers by asking the reader to make assumptions like including all 100,000 IRS employees because they MIGHT have access to your SSN. You also inflate your numbers by assuming every Social Security Administration employee has access and every HR employee of every company you have ever worked for can access your information, and on and on. While I consider myself fairly skeptical and paranoid (I'm paid to be that way), I do not have so little faith in humanity to think that every single one of these people are copying down my information and handing it out to the closet criminal for a few bucks. I'll agree with the paradigm that a secret is no longer a secret if you tell someone else, but the possession of knowledge does not necessitate dissemination of said knowledge.
Second, while it may be entirely practical to make the assumption that knowledge equals dissemination in the world of security, I also think that there is just as much a possibility that at least some of these organizations have some types of controls in place to control this type of curiosity and revelation of SSN's to criminals. That may sound naïve, but I don't really think it is at all. I can't prove that argument, but neither can you prove your numbers, Mr. Lindstrom. So your "conservative" estimate is actually quite liberal.
My third problem with your argument is that you ENTIRELY discount a very large portion of the population of the Untied States, namely children and new citizens. These people just got their SSN's, and they have not done much (if any) business with banks, credit card companies, and the like. Should we publish their information? No we shouldn't. Keeping their information private is still a possibility, IF we change the rules. If, as you say, there is no hope left for us poor souls who have taken part in this capitalist society we live in, then publishing our SSN's and other personal info may not be a big deal. But don't concurrently take away that same hope from the groups I named above. Again, IF we take this seriously and change the rules now, we can stop this problem from being inherited by our children and those trying to take part in our society by becoming citizens.
So Mr. Lindstrom, while I greatly appreciate your well thought out and very persuasive ideas, I do not think we can simply give everyone access to our private (yes, private) information just so no one can claim that it is being kept secret. I simply do not buy that. And in this case, shooting ourselves in the foot will also be shooting our kids and future citizens in the foot.
Print
Email this
Digg this
