When “Efficiency” Becomes Exposure: How DOGE Put America’s Identity at Risk

[Privacy2]

@tracy

No wait, I’m conflating that with you old BEachwood exchange number ending in 4-5789.

I had to google the reference. Beechwood 4-5789 is a song by The Marvelettes. And it includes the lyric of “have a date, any ol’ time”.

[Privacy2]

@irvinewade

In my opinion, the bigger problem is not that someone took a copy of the file but that the file exists in the first place. As they say, collect it and the breach will come.

It was directly from the Social Security Administration. Of course they have all of the Social Security information and that’s all Numident is ( Numident - Wikipedia ).

Numident, or “Numerical Identification System,”^[1] is the Social Security Administration’s computer database file of an abstract of the information contained in an application for a United States Social Security number (Form SS-5). It contains the name of the applicant, place and date of birth, and other information. The Numident file contains all Social Security numbers since they first were issued in 1936.

[tracy]

No issues with Pennsyvania 6 5000 then?

(That was a hotel phone number and the hit song was free advertising if I recall.)

[irvinewade]

@Privacy2

Of course they have all of the Social Security information

I understand that but I was alluding to other information that is listed such as “parents names, and even health and financial data”. While “health and financial data” is quite vague, mission creep is very possible with any database that starts out authorised by law.

I don’t know about in the US but perhaps you are allowed to apply to the “Social Security Administration” and demand a copy of all the information that they are holding on you - and thereby assess what the actual “exposure” risk is for you personally.

I’m not as cynical as you are about insurance but I apply the three considerations in post 9 above to any insurance offering.

[tracy]

Per what Irvinwade said. I think that much of what that company does, (as well as a few others). is take some of the steps above vis-a-vis the Social Security Administration (SSA) as a service as well as other gov’t agencies (like local governments) where your house/(s) Title/(s) is/(are). Then they add insurance and legal services on top of it.

The risk I see here is they become another potential point of breach (and a target). However if they have a major data breach, they’re liable for all their customers. If the SSA has a breach, everyone gets an “apology” an investigation, and a debate in congress.

[Privacy2]

@irvinewade

I understand that but I was alluding to other information that is listed such as “parents names, and even health and financial data”. While “health and financial data” is quite vague, mission creep is very possible with any database that starts out authorised by law.

To be crystal clear: The only data saved is data that was given to the SSA by the individual. If you think that the SSA goes out and mines hospital or other data, you’re just wrong. Don’t let your speculation run amuck.

The only one that is a bit odd is the “parents names”. It’s part of their “birth records” which are provided to the SSA when you apply for a SSN. They store:

1. Date of birth.
2. Location of birth.
3. Parents names and possibly other information (such as their SSNs if available).

Age is a key Social Security bit of information. Location of birth is for help in determining uniqueness so that Social Security numbers can be unique. Parents names (and presumably social security numbers) might be useful since social security disability claims for minors depends on the parents work history.

Other information saved:

1. Other names and aliases (e.g. history of name changes via marriage, etc.). [Presumably for having a more clear identification. All of this is supplied to the SSA by the individual as part of the US name changing process.]
2. Financial data: I believe they only store the history of social security payments and medicare payments (specifically the tax collected and the earnings they were based on). The former are needed to determine the benefits due.
3. Health Information: This is restricted to information that the individual supplied to or provided the SSA access to for disability claims. e.g. I have never filed for disability so the SSA has no health information for me. They explicitly do not store information regarding medicare claims.

I believe that in regard to the SSA, you were engaging in just a tad too much speculation.

@irvinewade

I don’t know about in the US but perhaps you are allowed to apply to the “Social Security Administration” and demand a copy of all the information that they are holding on you - and thereby assess what the actual “exposure” risk is for you personally.

I don’t know if one can easily get everything they have stored. There is a system, called ERE and ERECA, to download detailed information. It’s mainly for use when someone needs professional help in making claims for or appealing SSA or medicare benefits. The only thing I’ve downloaded is my history of medicare taxes+earnings and social security taxes and earnings. That’s necessary to understand one’s social security benefits.

[amarok]

@tracy

I think it should read: “…American’s…”.

Actually:
Americans’

Possessive plural.

[irvinewade]

OK, Apostrophe Man.

[Privacy2]

@irvinewade

However insurance in no way prevents the insured event. It just makes it less painful after the fact.

Funny aside: The CEO of LifeLock posted his own Social Security number to somehow prove that LifeLock could protect him from identity theft. He has had his identity stolen at least 13 times with serious consequences (large loans taken out in his name, liens on property, fake phone numbers, …. The FTC fined LifeLock $12m in 2010 because at that time they purported to say they could stop identity theft. It’s now just insurance. LifeLock CEO's Identity Stolen 13 Times | WIRED