Why using Social Security numbers for identification is risky and stupid.

Inside the Internet.
July 14 2009 6:08 PM

No, You Can't Have My Social Security Number

Why using SSNs for identification is risky and stupid.

Illustration by Rob Donnelly. Click image to expand.

In a paper published last week, two Carnegie Mellon professors unveiled a method for cracking the code of Social Security numbers. Given a person's birth date and the state where he or she was born along with public records of deceased people born around the same time, the researchers wrote an algorithm that predicted a person's SSN with startling accuracy. The biggest question raised by their paper isn't how our country came to rely on such an insecure identification system. The mystery is how it took so long for anyone to break such a ridiculously elementary system.

Social Security numbers were never designed to be secure. When SSNs came into existence 75 years ago, they had one and only one purpose: to keep track of contributions to the federal pension system. When Congress established the program in 1935, it started issuing cards with unique nine-digit numbers. The numbers were derived using a simple formula. The first three digits, called the "area number," refer to the state where the card was issued. The fourth and fifth digits, the "group number," are assigned in a predetermined order to divide the applicants into arbitrary groups. The last four digits, the "serial number," are assigned sequentially, from 0001 to 9999 in each group.

Advertisement

Ten years after the SSN debuted, the feds added a clarification to the card in capital letters: "FOR SOCIAL SECURITY PURPOSES—NOT FOR IDENTIFICATION." By that point, it was already too late. Three years earlier, President Franklin Roosevelt had issued an executive order allowing other federal agencies to use SSNs rather than launch their own systems. Within 20 years, the IRS, the Civil Service Commission, and the military were all using the numbers to identify people.

Social Security numbers haven't evolved much since those early days, but the techniques for exploiting them have. The Social Security Administration's Web site is happy to tell you which three-digit codes belong to which states and in what order the group numbers are assigned. The Carnegie Mellon researchers simply determined that if you know when and where a person was born—info that many of us readily supply on Facebook—you can narrow down her possible Social Security number to a fairly small range. (Studying existing government records, like the list of dead people's SSNs in the Death Master File, gave the researchers additional clues about when exactly specific states assigned specific numbers.) The system works particularly well for people born in small states, which have only a few possible area numbers. (For example, Wyoming natives are very likely to have Social Security numbers that start with 520.) The odds of guessing someone's number on the dot are still low—about 1 percent on average for more recent births, but up to 10 percent in small states. Even the lower figures, however, are plenty large enough to steal a lot of real identities if you use a small network of computers to try out lots of possibilities.

Now that SSNs are used on our driver's licenses, tax returns, and bank statements, we have the worst of all possible worlds: Numbers that were never intended to be secure are being used to secure our most-valuable information. Because many companies also use Social Security numbers as a password to get into your account, swiping the number from a license or a student ID card gives a person all sorts of access to your life.

TODAY IN SLATE

Politics

Talking White

Black people’s disdain for “proper English” and academic achievement is a myth.

Hong Kong’s Protesters Are Ridiculously Polite. That’s What Scares Beijing So Much.

The One Fact About Ebola That Should Calm You: It Spreads Slowly

Operation Backbone

How White Boy Rick, a legendary Detroit cocaine dealer, helped the FBI uncover brazen police corruption.

A Jaw-Dropping Political Ad Aimed at Young Women, Apparently

The XX Factor
Oct. 1 2014 4:05 PM Today in GOP Outreach to Women: You Broads Like Wedding Dresses, Right?
Music

How Even an Old Hipster Can Age Gracefully

On their new albums, Leonard Cohen, Robert Plant, and Loudon Wainwright III show three ways.

How Tattoo Parlors Became the Barber Shops of Hipster Neighborhoods

This Gargantuan Wind Farm in Wyoming Would Be the Hoover Dam of the 21st Century

Moneybox
Oct. 1 2014 8:34 AM This Gargantuan Wind Farm in Wyoming Would Be the Hoover Dam of the 21st Century To undertake a massively ambitious energy project, you don’t need the government anymore.
  News & Politics
Politics
Oct. 1 2014 7:26 PM Talking White Black people’s disdain for “proper English” and academic achievement is a myth.
  Business
Buy a Small Business
Oct. 1 2014 11:48 PM Inking the Deal Why tattoo parlors are a great small-business bet.
  Life
Outward
Oct. 1 2014 6:02 PM Facebook Relaxes Its “Real Name” Policy; Drag Queens Celebrate
  Double X
The XX Factor
Oct. 1 2014 5:11 PM Celebrity Feminist Identification Has Reached Peak Meaninglessness
  Slate Plus
Behind the Scenes
Oct. 1 2014 3:24 PM Revelry (and Business) at Mohonk Photos and highlights from Slate’s annual retreat.
  Arts
Brow Beat
Oct. 1 2014 9:39 PM Tom Cruise Dies Over and Over Again in This Edge of Tomorrow Supercut
  Technology
Future Tense
Oct. 1 2014 6:59 PM EU’s Next Digital Commissioner Thinks Keeping Nude Celeb Photos in the Cloud Is “Stupid”
  Health & Science
Science
Oct. 1 2014 4:03 PM Does the Earth Really Have a “Hum”? Yes, but probably not the one you’re thinking.
  Sports
Sports Nut
Oct. 1 2014 5:19 PM Bunt-a-Palooza! How bad was the Kansas City Royals’ bunt-all-the-time strategy in the American League wild-card game?