In the wake of the massive Equifax hack which exposed social security numbers and other sensitive data of over 143 million Americans, the White House is exploring alternative methods of identifications for U.S. citizens, according to Job Joyce, Special assistant to the President and White House cybersecurity coordinator.
“I feel very strongly that the Social Security number has outlived its usefulness,” Joyce told attendees at a cyber conference hosted by the Washington Post. “Every time we use the Social Security number, you put it at risk.”
Joyce’s comments echo those of former Equifax CEO Richard Smith, who testified before the House Energy and Commerce Committee regarding the massive hack.
“The concept of a Social Security number in this environment being private and secure — I think it’s time as a country to think beyond that,” Smith said. “What is a better way to identify consumers in our country in a very secure way? I think that way is something different than an SSN, a date of birth and a name.
Further into the Matrix…
Proposed solutions to a social security number are all digital. Bloomberg reports:
Joseph Lorenzo Hall, chief technologist at the Center for Democracy and Technology in Washington, said one possibility could be giving individuals a private key, essentially a long cryptographic number that’s embedded in a “physical token” that then requires users to verify that the number belongs to them. It could work like the chip in a credit card that requires the owner to enter a pin allowing use. He pointed to Estonia where they have deployed such cards that people use to validate their identity.
“Your pin unlocks your ability to use that big number,” he said. The challenge is how to create the identifiers and how to distribute the keys. “It’s very promising” and “it’s possible to technically design something like this” but it could be expensive to design and disseminate such material to each American, he said. “This is a pretty big endeavor.”
The administration is also participating in discussions Congress is having about the requirements of protecting personal data and breach notifications for companies.
Another solution would be to use blockchain technology currently employed in cryptocurrencies, to create a sort of digital DNA fingerprint which would be “mathematically impossible” to duplicate. Instead of a SSN, each citizen would receive a ‘blockchain hash,’ a kind of algorithm unique to the individual.
Out with the old…
Harvard’s Bruce Schneider, a fellow at the Kennedy School of Government thinks that Social Security numbers are antiquated – and were only useful when it was the only number available to identify a person.
“They appeared at an age when we didn’t have other numbers,” Schneier said in an interview. “Think of this as part of our aging infrastructure” from roads and bridges to communications. “Sooner or later we as a society need to fix our aging infrastructure.”
Schneier pointed to India’s use of the Aadhaar card – a unique number provided to the country’s 1.2 billion citizens after collecting their fingerprints, an iris scan, demographic data, and other identifying information.
Laws would need to change
In order to accept the mark of the beast, “you’d need to change a lot of existing public law” says Marc Rotenberg, executive director of the Electronic Privacy Information Center in Washington – an advocate of reducing SSN use. “There would need to be extensive hearings and study about the consequences. It’s a complicated issue.”
The failure of the Social Security number is that there’s only one for each person, “once it’s compromised one time, you’re done,” Bob Stasio, a fellow at the Truman National Security Project and former chief of operations at the National Security Agency’s Cyber Operations Center.
Public and private keys — long strings of code — could help validate identities. For instance, the government could issue each person a public key and private key. If people were to open a bank account, for instance, they could provide their public key — instead of a Social Security number — and the bank would send a message that could only be decrypted using their private key. If the private key gets compromised, the government could easily issue another one.
If you enjoy the content at iBankCoin, please follow us on Twitter
…and the private key would be stored on a chip which would be implanted to protect it. Brilliant.