In the never-ending immigration reform debate, we on the "liberal" side keep coming back to two proposals: reform immigration mechanisms, and enforce employment restrictions. These are all well and good in the abstract, but an article in today's Washington Post, verbosely entitled Researchers: Social Security Numbers Can Be Guessed, should give us all a pause for reflection.
Why? Well, there are about 300,000,000 people currently living in the United States. In contrast, there are only 1,000,000,000 total possible Social Security Numbers. That's right - in fewer than 4 guesses, you can come up with a current legitimate Social Security Number. And, worse, according to today's article...
[...] it is possible to guess many -- if not all -- of the nine digits in an individual's Social Security number using publicly available information
Just how bad is it? Follow below the fold for the gory details...
Okay - the scary part first:
They were able to identify all nine digits for 8.5 percent of people born after 1988 in fewer than 1,000 attempts. For people born recently in smaller states, researchers sometimes needed just 10 or fewer attempts to predict all nine digits.
How? The article details just how Social Security Numbers are assigned - regionally, then sequentially by application order within the region. In 1988, the government began pushing for registering newborns with the SSA, making the numbering much more predictable if given a starting date. And the SSA publishes the full Social Security Number and birth information of every deceased US Citizen in it's Death Master File (available on such popular sites as genealogy.com....). Knowing a person's birth date and having the DMF on-hand can get you pretty close to a person's SSN - and once you have a name associated with an SSN, you can slip past any employer's ID check.
But things are worse than even the "doomsday" scenario painted by the Post. The last four digits of your SSN are used by many institutions as a kind of poor man's PIN. Colleges and work places use them in student and employer IDs and e-mail addresses. Credit companies use them when you call in using their tele-pay systems. And these last four digits are the very digits that scammers and ID thieves find hardest to guess - made easier by laziness as much as anything else.
When the Social Security system was created, SSNs were meant as a tax ID for the SSA - and only as a tax ID for the SSA. They were not to be used outside of government except for when reporting back to the government for these specific purposes. And they were not designed with a concurrent population of 300,000,000 in mind.
Which leads us back to today's problem: enforcing employment status for immigrants. How can we expect an employer to validate a Social Security Number as valid when just under 1 in 3 are currently in use? Can we even expect an employer to clear a younger worker when their SSN and name match? The answer is both obvious and painful...
The current Social Security Number system needs to be replaced. And with it, the green card ID system, which is just as easy to fake. The problem is simple and two-fold. First, there aren't enough ID numbers available. And second, we must return to the days when the SSN was only used to identify a taxpayer to the government.
Returning to the days of limited SSN use isn't hard to enact - it would be a simple law, after all - but it would be incredibly hard to ram past today's corporate credit holders. Your credit life is run by your SSN. Credit reporting agencies store all their data by your SSN. Creditors, landlords, and other people who have no real "right" to your SSN nonetheless require it - to run a credit check. Companies with whom you've never spoken can request your credit report (keyed by your SSN) without your even knowing - unless you've locked down your credit report explicitly. It would take a significant effort for everyone to find a new ID system to replace the SSN, and while we're at it we might want to throw in some real security measures to back up any new corporate ID system.
And then there's the hard part - increasing the number of ID numbers so that it can be secure, effective for employers, and useful when considering immigration reform. To present our current Social Security Number system in mathematical terms, the "hash space" - the total list of available numbers - isn't "sparse" enough (full of enough empty spaces) to be efficient. If a hash space is properly designed, it is hard to pick a random number and find it already in use; this is good in cryptology, in computer programming - and in finding unique identifiers for people. Does this mean we have to use 30-digit numbers? Not really. In fact, we could keep the length of this new Government Tax ID the same as our current SSNs if we switched from a numeric ID to an alphanumeric ID. There are 36 alphanumeric characters, but a few look or sound similar; if we removed a few letters - say 6 - we would still have enough ID numbers for 19 trillion people. With 10 characters, the total space is 590 trillion IDs. What's so hard about it, then? Reprogramming many, many computers to use an alphanumeric identifier that ideally might be one character larger than the current ID.
What's at stake? Until we can control employer verification of work status, we will never IMHO get control of our immigration, or of the exploitation of undocumented workers that drives some employers to look the other way in the face of obvious documentation problems.
Do we have the political will and the administrative drive to get this done?
