Breaking News Emails
Get breaking news alerts and special reports. The news and stories that matter, delivered weekday mornings.
Nov. 4, 2018 / 12:36 PM GMT
By Brandi Vincent
At a recent panel on modernizing Social Security numbers, Candace Worley, vice president and chief technical strategist for cybersecurity firm McAfee, laid out the core problem with the national identity system that has been in place since 1936.
“You can’t have 80 percent of your numbers compromised and continue to consider it a secure form of identity,” Worley said.
Social Security Numbers, or SSNs, remain an integral part of how Americans and U.S. residents are identified for everything from opening bank accounts and applying for loans to enrolling in Medicare and filing taxes. But a series of major data breaches in the past decade have exposed the Social Security numbers of almost 158 million Americans, opening a large majority of the country to the risk of identity theft.
Those breaches have pushed privacy advocates and politicians to call for a new system.
“Time is of the essence,” Rep. Sam Johnson, R-Texas, chairman of the House Social Security Subcommittee, said. “We must promptly evaluate options and begin putting in place those that will best protect Americans from identity theft.”
The problem is well-recognized, but the solution is not. Experts and politicians have warned that the SSN system is badly in need of an update, but there is little consensus on just what should be done. Most solutions are either technologically untested, expensive to implement — or both.
Get smart
One of the most common suggestions for updating SSNs is moving the U.S. to a “smart card” system, like the one suggested in a recent report from the Center for Strategic and International Studies, or CSIS, a nonprofit research organization that aims to provide solutions for current and emerging foreign policy and national security issues
“The simplest approach to modernization would be for the U.S. to transform the venerable Social Security Card into a ‘smart card,’” which would be a plastic card with a readable chip, similar to modern credit cards, the report states. Under that system, Americans would use two numbers — an encrypted SSN and a “proxy” number that would link the smart card and could be changed if compromised.
James A. Lewis, senior vice president at CSIS and author of the report, said that smart cards offer the most attractive approach for the immediate future because they build on existing technology and involve a widely adopted embedded chip that people are already comfortable using in credit cards. They would also enable an incremental approach to modernization that could curtail inevitable hiccups along the way.
Others aren’t optimistic about smart cards. Paul Grassi,an identity and cybersecurity expert who servedas senior standards and technology advisor at the National Institute of Standards and Technology, a non-regulatory agency that develops technical standards, said smart cards aren’t a good solution.
“Giving me a smart card does nothing unless the entire global infrastructure of global institutions is changed to be able to interact with a smartcard,” Grassi said. “It’ll never happen. The cost would be too astronomical.”
Joe Stuntz, principal of cybersecurity at One World Identity, a digital strategy consultancy focused on trust and the data economy, also said the smart card plan was too expensive.
“I can’t see a budget environment where this gets prioritization over some of the other things that need to be funded in terms of cybersecurity or identity,” Stuntz said.
SSN reform is also running short on champions in the U.S. government. Johnson is retiring at the end of his term, and Rob Joyce, the White House cybersecurity coordinator who called for ideas for SSN replacements, left the administration in May — and his position was eliminated.
To the future and beyond
The identity and verification needs filled by SSNs are also problems that a variety of nascent technologies including biometrics and blockchain theoretically solve, leading some to hope that the best solution for national identity is yet to come.
But Stuntz, who previously ran smartcard programs for the federal government, said a cheaper, more viable solution could be found in something most Americans use daily: smartphones, which already have authentication and verification apps for private services.
“When smartphones have secure environments that could hold this type of information and be more accessible, I don’t think the cost of a smart card is justified in that report,” Stuntz said.
As for biometrics and blockchain, Grassi said that both need to answer major questions before they could be used to upgrade or replace the SSN system, including making sure they’re secure and easy to use.
And the U.S. national identity system, Lewis said, is not a place to test out new technology.
“This will eventually change,” Lewis said. “But making the SSN the testbed for a deployment involving hundreds of millions of individuals would create the risk of turmoil in the U.S. economy.”