PUSH IS ON TO GET NEW FORM OF ID

Social Security numbers ‘horrific’

The White House is pushing a plan to replace Social Security numbers as the main way people identify themselves — and as a protection against data breaches like Equifax that affected nearly 150 million.

“The Social Security number as an identity, or even worse as an access control, is just a horrific idea,” said Rob Joyce, White House cybersecurity czar, at the Cambridge Cyber Summit in Boston yesterday.

“Why should something you have to write down on a form and give to third parties, transmit openly, allowed to be stored in filing cabinets and in records all over the country, even all over the globe — why should that be the thing that allows access to your financial records?” Joyce said.

Social Security numbers were never meant to be a standard way of ensuring someone is who they say they are, experts say, but filled that role as more and more parts of the economy began relying on those nine digits. Now, they are used for medical records, to open a bank account, and to run a credit check.

“A Social Security number was never intended to be more than an identification credential for government services,” said Michael Figueroa, executive director of the Advanced Cyber Security Center in Boston.

“We’ve used it so much, it’s extended so far beyond its primary purpose,” Figueroa said. “It’s infused in so many aspects of our lives.” To make things worse, once a Social Security number is stolen, it is extremely difficult to replace, Joyce noted.

“It’s not a great method to authenticate given that these have been stolen from all of us many times,” said Michael Sulmeyer, director of the Cyber Security Project at Harvard’s Belfer Center.

Earlier this year, President Trump directed federal agencies to begin looking at other options, and the National Institute for Standards and Technology has been working with the financial industry on the problem, Joyce said.

Earlier this week, former Equifax chief executive Richard Smith said the idea of a private, secure Social Security number is no longer accurate.

Even though the problem is clear, experts say, there is no easy path to phase out Social Security numbers. Because so many institutions rely on them, it would require an enormous undertaking from businesses, and the idea of creating a new national ID could be politically risky, raising the Big Brother specter.

Still, the challenges are largely around the politics and policy of the plan, not technology.

“There’s good ideas out there. We’ve got to pick the best one and then start moving to implementation,” Joyce said. “It’s not going to be easy, but if we keep talking about it, we’ll still be talking about breaches in 10 years.”