A new way to authenticate your identity?

updated 10:27 a.m. ET July 30, 2005

NEW YORK - Recent disclosures of massive data leaks at information brokers, banks and retailers have prompted Congress to once again consider tightening access to Social Security numbers, which have evolved into dangerous master keys for fraudsters.

But Social Security numbers already have come under a hodgepodge of restrictions over the years, and many experts question whether the new proposals would truly hinder identity theft.

In fact, reducing some companies' access to Social Security numbers could even worsen the situation.

Several identity theft watchdogs say the bills would neglect the deeper reason why financial fraud is relatively easy: Speed, not identity assurance, is the main priority of U.S. financial institutions that issue credit.

To be sure, the fact that many companies use Social Security numbers essentially as a password — not only are they the key to getting credit, they can also unlock access to an account over the phone — magnifies the problem. That's why Congress hopes to hide the numbers better — by reducing the ways they can be sold, for example, or by prohibiting them from being printed on benefit checks.

Even so, keeping the numbers and other personal data out of the wrong hands likely will remain tricky.

"It's too easy to get to data no matter what the key is, from insiders or hackers or mistakes," said Jody Westby, head of the security and privacy practice at PricewaterhouseCoopers LLP. "What we have to do is make it harder to use the data."

Westby's solution would be quite simple: universal use of the fraud alert, which identity theft victims are allowed to put on their credit reports for seven years. Before any new credit is granted, a card issuer or loan provider is supposed to call them and doublecheck that they, rather than an impostor, really made the application.

Putting everyone on fraud alert status would be a simple way of bringing more personal control to the system, Westby argues, just as do-not-call lists let people decide for themselves whether to talk to telemarketers.

In contrast, the data bills pending in Congress would make a lot of changes at once. Consumer advocates like many of the provisions, such as allowing people to refuse to give businesses their Social Security numbers, requiring more encryption of financial records and demanding widespread disclosure of data breaches.

Finer points in the bills are expected to change as several measures are combined in hopes of generating one likely to pass. But a look at some of the details shows the difficulty of restricting Social Security numbers.

For example, a proposal from Sens. Arlen Specter, R-Pa., and Pat Leahy, D-Vt., would prohibit data brokers from selling a Social Security number without the consent of the subject. But there are many exceptions. The numbers could be sold for "research" purposes, for example, or if just the last four digits are listed.

The latter exception "almost nullifies the entire bill," said Daniel Solove, a law professor at George Washington University and author of "The Digital Person." That's because the last four digits of any Social Security number are the only truly random part of the string. A savvy thief sometimes can determine the first five digits, because those are determined by where and when the number was granted.

And even if a fraudster doesn't get someone's exact number, he still might be able to obtain credit in that person's name.

Because the system is built to grant credit in a minute, there's a built-in tolerance for typographical errors or misprints such as transposed digits in the Social Security number.

MORE FROM SECURITY

Security Section Front

Debate over possible responses to cyber attacks   Experts work to untangle cyber attacks S. Korean Web sites under renewed attack White House among targets of cyber attack U.S. eyes N. Korea for ‘massive’ cyber attacks How a denial-of-service attack works A look at Estonia’s cyber attack in 2007 Researchers say they can guess your SSN Chinese go online to vent ire at Xinjiang unrest Dell launches digital forensics service for police Security Section Front   Add Security headlines to your news reader: