From: sean@sdg.dra.com
Newsgroups: alt.privacy
Subject: Re: SSN as loan account number
Date: 15 Aug 92 08:43:53 GMT
Organization: Data Research Associates, St. Louis MO

In article <1992Aug15.000514.9281@colorado.edu>, bear@tigger.cs.Colorado.EDU (Bear Giles) writes:
> SSNs are supposed to be unique.  In practice they are not always unique,
> but in most situations people will catch a uniqueness violation _very_
> quickly.

This is why people hate computers.  We know we've got a flawed system, but it
is up to you to catch our errors.  Yes, we realize that your GPA may be harmed,
and your credit and good reputation damaged, but that's your problem.  Our 
computer says that SSN are unique.  What, you don't have a SSN because of
your religious beliefs, well I'm sorry but SSN is a mandatory field.

> 
> For instance, how long do you think a student will wait before reporting
> bad grades lowering his GPA, or a person will wait before informing a
> credit-card company that he has never had an account with them and please
> stop sending me dunning letters?

Yes, this happens to people.  It often takes them years to clean up the mess.
It is usually very difficult to correct because the people who designed the
databases on some of these systems where under the mistaken impression that
SSNs were a unique, positive form of identification.

> On the other hand, SSNs are universal.  There may be a rich son of a
> newspaper publisher somewhere (:-) who has never worked a day in his life,
> but most people now get a SSN by the time they are 2.  The only exception
> is foreign students, but that constitutes a small fraction of all users.

"Foreign" students are hardly the only exception.  And even if a large
portion of the population does have SSN, building a requirement in to the
database that you know is false even in a few cases is poor design.  Wait
until product liability suits catch up with computer programmers.

> 
> SSNs don't have check digits, but on an online system it doesn't matter.
> For billing purposes it's easy to make your account number 123-45-6789-x
> where x is a standard check digit.

If you are going to make up a checkdigit for the account number, why don't
you just make up an entire account number that you know is unique within
your database.  That way you also avoid losing the person's previous
records because they get a new SSN, and prevent mushing two people's records 
together because the same SSN was entered.

> 
> And so forth.  Granted, SSNs are not perfect, but they are close to a
> national ID number and in _many_ cases can be used as such.  Since this
> was a survey course it wasn't appropriate to dwell in the details of
> the possible abuses.
> 
> (BTW, this was in the context of a discussion of how to find unique
> identifiers.  There are many Bill Smiths, so name alone is not enough.
> Bill Smith at 1313 Mockingbird Lane isn't enough, since Mr Smith has
> a son named Bill Jr.  Toss in birthday and you're getting closer, as long
> as you don't have Bill & Bob Smith, twins, both going by B. Smith.  Etc).

SSNs are lousy as unique identifiers (and getting worse all the time).  If
you want to assign a unique identifier to every record in your database you
need to generate your own key.  Any externally assign key, not just SSNs,
will have problems.  Just because it was a survey course doesn't justify
wrong information.

-- 
Sean Donelan, Data Research Associates, Inc, St. Louis, MO
Domain: sean@sdg.dra.com, Voice: (Work) +1 314-432-1100
Newsgroups: alt.privacy