From: edp@math.zko.dec.com (Eric Postpischil)
Subject: Re: SSN as loan account number
Reply-To: edp@math.zko.dec.com (Eric Postpischil)
Organization: Digital Equipment Corporation
Date: Mon, 17 Aug 1992 13:41:17 GMT

In article <1992Aug15.000514.9281@colorado.edu>,
bear@tigger.cs.Colorado.EDU (Bear Giles) writes:

>For instance, how long do you think a student will wait before reporting
>bad grades lowering his GPA, or a person will wait before informing a
>credit-card company that he has never had an account with them and please
>stop sending me dunning letters?

Oh, a person would not wait very long at all.  But a bureaucracy can
take decades to fix a mistake.  A case was reported in the news in the
past few weeks in which two people born close to the same time and given
similar names were issued one SSN by the Social Security Administration.
One person apparently died, and the other is now in trouble for failure
to pay child support, et cetera.  The state government is garnishing the
wages of the living person and refusing to correct the problem.

This proves that Social Security Numbers are NOT proper keys, and NOBODY
should EVER rely on them as evidence of identity, particularly where a
person is to be penalized.

>SSNs don't have check digits, but on an online system it doesn't matter.
>For billing purposes it's easy to make your account number 123-45-6789-x
>where x is a standard check digit.

Implementing a check digit can only affect direct relations between
account holder and the issuer of the account.  Social Security Numbers
are commonly exchanged between banks, credit agencies, government
agencies, et cetera.  Without a standardized check digit, there is no
checking between these agencies.  A person could still obtain a credit
card, give your SSN, charge a lot to the card, and leave you hanging.

>And so forth.  Granted, SSNs are not perfect, but they are close to a
>national ID number and in _many_ cases can be used as such.

A national ID number is in itself a bad thing, because it causes loss of
privacy, loss of personal control over who uses the number (like the
criminal described above or like incompetent government agencies or
abusive private companies), et cetera.

>(BTW, this was in the context of a discussion of how to find unique
>identifiers.  There are many Bill Smiths, so name alone is not enough.
>Bill Smith at 1313 Mockingbird Lane isn't enough, since Mr Smith has
>a son named Bill Jr.  Toss in birthday and you're getting closer, as long
>as you don't have Bill & Bob Smith, twins, both going by B. Smith.  Etc).

You suggested SSN with a check digit.  As I pointed out, that is only
useful between a customer and the issuer.  If this is all that is
desired, there is a much simpler scheme that does not infringe upon
privacy or control.  Give the first person entered in your database the
number 1 (plus some check digits).  Give the next person 2.  Then 3, 4,
5, 6, and so on.  I guarantee the numbers you assign will each be unique
in your database.


                                -- edp (Eric Postpischil)
                                "Always mount a scratch monkey."
                                edp@alien.enet.dec.com