U.S. GOVERNMENT PUBLISHING OFFICE

33–871 WASHINGTON : 2019

SECURING AMERICANS’ IDENTITIES: 

THE FUTURE OF THE SOCIAL SECURITY NUMBER 

HEARING 

BEFORE THE

SUBCOMMITTEE ON SOCIAL SECURITY 

OF THE

COMMITTEE ON WAYS AND MEANS 

U.S. HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

SECOND SESSION 

MAY 17, 2018 

Serial No. 115–SS09 

Printed for the use of the Committee on Ways and Means 

( 


ralbany on LAP520R082 with HEARINGS
ii 

COMMITTEE ON WAYS AND MEANS 

KEVIN BRADY, Texas, Chairman 

SAM JOHNSON, Texas 

DEVIN NUNES, California 

DAVID G. REICHERT, Washington 

PETER J. ROSKAM, Illinois 

VERN BUCHANAN, Florida 

ADRIAN SMITH, Nebraska 

LYNN JENKINS, Kansas 

ERIK PAULSEN, Minnesota 

KENNY MARCHANT, Texas 

DIANE BLACK, Tennessee 

TOM REED, New York 

MIKE KELLY, Pennsylvania 

JIM RENACCI, Ohio 

KRISTI NOEM, South Dakota 

GEORGE HOLDING, North Carolina 

JASON SMITH, Missouri 

TOM RICE, South Carolina 

DAVID SCHWEIKERT, Arizona 

JACKIE WALORSKI, Indiana 

CARLOS CURBELO, Florida 

MIKE BISHOP, Michigan 

DARIN LAHOOD, Illinois 

BRAD R. WENSTRUP, Ohio 

RICHARD E. NEAL, Massachusetts 

SANDER M. LEVIN, Michigan 

JOHN LEWIS, Georgia 

LLOYD DOGGETT, Texas 

MIKE THOMPSON, California 

JOHN B. LARSON, Connecticut 

EARL BLUMENAUER, Oregon 

RON KIND, Wisconsin 

BILL PASCRELL, JR., New Jersey 

JOSEPH CROWLEY, New York 

DANNY DAVIS, Illinois 

LINDA SA ́ NCHEZ, California 

BRIAN HIGGINS, New York 

TERRI SEWELL, Alabama 

SUZAN DELBENE, Washington 

JUDY CHU, California 

GARY J. ANDRES, Staff Director 

BRANDON CASEY, Minority Chief Counsel 

SUBCOMMITTEE ON SOCIAL SECURITY 

SAM JOHNSON, Texas, Chairman 

MIKE BISHOP, Michigan 

VERN BUCHANAN, Florida 

MIKE KELLY, Pennsylvania 

TOM RICE, South Carolina 

DAVID SCHWEIKERT, Arizona 

DARIN LAHOOD, Illinois 

JOHN B. LARSON, Connecticut 

BILL PASCRELL, JR., New Jersey 

JOSEPH CROWLEY, New York 

LINDA SA ́ NCHEZ, California 


ralbany on LAP520R082 with HEARINGS
iii 

C O N T E N T S 

Page 

Advisory of May 17, 2018 announcing the hearing .............................................. 2 

WITNESSES 

Nancy Berryhill, Acting Commissioner, Social Security Administration ............ 6 

Elizabeth Curda, Director, Education, Workforce, and Income Security, Government Accountability Office ............................................................................. 16 

Samuel Lester, Consumer Privacy Counsel, Electronic Privacy Information 

Center .................................................................................................................... 39 

Paul Rosenzweig, Senior Fellow, R Street Institute ............................................. 51 

Steve Grobman, Senior Vice President and Chief Technology Officer, McAfee, 

LLC ........................................................................................................................ 61 

Jeremy A. Grant, Coordinator, Better Identity Coalition .................................... 72 

James Lewis, Senior Vice President, Technology Policy Program, Center for 

Strategic and International Studies ................................................................... 85 

MEMBER QUESTIONS FOR THE RECORD 

Rep. Sam Johnson to Elizabeth Curda .................................................................. 108 

Elizabeth Curda Response ...................................................................................... 109 

Rep. Sam Johnson to Jeremy A. Grant .................................................................. 111 

Jeremy A. Grant Response ..................................................................................... 112 

Rep. Sam Johnson to Steve Grobman .................................................................... 122 

Steve Grobman Response ........................................................................................ 123 

Rep. Sam Johnson to Paul Rosenzweig ................................................................. 126 

Paul Rosenzweig Response ..................................................................................... 127 

PUBLIC SUBMISSIONS FOR THE RECORD 

NAPBS, statement ................................................................................................... 128 


ralbany on LAP520R082 with HEARINGS

ralbany on LAP520R082 with HEARINGS
(1) 

SECURING AMERICANS’ IDENTITIES: 

THE FUTURE OF THE SOCIAL SECURITY 

NUMBER 

THURSDAY, MAY 17, 2018 

U.S. HOUSE OF REPRESENTATIVES, COMMITTEE ON WAYS AND MEANS, SUBCOMMITTEE ON SOCIAL SECURITY, Washington, DC. 

The Subcommittee met, pursuant to notice, at 10:08 a.m., in 

Room 1100, Longworth House Office Building, the Honorable Sam 

Johnson [Chairman of the Subcommittee] presiding. 

[The advisory announcing the hearing follows:] 


ralbany on LAP520R082 with HEARINGS
2 


ralbany on LAP520R082 with HEARINGS33871.001

<i) 

WAYS AND MEANS 

CHAIRMAN KEV I N BRADY 

Chairman Johnson Announces Hearing on 

Securing Americans' Identities: 

The Future of the Social Security Number 

House Ways and Means Social Security Subconunittee Chairman Sam Johnson (R-TX) 

announced today that the Subc01runittee will hold a hearing entitled "Securing 

Americans' Identities: The Future of the Social Security Nwnber." The hearing will 

focus on the dangers of the use of the Social Security number (SSN) as both an identifier 

and authenticator, and examine policy considerations and possible solutions to mitigate 

the consequences of SSN loss or theft. The hearing will take place on Thursday, May 

17, 2018 in 1100 Longworth House Office Building, beginning at 10:00 AM. 

In view of tbe limited time to hear witnesses, oral testimony at this hearing will be from 

invited witnesses only. However, any individual or organization may submit a written 

statement for c.onsideration by the Conunittee and for inclusion in the printed record of 

the hearing. 

DETAILS FOR SUBMISSION OF WRJTIEN COMMENTS: 

Please Note: Any person(s) and/or organization(s) wishing to submit written comments 

for the bearing record must follow the appropriate link on the bearing page of the 

Conunittee website and complete the infonnational forms. From the Conunittee 

homepage, http://waysandmeans.house.gov, select "Hearings." Select the hearing for 

which you would like to make a submission, and click on the link entitled, "Click here to 

provide a submission for the record.'' Once you have followed the online instructions, 

submit all requested infonnation. ATTACH your submission as a Word document, in 

compliance with the fonnatting requirements listed below, by the close of business on 

Thursday, May 31, 2018. For questions, or if you encounter technical problems, please 

call (202) 225-3625. 

FORMA lTING REQUIREMENTS: 
3 

f 


ralbany on LAP520R082 with HEARINGS33871.002

The Committee relies on electronic submissions for printing the official hearing record. 

As always, submissions will be included in the record according to the discretion of the 

Committee. ·n1e Conunittee will not alter the content of your submission, but we reserve 

the right to fonnat it according to our guidelines. Any submission provided to the 

Committee by a witness, any materials submitted for the printed record, and any written 

comments in response to a request for written comments must confonn to the guidelines 

listed below. Any submission not in compliance with these g11idelines will not be 

printed, but will be maintained in the Committee files for review and use by the 

C01mnittee. 

All submissions and supplementary materials must be submitted in a single document via 

email, provided in Word format and must not exc.eed a total of 10 pages. Witnesses and 

submitters are advised that the Committee relies on electronic submissions for printing 

the official hearing record. 

All submissions must include a list of all clients, persons and/or organizations on whose 

behalf the witness appears. The name, company, address, telephone, and fax numbers of 

each witness must be included in the body of the email. Please exclude any personal 

identifiable information in the attached submission. 

Failure to follow the fom1atting requirements may result in the exclusion of a submission. 

All submissions for the record are fmal. 

The Committee seeks to make its facilities accessible to persons with disabilities. Uyou 

are in need of special accommodations, please call202-225-1721 or 202-226-3411 

TTDITTY in advance of the event (four business days' notice is requested). Questions 

with regard to special accommodation needs in general (including availability of 

Committee materials in alternative formats) may be directed to the Committee as noted 

above. 

Note: All Committee advisories and news releases are available at 

http://www. waysandmeans.house.gov/ 
4 

Chairman JOHNSON. Good morning and welcome to today’s 

hearing on the future of the Social Security number. 

The Social Security card and the Social Security number were 

created in 1936, believe it or not, so the Social Security Administration could track earnings and correctly determine benefits. Today’s use of Social Security numbers for everything—you need one. 

So when you get a job, buy a house, or open a new credit card (sic). 

Given all the ways we use it, it is no wonder Social Security 

numbers are a valuable target for identity thieves. For years, I 

have been dedicated to doing all I can to protect America—Americans from identity theft by protecting the privacy of Social Security 

numbers. Military IDs no longer use Social Security numbers, and 

Medicare is now sending new cards without numbers, Social Security numbers, to seniors across the country. And last year Congress 

made all federal agencies stop mailing documents that contain Social Security numbers unless it is absolutely necessary. 

For a long time keeping Social Security numbers secret meant 

keeping them safe. But after so many high-profile data breaches 

like Equifax, OPM, and Anthem, where hundreds of millions of Social Security numbers were stolen, it is clear they aren’t a secret 

anymore. And it is time we stop pretending that they are. 

Make no mistake, it is still important to limit the unnecessary 

use of Social Security numbers. But if we want to keep pace with 

identity thieves, we need to think beyond just keeping them. 

As we will hear today, what makes these numbers so valuable 

to identity thieves is how we use them. Using Social Security numbers both to identify someone and to prove their identity doesn’t 

make sense. But we have been doing it forever. We need to break 

the link between identification and authentication. 

We will also hear from Social Security about what it takes get 

a new Social Security number when it has been stolen and why it 

is often harder to do than it should be. I recently learned of a case 

in Arizona where the mother of a child whose Social Security number had been stolen was told she needed to change her daughter’s 

name and last name—first, middle, and last name—before her 

daughter could get a new Social Security number. Can you believe 

that? That is wrong. 

But what is worse is that having to change your name isn’t Social Security’s policy. It was an extra hoop to jump through made 

up by a field office employee. While I am happy the little girl eventually got a new number without having to change her name, getting a new number shouldn’t be so difficult. It shouldn’t take a 

local news story or a call from a congressional office for Social Security to do right by those looking for help. 

Identity theft is on the rise, and we must take a hard look at the 

future of Social Security numbers, both how it is used, and if Social 

Security needs to do things differently. We have a responsibility to 

do all we can to better protect Americans from identity theft. 

I want to thank our witnesses for being here today and I look 

forward to hearing your testimony, all of you. 

And I will now recognize Mr. Larson for his opening statement. 

Mr. LARSON. Well, thank you, Mr. Chairman, and let me echo 

your sentiments and also acknowledge that you have been a leader 

in the United States Congress, both in protecting the integrity of 


ralbany on LAP520R082 with HEARINGS
5 

the Social Security program from fraud and abuse, and certainly, 

in this case, of identity theft which threatens the entire system. 

As you indicated, Mr. Chairman, the recent data breach at 

Equifax has left more than 145 million people wondering whether 

they will have their identity stolen or credit damaged. Their ability 

to get a mortgage, a small-business loan, or even a job is at the 

whim of criminals, who have stolen information to wreak havoc on 

their financial security. 

It doesn’t matter if you are in Plano, Texas or you are in East 

Hartford, Connecticut, or whether you are 6 weeks old or 96 years 

old. Cyber criminals don’t care. Their only interest is in profiting 

from your identity in a way that makes them as much money as 

possible. Unfortunately, Equifax is just one in a long list of data 

breaches where personal information about hard-working men and 

women has been compromised, including Social Security numbers, 

which is the subject of today’s hearing. 

The problem of identity theft is well known and it affects our entire economy. We need to come together in a bipartisan way to 

strengthen privacy protections and safeguard financial security. 

And I thank you, Mr. Chairman, for your continued efforts in 

reaching out along those lines, as well. 

What is clear, that all users of Social Security numbers, both 

government and business, need to change their ways. The widespread use of Social Security numbers as a way to both identify 

and authenticate individuals poses an ongoing risk of identity 

theft. This practice assumes that only I have access to my Social 

Security Number. 

But given the extensive data breaches, this is no longer a safe 

assumption, as I believe our witnesses will all agree. There is a 

role here both for government and for industry. 

Unfortunately, there are steep headwinds in this fight. The pace 

of innovation in the technologies used by cyber criminals present 

a very difficult and foreboding challenge. At the same time, we 

must be sure that the solutions to better protect personal information are accessible to all Americans, even those of us who are less 

adept at the new technologies. 

Finally, we must keep Americans’ privacy concerns in mind 

about how data is collected about individuals, how it is used, and 

who controls it. Just as we must come together to protect Americans’ personal identity information, we should also come together 

to protect the future of Social Security itself. 

I know my dear friend and colleague shares my concern in this. 

I think we need to have a hearing on the future of Social Security 

itself. We have proposed bills and legislation. It is time that we expand the most successful program in the Nation’s history, knowing 

that as we go forward it is important to protect it at its very heart 

to secure it from fraud and abuse, but also to understand that this 

is an insurance program that needs to be made actuarially sound, 

that was last touched in 1983, when Ronald Reagan was President 

and Tip O’Neill was Speaker of the House. 

It is an actuarial problem that can and should be addressed to 

not only protect the future of Americans, but also, as disparity 

grows in this great country of ours, the one thing that every single 

person in this Nation can count on is that Social Security has never 


ralbany on LAP520R082 with HEARINGS
6 

missed a payment. We have an obligation on this Committee, and 

as Members of Congress, to make sure that the integrity of the program and also its viability goes beyond the 75-year requirement 

that we are sworn to serve. 

And with that, Mr. Chairman, I yield back and look forward to 

the questions and what we are—look forward to asking questions, 

and look forward to hearing from our distinguished panel. 

Chairman JOHNSON. Well, thank you for your comments. As is 

customary, any Member is welcome to submit a statement for the 

record. 

And before we move on to testimony, I want to remind our witnesses to please limit your oral statements to five minutes. However, without objection, all of the written testimony will be made 

a part of the hearing record. 

We have seven witnesses today. Seated at the table are Nancy 

Berryhill, acting commissioner of Social Security Administration; 

Elizabeth Curda, director, education, workforce, and income security for Government Accountability Office; Samuel Lester, consumer privacy counsel, Electronic Privacy Information Center; Paul 

Rosenzweig—and that is not right—Paul—— 

Mr. ROSENZWEIG. It is Rosenzweig, sir, but—— 

Mr. JOHNSON. Rosenzweig? 

Mr. ROSENZWEIG. Yes, sir. 

Mr. JOHNSON. Thank you. Senior fellow, R Street Institution. 

Steve Grobman, senior vice president and chief technology officer, 

McAfee; Jeremy Grant, coordinator, Better Identity Coalition; 

James Lewis, senior vice president, technology policy program, 

Center for Strategic and International Studies. 

Acting Commissioner Berryhill, please begin your testimony. 

STATEMENT OF NANCY BERRYHILL, ACTING COMMISSIONER, 

SOCIAL SECURITY ADMINISTRATION 

Ms. BERRYHILL. Chairman Johnson, Ranking Member Larson, 

and Members of the Subcommittee, thank you for inviting me to 

discuss identity theft and the future of the Social Security number. 

I am Nancy Berryhill, Social Security’s acting commissioner. 

The scope of our programs is enormous. We pay monthly benefits 

to over 62 million Social Security beneficiaries and 8 million supplemental security income recipients. During fiscal year 2017 we 

paid about $934 billion to Social Security beneficiaries, and $55 billion to SSI recipients. In addition, we posted 279 million earning 

items to workers’ records last year. 

The SSN underpins the programs we administer. We designated 

this 9-digit number in 1936 to allow employers to accurately report 

earnings and determine eligibility for benefits. To date we have 

issued around 505 million unique numbers to eligible individuals. 

Although we created the Social Security number for our programs, it has become a personal identifier used most broadly across 

government and the private sector. For example, in 1943 the executive order required federal agencies to use the SSN. Advances in 

computer technology and data processing in the 1960s further increased the use of the number within federal agencies. 

For example, in 1961 the Federal Civil Service Commission 

began using the SSN as identification number for all federal emVerDate Sep 11 2014 05:09 Apr 25, 2019 Jkt 033871 PO 00000 Frm 00010 Fmt 6633 Sfmt 6602 I:\WAYS\IN\33871\33871.XXX 33871

ralbany on LAP520R082 with HEARINGS
7 

ployees. The next year the IRS began using the number as a taxpayer identification number. Beginning in the 1970s, Congress enacted legislation requiring the number for a variety of federal programs. Over the decades use of the SSN grew, not just in Federal 

Government, but throughout the state and local government, 

banks, credit bureaus, hospitals, and other parts of the private sector. 

As use of the SSN has increased, so have the opportunities for 

misuse. We and Congress have made changes to try to protect the 

integrity of the number, including strengthening the security of the 

SSN card, and requiring additional proofs to issue them; establishing programs and ensure accurate and timely of the SSN (sic), 

such as enumeration at birth, program that assigns SSNs to 

newborns, and verifying SSNs for federally-funded programs, employment eligibility, and other programs. 

Unfortunately, SSN misuse and identity theft continues to increase. We understand the distress and economic hardship victims 

of identity theft face. We advise suspected victims on how to contact the Federal Trade Commission and law enforcement, and we 

refer cases of misuse to our office of inspector general for investigation. In certain circumstances we assign a new number to a victim 

of SSN misuse who has been disadvantaged due to misuse of the 

number. 

It is important to note that assigning a new number is often a 

last resort, because it can cause more problems than it solves. For 

example, the absence of a credit history under a new number 

makes it more difficult to obtain credit to buy a house or a car. 

Nevertheless, in recognition of devastating effects identity theft can 

have, we continue to refine our policies in this area. Our goal is to 

serve the needs of the victims. 

Over the years we have added flexibilities to our policies where 

needed, and we encourage front-line employees to coordinate with 

experts in our regional offices. We will continue to do what we can 

to mitigate the effects of SSN misuse. 

We—but we cannot alone solve the problem that over-reliance of 

the SSN has caused. As long as the SSN remains key to assessing 

things of value, particularly credit, the SSN itself will have commercial value, and it will continue to be targeted by fraudsters for 

misuse. 

Identity theft is a broad public policy issue that must be addressed. I applaud the chairman and the Subcommittee for their efforts to protect the SSN, including mandating the removal of the 

SSN from the Medicare cards and documents mailed by federal 

agencies. These bills are an important step. 

However, addressing identity theft requires a unified effort that 

includes this Subcommittee and Congress, the Administration, public and private experts throughout the country. 

Our chief information officer, who is sitting behind me, Rajive 

Mathur, is here with me today. He and I look forward to hearing 

the ideas raised during today’s hearing. 

Thank you, and I will be happy to answer any questions that you 

may have. Thank you. 

Chairman JOHNSON. I appreciate your testimony. 

[The prepared statement of Ms. Berryhill follows:] 


ralbany on LAP520R082 with HEARINGS
8 


ralbany on LAP520R082 with HEARINGS33871.003

COMMITTEE ON WAYS AND MEANS 

SUBCOMMITTEE ON SOCIAL SECURITY 

U.S. HOUSE OF REPRESENTATIVES 

May 17, 2018 

STATEMENT FOR THE RECORD 

NANCY A. BERRYHILL 

ACTING COMMISSIONER 

SOCIAL SECURITY ADMINISTRATION 
9 


ralbany on LAP520R082 with HEARINGS33871.004

Cbainuan Johnson, Ranking Member Larsoo, and Members of the Subcommittee: 

Thank you for inviting me to discuss the Social Security number (SSN) and card. I am 

Nancy BerryhiJJ, Acting Commissioner of the Social Security Administration. My testimony 

today describes the development of the SSN for the administration of Social Security programs 

and our ongoing efforts to ensure its integrity. 

As you know, use of the SSN as an effective record-keeping tool has expanded far beyond its 

original and primary purpose. I hope our efforts show that we are committed to doing what we 

can to mitigate the harm resulting from SSN misuse and identity theft. But these issues extend 

beyond our programs, and solutions require commitment !rom the public and private sectors. I 

commend you for holding this hearing today. 

The SSN and Our Programs 

When the Social Security program was enacted under the Social Security Act of 1935 (Act), the 

Act did not mandate the use of SSNs but authorized the creation of some type of record-keeping 

system. Names alone could not ensure accurate wage reporting. We designed the nine-digit 

SSN to allow employers to uniquely identifY and report an individual's earnings covered under 

the new Social Security program, and to help us track earnings, detern1ine eligibility for benefits, 

and pay the correct benefit amount. We also developed the SSN card to show the SSN assigned 

to a particular individual to assist employers in properly reporting earnings. 

Today, over 80 years since the program's inception, the SSN remains at the core of our recordkeeping processes and is essential to carrying out our mission. We use the SSN to administer the 

Retirement, Survivors, and Disability Insurance programs, commonly referred to as "Social 

Security." We also usc the number to administer the Supplementa l Security Income (SSI) 

program, which provides monthly payments to people with limited income and resources who 

are aged, blind, or disabled. 

Through the use of the SSN, in Fiscal Year (FY) 20 17, we posted 279 million earnings items to 

workers' records. Based on wages reported using the SSN, on average, each month we pay 

Social Security benefits to over 62 million individuals. We also pay SSI benefits to over 8 

million individuals. In total, during FY 2017, we paid about $934 billion to Social Security 

beneficiaries, and about $55 billion to SSI recipients. That same year, we assigned over 5.8 

million original SSNs and issued nearly I 0.6 million replacement SSN cards. To date, we have 

issued around 505 million unique numbers to eligible individuals. 

Expansion of SSN Use for Other Purooscs 

Many factors led to the expanded use of the SSN over time. The universality and ready 

availability of the number made the SSN a convenient means of record-keeping in other large 

systems of records. lu 1943, for example, Executive Order 9397 required Federal agencies to 

use the SSN in any new system for distinguishing individuals. Then, beginning in the 1960s, 

SSN use expanded quickly due to advances in computer technology as government agencies and 

private organizations began using automated data processing and record keeping. 
10 


ralbany on LAP520R082 with HEARINGS33871.005

In 1961 , the Federal Civil Service Commission began using the SSN as the identification number 

for all Federal employees. The next year, the Internal Revenue Service began using the number 

as its taxpayer identification number. ln 1967, the Department of Defense adopted the SSN as 

the service number for military personnel. 

In the 1970s, Congress enacted legislation requiring an SSN for applicants to receive assistance 

under the Aid to Families with Dependent Children program (succeeded by Temporary 

Assistance for Needy Families), Medicaid, and food stamps. Additional legislation authorized 

States to use the SSN in the administration of taxes, general public assistance, driver's licenses, 

or motor vehicle registration laws within their jurisdiction. In the 1980s and 1990s, legislation 

required the use of the SSN in employment eligibility verification and military draft registration, 

among other things. The 1996 welfare reforn1 law required the SSN to be recorded in a broad 

array of records- including applications for professional licenses, marriage licenses, divorc·e 

decrees, support orders, and paternity determinations- to improve child support enforcement. 

The 1996 Jaw also included SSN requirements for purposes of obtaini11g the Earned Income Tax 

Credit, and in just the last few years, Congress has enacted SSN requirements for eligibility for 

additional tax credits, such as the Child Tax Credit. These examples are not exhaustive, but 

illustrate the growth of the use of the SSN within the Federal government. 

Use of the SSN by the Private Sector 

Use of the SSN for computer and other accounting systems spread, not just throughout State and 

local governments, but to banks, credit bureaus, hospitals, educational institutions, and other 

parts of the private sector. Generally, there are no restrictions in Federal law on the use of the 

SSN by the private sector. For example, businesses may ask for a customer's SSN to apply for 

credit cards, obtain medical services, and apply for public utilities. A customer may refuse to 

provide the number; however, a business may, in tum, decline to funlisb the product or service. 

TI1e SSN not only allows businesses to track and identifY individuals, it also allows them to 

exchange infonnation about these individuals. Over the last decade, additiona l advances and 

trends in technology fostered the growth of data aggregators who amass and sell large volumes 

of personal information, including SSNs, collected by businesses. Generally, data aggregators 

use the SSN to store and retrieve inforu1ation about an individual because it is such an easy, 

universal method to maintain individual records. 

Responding to the External Use of the SSN 

While not intended, the SSN has become the personal identifier most broadly used by both 

government and the private sector to establish and maintain information about individuals. 

Before the widespread use of the SSN outside of Social Security programs (for purposes such as 

establishing credit), there were few incentives to obtain fraudulent SSNs or counterfeit cards. 

However, as the use of the SSN expanded, so too did incentives to obtain fraudulent SSNs, 

giving rise to concerns about the integrity of the number and card. Working with Congress, we 

have made changes to protect the integrity of the number. These efforts focus on increasing the 

2 
11 


ralbany on LAP520R082 with HEARINGS33871.006

security of the SSN and card, confirn1ing the authenticity of the SSN and card through SSN 

verifications, and educating the public. The following are examples of some of our key efforts. 

Strengthening !he SSN and Card 

In the beginning of the program, and for many years thereafter, we assigned SSNs and issued 

cards based solely on the applicant's allegation of name, date of birth, and other personal 

information. We required no documentation to verify an individual's identity. We began adding 

documentation requirements in the I 970s as a result of statutory changes to the Act. By 1978, 

we required evidence of age, identity and citizenship/alien status from all applicants for original 

SSNs, as well as evidence of identity for replacement cards. 

Today, we use a robust application process requiring SSN applicants to submit evidence of age, 

identity, and United States citizenship or current work-authorized immigration status. Geuerally, 

individuals (other than newborns) must come into an SSA field oftice or Card Center to apply for 

an original SSN and card. We require an in-person interview for all applicants age 12 or older. 

During the interview, we allempt to locate a prior SSN to help ensure that we do not assign an 

SSN to an individual assuming a false identity. 

These policies comply with requirements enacted in the Intelligence Refonn and Terrorism 

Prevention Act (IRTPA) of2004, which include: 

New, rigorous minimum standards for verification of documents submitted in connection 

with an SSN; 

• The addition of death and fraud indicators to SSN verification routines for employers and 

for State agencies issuing driver's licenses and identity cards; and, 

• Limiting individuals to 3 replacement SSN cards per year and I 0 per lifetime (with 

limited exceptions). 

We have also established programs to ensure the accurate and timely assignment ofSSNs, and to 

provide convenient public service options. Through these programs, we coordinate with other 

govenm1ent agencies- the custodians ofthe very records we use to assign SSNs- to obtain the 

information they collect and verify electronically. Because we work directly with the custodians 

of the evidence records we need, individuals who choose to use these programs do not need to 

visit our offices to present their documents in person. 

• The Enumeration at Birth (EAB) program allows parents to obtain SSNs for their 

newborns as part of the birth registration process. The evidence required to process an 

SSN application is the same evidence gathered by hospital.s and birthing facilities and 

verified by bureaus of vital statistics (BVS) during the birth registration process. 

Through EAB, BVSs electronically send us the information we need; we assign the 

number and issue the card. Today, all 50 States plus Puerto Rico, New York City and the 

District of Columbia participate. In FY 20 I 7, we assigned over 3.8 million SSNs through 

EAB. 
12 


ralbany on LAP520R082 with HEARINGS33871.007

The Enumeration at Entry (EAE) program allows lawful pennanent residents (LPRs) to 

obtain SSNs as part of the immigrant visa process. Once the Department of State 

approves the visa, it transmits identifying information from the visa application to the 

Department of Homeland Security (OHS); DHS, in tum, transmits to us the data we need 

when the person enters the country. In FY 2017, we assigned over 27 1,000 SSNs and 

issued about 7,600 replacement cards through EAE. 

The Enumeration Beyond Entry (EBE) program-our newest program- allows lawfully 

present noncitizens to obtain an SSN when DHS provides them work authorization. DHS 

sends us the information it collected and verified when approving the request for work 

authorization. We implemented this process in October 2017, and have used it to assign 

about 106,000 SSNs and issue about 14,000 replacement cards through April2018. 

Like evidence requirements, at the inception of the program, there were no specific requirements 

regarding the SSN card. However, as use of the SSN and card increased and technology 

improved, so too did counterfeiting concerns. In 1983, Congress amended the Act to require that 

SSN cards be made ofbanknote paper and be cotmterfeit-resistant to the maximum extent 

practicable. In 2007, pursuant to IRTPA, we implemented additional changes to the card based 

on interagency taskforcc recommendations. TI1e new security features include: 

A g11illoche background pattern, which is a unique, computer-generated, non-repeating 

spiral design; 

A latent image, visible only when viewed at specific angles; 

Color shifting inks, like those in the Nation's cutTency, that create a noticeable color shift 

when moved in front of a light source; and 

The card issuance date, reflecting the date we processed the card application. 

SSN Verifications 

In 1984, shortly a tier amending the Act to require a banknote paper card, Congress added a new 

income and eligibility verification system aimed at reducing improper payments of Federallyfunded benefits (e.g., Medicaid, Supplemental Nutrition Assistance, and Unemployment 

Insurance). Verification of the SSN is a key aspect of this system; we confmn whether the 

name, SSN, and in most cases date of birth, provided by an individual match the information in 

our records. 

Since then, Congress has mandated the verification ofSSNs for such varied purposes as DHS's 

E-Verify program, health care programs, voter registration, drivers' licensing, and many others. 

So, the use ofSSN verifications has grown dramatically. Today, we perform over 2 billion SSN 

verifications a year. 

Public EducaTion 

We also focus on educating the public about how they can protect their SSNs. We advise 

individuals to avoid sharing their SSNs. We encourage them to keep their cards in a safe place 
13 


ralbany on LAP520R082 with HEARINGS33871.008

and not to carry them, or any documents displaying their SSNs, with them unless an employer or 

service provider insists on seeing it. 

In addition, we: 

Post Frequently Asked Questions on our website that address questions related to identity 

theft and the various ways we protect SSNs 1

; 

Post publications that specificaUy address identity theft and how an individual can protect 

his or her SSN2; 

Provide articles for publication in local newspapers nationwide urging people to protect 

their SSNs and cards; 

Broadcast best practices, such as "Tips to Prevent Identity Theft," on televisions in field 

office lobbies, to explain bow individuals can protect themselves from identity theft; and, 

Collaborate with the Federal Trade Commission (FTC) to educate the public through 

local seminars and public infom1ation materials. 

Identity Theft 

Unfortunately, SSN misuse and identity theft- particularly pairing fraudulent identity 

information with valid information, known as synthetic identity theft-continue to increase. As 

DHS has advised us, part of this problem results from the use of stolen or made-up SSNs to 

secure work by individuals, for example, who are not authorized to work (such as aliens without 

work authorization) or are attempting to underreport earnings. In addition, according to our 

Office of the Inspector General, identity thieves often target children because their credit 

histories are clean, and their records may be used for years before anyone realizes someone has 

stolen their identities or misused their SSNs.3 

We understand the frustration, distress, and economic hardship SSN misuse and identity theft 

cause victims. As a matter of practice, online and in our oflices, we provide individuals who 

suspect their identities have been stolen up-to-date information about steps they can take to work 

with credit bureaus, law enforcement agencies, and the FTC. We develop cases of possible fraud 

and refer them to our Office of the Inspector General for investigation as appropriate. 

In certain circumstances, we will assign new, different numbers to victinls of SSN misuse who 

suffer disadvantage due to the misuse of their SSNs. It is important to note that assigning a new 

number is often a last resort because, unfortunately, given the pervasiveness of the SSN in daily 

life, a new number may cause the victim greater problems than the ones they arc trying to solve. 

For example, the absence of history under the new SSN may itself cause difficultiesparticularly a lack of credit history under the new number, which may make it more difficult to 

obtaiJt credit, buy a car, or get a mortgage. 

1 e.g., hnps://fag.ssa.govllink/porlal/34011/34019/Ar1icle/3790/Can-l-get·a.<fifl'ereni·Social-Securily·munber-if-Iam-a-victim-of-idcnlily·lhcfl 2 e.g., " ldenlityThcfl and Your Social SecW'ity Numbe•·," at www.socialsecurity.gov/pubs/EN·05-10064.!ldf 

'See SSA Office of the Inspector General, Potential Misuse of Foster Children's Social Security Numbers, A-08-

12-11253 (Sept. 25, 2013). 
14 


ralbany on LAP520R082 with HEARINGS33871.009

In the past, our policies required that evidence of disadvantage resulting from SSN misuse be 

recent, occurring within the year preceding ihe request for a new number. In recognition of the 

devastation identity theft poses, and the fact that it may not manifest immediately, we 

re-evaluated this policy and made several key changes. First, we lengthened the look-back 

period; we now allow for evidence of disadvantage within the two yea.rs preceding the request 

for a new number. This timeframe covers the majority of requests, and technicians may extend 

the two-year window further depending on the circumstances. Second, we advise frontline 

employees to consult regional office specialists regarding complex cases. This allows us to 

better serve the needs of victims of misuse and identity theft by ensuring consistent application 

of policy and leveragi11g the expertise of regional office employees. Third, we added examples 

to our procedural instructions to illustrate the different ways an individual may be disadvantaged 

due to SSN misuse. 

Recently, we published a policy clarification regarding child SSN misuse cases. We reminded 

our frontline employees that child cases can be different from adult cases. When SSN misuse 

has occurred with a child's number, the hann caused by the misuse- particularly credit 

damage- may go undetected by the child and parents for years. As a result, we instntct 

employees to carefully consider all evidence of disadvantage, and we remind them to coordinate 

closely with their regional offices. I want to thank the Subcommittee for alerting us to a specific 

case that demonstrated the need for a policy clarification in this area. 

We encourage everyone to establish a my Social Security account. Doing so ensures that no one 

else can open an account with their SSN. We also educate individuals who suspect they may be 

victims of identity theft about how to block access to SSA electronic services. This block 

prevents all automated telephone and electronic access to Social Security records, as well as 

online claims. When we assign a new, different number, we automatically place a fraud 

indicator on the original number. This fraud indicator blocks the number from being used to 

establish a my Social Security account or get a replacement SSN card, or from verifying under 

our verification services for employers, driver's license-issuing entities, and others. 

Going forward, we will continue to refine the role that our Special Assistant U.S. Attorneys 

(SA USA) play in prosecuting SSN misuse. SAUSAs currently prosecute cases of alleged Social 

Security fraud that would not otherwise be prosecuted in Federal courts. We plan to maintain a 

corps of35 SAUSAs in FYs 2018 and 2019. Their work is valuable in prosecuting c1urcnt fraud 

and deterring potential future bad actors. 

Moving Forward with New Solutions 

We know the large challenges associated with fully addressing the dangers posed by identity 

theft. As long as the SSN remains key to accessing things of value-credit, loaJlS, and financial 

accounts, and thus numerous common goods and services- the SSN itself will have cotrunercial 

value, and it will continue to be targeted for misuse. At SSA, we take seriously the integrity of 

the SSN. We will continue to do what we can to prevent and mitigate the effects of SSN misuse 

and identity theft, and we wiU continue to evaluate new teclmologies and data to better secure 

the number. But just as we cannot control how other entities use tbe SSN for outside purposes, 

we alone cannot solve the problem overreliance on the SSN has caused. 

6 
15 

f 


ralbany on LAP520R082 with HEARINGS33871.010

Identity theft is a broader public policy issue. l applaud the Chairman and this Subcommittee for 

their efforts to protect the SSN. The "Medicare Access and CHIP Reauthorization Act o/2015" 

required the removal of the SSN from Medicare cards. We are pleased to support the Centers for 

Medicare and Medicaid Services (CMS) in its efforts to implement this bill, and I am happy to 

note the CMS has just begun issuing the new cards. TI1e Social Security Number Fraud 

Prevention Act of2017 restricted the inclusion of SSNs on documents mailed by Federal 

Agencies. As we promised this Committee, we have continued our work to remove the SSN 

from notices where we can. Last month, we removed the SSN from benefit verifications, postentitlement notices, and certain documents sent to appointed representatives. The 

Administration also encourages Congress to pass legislation with a requirement that employers 

use DHS's E-Verify system, such as the requirements in the Legal Workforce Act. Mandatory 

use of £-Verify by employers would help reduce the incidence of fraudulent use ofSSNs. We 

would be happy to work with you as you contemplate that or similar legislation. 

These bills are an important step. However, because identity theft is a pervasive issue, 

addressing it requires a unified effort that includes this Subcommittee and Congress, the 

Administration, and public and private experts throughout the country. Any solution must be a 

durable and comprehensive one in order to reduce and ultimately prevent identity theft 

throughout public and private industry. 

Conclusion 

As this Subcommittee- and Congress as a whole-considers how to address identity theft, I 

urge them to keep in mind that we designed the SSN to administer Social Security programs. 

We never intended the SSN to serve as the universa l personal identifier it has come to be. 

TI1ank you for the opportunity to discuss these very important issues. I will be happy to answer 

any questions you may have. 
16 

Chairman JOHNSON. Ms. Curda, welcome again. Please proceed. 

STATEMENT OF ELIZABETH CURDA, DIRECTOR, EDUCATION, 

WORKFORCE, AND INCOME SECURITY, GOVERNMENT ACCOUNTABILITY OFFICE 

Ms. CURDA. Chairman Johnson, Ranking Member Larson, and 

Members of the Subcommittee, thank you for inviting me here to 

discuss GAO’s observations on the extent to which the paper Social 

Security card is currently used, and what it costs to produce. 

SSA has issued about 500 million Social Security numbers and 

cards since the Social Security program began in 1935. Originally, 

the SSN was not intended to serve as a personal identifier outside 

of SSA’s programs. But due to its universality and uniqueness, government agencies and private-sector entities increasingly use the 

SSN as a convenient means of identifying people. 

However, as everyday transactions are increasingly conducted 

electronically, it raises questions about whether a paper card is 

still needed or desirable to communicate or verify a person’s SSN. 

Today I will first discuss whether there are any federal requirements to present a Social Security card. Second, I will discuss common situations in which other public or private-sector stakeholders 

may ask to see the card to conduct business. And finally, I will discuss stakeholder views about the potential implications of eliminating the cards, including potential cost savings. 

Although there are many federal requirements to provide an 

SSN, we found no statutory requirements and only two regulatory 

requirements to show a card. Both requirements were to verify an 

individual’s SSN under certain narrow circumstances such as for 

uniformed service members seeking to change their SSNs. 

To identify requirements or customary uses of the cards outside 

of the Federal Government we spoke to a variety of associations 

representing human resource managers, the finance sector, higher 

education institutions, and state agencies. The stakeholders we 

spoke with described a variety of instances in which individuals 

may present a card among other acceptable forms of documentation 

in order to verify their identity or their SSN. 

For employment, all U.S. employers must verify and document a 

newly-hired employee’s employment eligibility. Although the Social 

Security card is the most commonly used document for this purpose, the card is one of several acceptable documents that employees may present to prove they are eligible to work in the United 

States. Other examples of acceptable documents include a U.S. 

passport or permanent residence card, among others. 

A common reason employers may ask to see a card is to verify 

the accuracy of the employee’s SSN because employers can be fined 

for submitting inaccurate W–2 forms, for example. 

The card is also commonly used to apply for a driver’s license 

under the Real ID Act of 2005. The card is one of several options 

for documents that an applicant must provide to verify their identity. 

The card may also be used as documentation when setting up financial accounts or to resolve SSN discrepancies when processing 

educational loans. However, providing the card is not required. 


ralbany on LAP520R082 with HEARINGS
17 

SSA and the stakeholders we interviewed also provided their perspectives on the implications of eliminating the card. One advantage of showing the card is to ensure the accuracy of the SSN, instead of relying on someone’s memory. A disadvantage stakeholders 

cited included that the card alone is not sufficient to ensure the 

identity of the card holder, so other forms of identification are usually needed. 

However, most of the stakeholders we interviewed indicated that 

their processes would not change significantly if the card were 

eliminated. They would continue to collect SSNs, as required, but 

would use other documents for identification or verification purposes, or electronically verify the SSN with SSA. 

SSA officials also provided their perspective that eliminating the 

card may result in limited cost savings, if any. In 2016, SSA estimated that the cost to produce a card ranged from $6 for a replacement card requested online to $34 for a card requested in person 

at a field office. These estimates include staff time, technology, 

paper, printing, postage, and overhead. If the card were eliminated, 

only some of these costs would be saved because of the labor and 

other costs still needed to generate new SSNs. 

A conservative estimate of the savings based on the printing, paper, and mailing costs accounts for only $.60 of the cost of the 

card. SSA officials stated that the agency spent about $8 million 

in fiscal year 2016 on paper, printing, and delivery of the cards. 

However, implementing a new system to replace the card could offset these savings. 

Other implications of a cardless electronic system, stakeholders 

cited, included security and control over personal information and 

potential barriers for people with limited access to technology. 

This concludes my prepared statement, and I would be happy to 

answer the Committee’s questions. 

Chairman JOHNSON. Thank you. I appreciate your testimony. 

[The prepared statement of Ms. Curda follows:] 


ralbany on LAP520R082 with HEARINGS
18 


ralbany on LAP520R082 with HEARINGS33871.011

For Release on Delivery 

Expected at 10 a.m. EDT Thursday. May 17. 2018 

GA0-18-507T 

United States Government Accountability Office 

Testimony 

Before the Subcommittee on Social 

Security, Committee on Ways and 

Means, U.S. House of Representatives 

SOCIAL SECURITY 

ADMINISTRATION 

Observations on Use 

and Costs of 

Social Security Cards 

Statement of Elizabeth H. Curda, Director, Education, Workforce, and Income Security 
19 


ralbany on LAP520R082 with HEARINGS33871.012

GAO 

Highlights 

Htghllght$ OI.(;A().1B·S07t, $ lesbt'nOny 

btforo tho Svb<lon'llmloo on SOC:iel SO<:un.tv, 

COtnmll1oo on WayS and Moans, Hou$0 oc Reprosenlabvos 

Why GAO Did This Study 

SSA has Issued about 500 million 

SSNs and cards since the flfSt design 

of the SSN and card in 1936. SSA provides a card to each individual 

when it issues an SSN, as required by 

law, and al$0 issues replacement 

cards upon request Conc:ems about 

costs and identity security in an 

increasingly paperless society have 

raised the question of wllether a paper 

SSN card Is still needed. GAO was 

asked to examine the use of the card. 

This testimony focuses on (1) federal 

requirements fof individuals to present 

an SSN card: 2) stakeholder views on 

the purposes for which the cards are 

used; and (3) potential implications of 

eliminating SSN cards and deve&oping 

alternative approaches. 

GAO reviewed federal Jaws and 

regulations; reviewed SSA fiscal year 

2016 data on card costs (the most 

recent year available); conducted a 

literature search to identify paperless 

identfficat~n atternatives; and 

interviewed SSA officials, as well as 

federal, state, and private sector 

stakeholders that may need and are 

legally authorized to collec1 an SSN. 

Stakeholders included associations 

representing state agencies, financial 

institutions, and human resource 

managers. 

What GAO Recommends 

GAO is not making any 

recommendations. DHS and SSA 

provided technical comments, wlllch 

we Incorporated as appropriate. 

VII.Wt GA0·18-50TT. For mofO tnrormabOo, 

oonS8el IIZ&~h CUI'd8 8t (202) 512 721$ Of 

curdae@gao.gav 

SOCIAL SECURITY ADMINISTRATION 

Observations on Use and Costs of Social Security Cards 

What GAO Found 

GAO Identified two federal requirements for individuals to show a Social Security 

card. Based on a search of federal statutes and regulations, GAO did not identify 

any federal statutory requirements for individuals to present their Social Security 

card. GAO identified two federal regulations that require individuals to present 

their card in order to verify their Social Security number (SSN) in certain 

circumstances, such as when updating a service membe(s or dependent's SSN 

information in certain Department of Defense re<:ords systems. 

Stakeholders we interviewed identified certain situations where, even though not 

required, the card is commonly used to verify Identity or an SSN. For example, 

offiCials from an association representing human resource managers said the 

card is one option on a list of acceptable documents that employees can present 

to prove they are eligible to wor1< In the United States. Financial and education 

association officials told GAO that they may. in rare circumstances request the 

card ff there is a discrepancy with the SSN provided by the individual. 

Representatives from an association of state human services agencies also told 

GAO that the card is not required vmen applying lor certain public benefit 

programs, such as the Supplemental Nutrition Assistance Program, although 

applicants may use it as a fonn of Identification. 

Organizations who use SSNs said eliminating the paper card would not change 

their current processes. Social Security Administration (SSA) officials and 

stakeholders we interviewed cited some issues to consider lor use of cards and 

for attemative approaches, including: 

• Identity verification: According to stakeholders, the card can help ensure 

an SSN is re<:orded accurately. However, they also noted that it is not 

sufficient to verify identity, and stakeholde<s often require electronic 

verification of SSNs. 

• Cost: SSA officials said eliminating the card may result in only limited oost 

savings. ff any, and alternatives may eteate new costs. In fiscal year 2016. 

SSA estimated that the oost to produce a card ranged from S6 to S34. 

depending on the mode by which the card was requesled, including staff 

time. technology, printing, and postage. Officials said that printing and 

mailing account for only 60 cents ofthat cost. In fiscal year 2016. SSA 

officials stated that the agency spent about $8 million on printing and delivery 

of the cards. SSA officials said they have not developed oost estimates lor an 

alternative system because the law requires SSA to issue cards. 

• Other f actors: Stakeholders aJso said there are other issues to consider in 

developing electronic approaches, including privacy, oost. and the effect on 

vulnerable populations. such as individuals with limited access to computers. 

Several government entities, including the Department of Homeland Security 

(DHS) and foreign governments. have begun to use electronic methods rather 

than cards to authenticate fndividual identities. For example, one electronic 

method allows users to print a copy or a document that contains identity 

information, n needed, although the document is maintained in an electronic 

system. 

-------------Unlled St•tN Govemment AccounttbiUty Oft'lc. 
20 


ralbany on LAP520R082 with HEARINGS33871.013

Chairman Johnson, Ranking Member Larson, Members of the 

Committee: 

Thank you for the opportunity to discuss our work on the use of Social 

Security cards. The Social Security Administration (SSA) has issued 

about 500 million Social Security numbers (SSN) and cards since the first 

design of the SSN and card in 1936. SSA provides a counterfeit-resistant 

paper card to each individual when it issues an SSN, as required by law, 

and it also issues replacement cards upon request. ' SSNs have become 

a central means for establishing and confirming identity, but also can be 

used to perpetrate identity theft. Aside from concerns about the use and 

security of the SSN itself, there is interest in the cost of producing a paper 

Social Security card and whether the card enhances SSN security or 

adds to its risk. 

Issues regarding identity security and cost in an increasingly paperless 

society have raised the question of whether a paper Social Security card 

is still needed. My remarks today are based on work requested by this 

committee. For this statement, we examined (1) the federal requirements 

for individuals to present their Social Security card; (2) stakeholder views 

on the purposes for which the cards are generally used; and (3) the 

potential implications of eliminating the cards, and developing alternative 

approaches. 

For the first objective, we reviewed federal laws and regulations to identify 

what requirements exist for an individual to present his or her Social 

Security card. For the second objective, we interviewed federal, state, 

and private sector stakeholders that may need, and are legally 

authorized, to collect an SSN, in order to learn when a paper Social 

Security card may be requested or required by policy or practice. 

Stakeholders included associations representing financial and higher 

education institutions, human resource managers, and state agencies, 

such as those that administer certain human services programs. For the 

third objective, we reviewed SSA data on actual costs for producing and 

mailing Social Security cards, as well as its estimates of the per-card cost 

for issuing Social Security cards in fiscal year 2016 (the most recent year 

available). We assessed the reliability of SSA's actual cost data and 

estimated per card cost data by reviewing existing information about the 

data and the systems that produced them, and interviewing agency 

1 See 42 U.S. C. § 405(c)(2XG). 

Page 1 GA0·18..S01T social Security Administration 
21 


ralbany on LAP520R082 with HEARINGS33871.014

Background 

officials knowledgeable about them. We determined that these data were 

sufficiently reliability for the purposes of this testimony. We conducted a 

literature search to identify paperless identification alternatives in use or 

being developed by government, both in the Un~ed States and abroad. 

We interviewed SSA officials regarding the production and mailing of 

Social Security cards. We also asked SSA officials and stakeholders 

about possible effects of eliminating the card. 

We conducted the w ork on which this statement is based from October 

2017 to May 2018 in accordance with generally accepted government 

auditing standards. Those standards require that w e plan and perform the 

audit to obtain sufficient, appropriate evidence to provide a reasonable 

basis for our findings and conclusions based on our audit objectives. We 

believe that the evidence obtained provides a reasonable basis for our 

findings and conclusions. 

In 1g36, following the enactment of the Social Security Act of 1935, the 

newly-created Social Security Board (which later became SSA) created 

the 9-digit SSN to uniquely identify and determine Social Security benefit 

entitlement levels for U.S. workers. SSA uses a process known as 

"enumeration" to create and assign unique SSNs for every eligible person 

as part of their work and retirement benefit record. 

Originally, the SSN was never intended to serve as a personal identifier 

outside of SSA's programs, but, due to its universality and uniqueness, 

government agencies and private sector entities increasingly used the 

SSN as a convenient means of identifying people. The expansion of 

government use of the SSN began with Executive Order g3g7, issued by 

President Franklin 0 . Roosevelt in 1943. This required all federal 

agencies to use the SSN exclusively to identify individuals in their 

systems2 Since Executive Order 9397 was issued, additional federal 

statutes have authorized or required the collection or use of SSNs for a 

2 In 2008, Executive Order 13478 amended Executive Order 9397 to rescind the 

requirement for federal agencies to use SSNs exclusively. 

Page2 GA0·'18.SOTT social securtty Aelmlnlstratlon 
22 


ralbany on LAP520R082 with HEARINGS33871.015

wide variety of government activities.

3 Appendix I lists examples of such 

statutes. 

At the inception of the program, all SSNs and cards were issued based 

solely on information provided by the applicant. However, in the 1970s, 

SSA began requiring proof of age, identity, and citizenship. According to 

SSA, the agency has instituted numerous evidentiary requirements to 

further safeguard and preserve the integrity of the SSN and to ensure 

issuance of SSNs and cards only to eligible individuals. 

SSA reported that 16.4 million Social Security cards were issued in fiscal 

year 2017. This total includes 5.8 million new cards issued when 

someone is enumerated-issued an SSN- either at birth, upon entering 

the United States, or becoming a permanent resident. SSA issued 10.6 

million replacement cards, many through their Internet SSN replacement 

card (iSSNRC) system, which allows people to order replacement cards 

online. By law. SSA generally must limit the number of replacement cards 

an individual may receive to 3 per year and 10 in a lifetime, beginning 

with cards issued on or after December 17, 20054 

SSA issues three types of Social Security cards: 

One shows a person's name and SSN, and lets someone work 

without restriction: it is issued to U.S. citizens and people lawfully 

admitted to the United States on a permanent basis. 

A second also shows a person's name and SSN, with a note saying 

·valid for work only with DHS authorization.• It is issued to people 

lawfully admitted into the United States on a temporary basis who 

have Department of Homeland Security (DHS) authorization to work. 

The third has a person's name and SSN, and the note "Not valid for 

employment." SSA issues it to people from other countries who are 

lawfully admitted to the United States without work authorization from 

DHS, but have a valid non-work reason for needing an SSN. 

3 1n recent yea.l"$, thtue have: been efforts to teduoe t~ use and display of SSNs in 

government programs. For example. in April2018, the Centers for Medicare and Medicaid 

Services began issuing Medicare cards that use new unique numbers in place of 

cardholder SSNs. 

4 See Intelligence Reform and Terrorism Prevention Acl of 2004, Pub. L. No. 108-458, 

§ 7213(a), 118 Stat. 3638. 3831. 

Page3 GA0·18..S01T social Security Administration 
23 


ralbany on LAP520R082 with HEARINGS33871.016

While the design of original and replacement cards has been the same 

since 1976, SSA changed the design many times in prior decades. 

Counterfeit protections were first put on the card in 1983, but older 

versions of the card remain in circulation and are valid. As a result of the 

Intelligence Reform and Terrorism Prevention Act of 2004, SSA reported 

that it implemented additional security features in 2007 based on 

recommendations by an interagency task force. In the past, Congress 

and SSA have considered enhanced cards that were more resistant to 

tampering and counterfeiting. Prior GAO wor1< found severallimitalions 

regarding the security of the Social Security card.s First, expertise of 

counterfeiters and the wide availability of state-of-the-art technology make 

it increasingly difficult to develop and maintain a document that cannot be 

counterfeited. In addition, while the employment verification process relies 

on a variety of documents to establish identity, the role of the Social 

Security card in proving authorization to work has limitations, in part 

because SSA did not begin requiring identification documents from all 

persons until 1978. Prior work also found that improvements to state 

drivers' licenses and identification cards, as a result of the REAL ID Act of 

2005,

6 may enhance the government's ability to identify individuals and 

establish better links to the Social Security card and employment eligibility 

determinations. 

s GAO. Socia/ Security Administration: Improved Agency Cooldina~on Need<>d fe< Social 

Security Card Enhan<J&ment Efforts. GAQ-06-303 (Washington, D.C .. Mar. 29, 2006). 

6 See Pub. L. No. 109·13, Oiv. B, 119Stat. 302. The REAL tO Act sets minimum security 

standards for driver"s license isS(Janoe and procfuetion, induding prooedures for states to 

follow when verifying the identity of license applicants. and prohibits Federal agencies 

from aooepting for certain pwposes driver's licenses not meeting these minimum 

standards. 

Page4 GA0·1a..507T soelal security Administration 
24 


ralbany on LAP520R082 with HEARINGS33871.017

GAO Identified Two 

Federal 

Requirements for 

Individuals to Present 

Their Social Security 

Card, and These 

Requirements Involve 

Verifying an 

Individual's Social 

Security Number 

We did not identify any federal statutory requirements for individuals to 

present their paper Social Security card. However. we identified two 

federal regulations that call for individuals to present their Social Security 

card in order to verify their SSN in certain circumstances (see table 1 ). 

We also spoke with officials at SSA, and they said they were unaware of 

any federal requirements to present the paper card. 

PageS GA0·18·SOTT social s.curt•y Admlnlstration 
25 


ralbany on LAP520R082 with HEARINGS33871.018

Table 1: Fede-ral Requirements for Presentation of a Paper Social Security Card 

Federal Provision 

32 C.F.R. § 161.23(1) 

34 C.F.R. § 661 .51(b)1 

Soc;,ial Security Card Requirement 

Department of Defense regulations require members of the uniformed setvices and their dependents 

seeking to change their SSN in the Defense Ervollment Eligibility Reporting System (DEERS) to 

provide O&rtain docume:ntation, lnctuding Sodal Se:curity cards establishing the lndl\lidual's old a.nd 

newSSN. 

Department of Education regulations regarding the Hearth Education A$$istance L~n (HEAL) 

Program require schools to verity the information provided by students in their HEAl application, 

Including, but not limited to, tM student's citizenship status and SSN. To comply with this 

requirement, the school may reque:st the student ptovide documentation required by the school, 

including a paper Social Security earcl. 

Scut~t'GA.O~ofttleUS ~.aM():)c)eciFedefal~ <JAO.-t~ 

Note: we u-Md a ttgal datebest end epptopriate starel\ tttrM to concru~ e starCh ln tM u.s. Cod• 

end U'lt COde or F.cttrll R~letlons for ptOVISklns thet r~!rt tnolvl<k.lals to prestnt thtir own paper 

Social Security card and provisions that authorize an entity to requte Individuals to ptesent their 

paper Social Security card. Consfstent with the purpose of~ search. we exduded any provisions 

""-IOtntifltd tMt mtftuon a SOCial S.Wrlty tatCI but dO not requite an lndlvichJ41 to present'* or Mr 

own eard. SM 42 u.s. c.§ 675(5XI) end 25 C.F.R. § 20.506{l'l). In edditiOn. we det.,-mlnt<l tNt 

provisions th.at dOW indM duats to p,.s.ent th•lr Soeill SKVrtty card to veMy thtlr kf• ntity Ot SSN. but 

do no1 require them to do so, were outside the scope of this objective, and therefore did not fnclude 

them in thls tab!e. For example, we ldentifted I'WO pro\llslons that requfre lndMdua1s to present their 

Soelal S.eurily «rd If tn.y hatJe It w•llabl•: ~v•r. tl'l.s• ~rcwi•IMt do flOC d••e~ tM 

cirrumstantf!s mat WOUld make a eal'd unavailable. and' they allow indMduatt to provide other documentation Ot take oth•r steps Instead Of prOVfding the caret See 6 C.F.R. § 37. 11(t ) ancs 26 

C.F .R. § 3 t .6011(b)-2. We did not interview relevant agency otficials about the agency requl nts 

we Identified, nor dld we attempt to identi.ty and review related agency guidance 01 other 

<Socumentatlon. 

-rhe making of new HEAL Program loans was dlscont1nued on September 30, 1998. See 42 U.S.C. 

§ 292.a(e). Howev~. tht rtpotling. notificatiOn. and recordkeepr.g assoclattd wi1h rtl'lnancing HEAL 

toeJU. strvlelng outsllndlng IOitiS. end edminlttering end monltorfng ot tl\t HEAL Ptogtam 

regulations oontfnues. In 2014., the HEAL Program and the authority to admlnlster It were transferted 

ftom the Department of HeaJih and Human SeMoes (HHS) to the Department of Education. See Pub. 

l . No. 113·76, § 625. 12SStat. .$, 413. Regotatlons ptomulgated by HHS In 1992 oonlaln the same 

S.nguagt as 1he Oepattmtftt of Education r.;ulatlon.s. SM 42 C.F.R. § 60.51{b). However. acoor<fJng 

to the Department or Education. HHS intends to remove the HEAt Program r~u ations from its 

regu1atlon-s. SM $2 Fed. Reg. 53.374, $3,374 (Nov. 1$, 2017). 

Page& GA0--18-$07T Soclel Sec::urtty Aefmlntstretlon 
26 


ralbany on LAP520R082 with HEARINGS33871.019

Stakeholders 

Reported that the 

Social Security Card 

Is One of Several 

Documents that May 

Be Used to Verify 

SSNs 

Employers 

In addition to the two requirements described above, stakeholders 

described instances where individuals may present a Social Security 

card, among other acceptable forms of documentation, in order to verify 

identity or their SSN. 

The Social Security card is the most commonly used document to verify 

employment eligibility, according to officials from an association that 

represents human resource managers we interviewed. The Immigration 

Reform and Control Act of 1986 amended the Immigration and Nationality 

Act to require all U.S. employers to complete an employment eligibility 

verification (Foon 1-9) process to venfy a newly-hired employee's identity 

and employment eligibility 7 The card is one of a list of acceptable 

documents that employees may present to prove that they are ertgible to 

WOII< in the United States. Other acceptable documents onclude a U.S. 

passport cx permanent residence card. Employers are required by 

regulation to physically examine the documentation that the ondillidual 

presents to verify that the document is genuone and relates to the 

individual' 

According to DHS officials, employers may also useE-Verify, an internetbased employment eligibility system admonistered by U.S. Citizenship and 

Immigration Services (USCIS), to verify identity and employment 

eligibility. While all U.S. employers must have all newly-hired employees 

7 See Pub.L. 99-603, § 101(1), 100 Stat. 3359, 3360·72 (codif,.d as amended at 8 U.S.C. 

§ 1324a). 

8 See 8 C.f .R. § 274a.2(bX1XII)(A). 

OA0.11401T Soe~l S.C.urtty Admlnlstt•Uon 
27 


ralbany on LAP520R082 with HEARINGS33871.020

Financial Institutions 

fill out an 1-9 form, E-Verify is optional for most employers.

9 E-Verify 

electronically compares information the employer enters from the Form 1-

9 to SSA and DHS records. While use of E-Verify does not require a card, 

according to a USC IS official, about 77 percent of E-Verify cases in the 

last 5 years used SSNs collected from cards presented for the 1-9. 

According to an official from an association that represents human 

resource managers, employers are required to complete a wage and tax 

statement (W-2) for every employee and provide this information to the 

government, in order to transmit earnings records to the employee's 

Social Security record. IRS guidance states that employers should 

examine the paper card if presented to verify that the SSN is correctly 

recorded on the employee's W-2. Employees are not required to present 

the card to verify their SSN, but employers may ask for it because they 

can be penalized for providing incorrect information on the W-2. In 

addition, according to this official, new employees have to provide their 

SSN to their employer, such as by providing a card, for enrollment in 

employee health benefits. According to another official, the Patient 

Protection and Affordable Care Act includes a requirement for employers 

to report the number of employees receiving health care, and the SSN of 

each employee and dependent.•o 

Representatives of financial institution associations said that although 

applicants for new accounts are not required to present a Social Security 

card, presenting the card is one way individuals can prove their identity 

when setting up a new account. Financial institutions may use the paper 

card as one of multiple forms of identification to establish a customer's 

identity. In addition, pursuant to provisions in the USA PATRIOT Act 11 and 

9 E-Verify is a voluntary program. However. employers wffh federal contracts or 

St.Jboontracts that contain the Federal Aoquisition Regulation E-Verify dause are required 

to enroU in E-Verify as a oondition of federal oontracting. Employers may also be required 

to participate in E-Verify if their states have legislation maodating its use. Aooording to 

USCIS. employers wflo wish to employ F-1 OPT foreign students with STEM extensions 

and agricuttural employers who would like to immediately employ a new H-2A employee 

already 'W'Of1<ing for another employer as an H-2A in the United States must be enrolled in E-Verify. Addftlonally, aocording to USCIS, all federal departments and agencies (OMB 

Memo M-07 ·21 ) and In the Legislative Bra~h. each Member of Cot\gres.s. each offiCer of 

Congress and the head of each agency of the legislative bt'anch that oondu<::ts hiring must 

enroll in E·Verify. 

10 See Pub. L. No. 1 11-148. 124 Sial 119 (2010). 

11 See Pub. L. No. 107-56, § 326, 115 Stal272, 317-18 (2001 ) (oocfified at31 U.S.C. 

§5318) . 

••• GA0·18·507T Social security Administration 
28 


ralbany on LAP520R082 with HEARINGS33871.021

Educational Institutions 

State Departments of Motor 

Vehicles (DMVs) 

Federal benefits 

the Bank Secrecy Act12 financial institutions are generally required to 

verify certain information when customers open new accounts such as 

date of birth, address. and identification number. 

13 According to officials 

we interviewed from a financial association, the goal of this requirement is 

to prevent money laundering, fraud, and misuse of the banking system. 

Financial institutions may also use other government-issued documents, 

or non-documentary methods (such as by contacting the customer), to 

verify identity. Officials said that a person could still open an account or 

apply for a loan if he or she does not have their card as long as they have 

photo identification and some other government-issued documentation, 

such as a passport. 

According to officials representing post-secondary educational 

institutions, students are rarely asked to present a card or even an SSN 

to enroll. Officials told us that the only time a school might request a 

paper card is to resolve discrepancies in a student's personal information, 

such as when the student's name and SSN on a financial aid form do not 

match information on other databases. 

According to an official representing motor vehicle administrators, the 

REAL ID Act of 2005 requires DMVs to collect and verify the SSN when 

issuing a driver's license. A person must provide proof of his SSN or proof 

that he is not eligible for an SSN. 14 A stakeholder told us the most 

common proof provided for REALID purposes is the card, although other 

documents, such as the W-2, can be used. 

According to officials from an association that represents state human 

services agencies, while the SSN is required for certain public benefit 

programs such as the Supplemental Nutrition Assistance Program and 

Temporary Assistance for Needy Families programs, states that 

administer these programs do not require the paper card to determine 

12 See Pub. L. No. 91 -508, 84 SloL 1114-24 (1970) (codified •• omended ol31 U.S.C. 

§ 5311 et seq,), 

13 AA identifiCation number could be an SSN if the person has been isSlled one, ot a 

Taxpayer Identification Number, wtlich is Issued by the IRS in the administration of tax 

laws. 

14 Accofding to USCIS officials. form 1-9 does not reqi.Jre tllat the driver's license be 

REALIO cotnpliant tu~n completing Focm 1·9. Official uS&s are ~fined as accessing 

federaJ faclti~s, entering nuclear power plants, and boarding federalfy·regulated oomrnerciaJ alrctaft. TherefOf'e, acooc'ding to USCIS, drive( slkensg that are not REAL 

10 compliant are acceptable fot Form 1-9 and E-Verify. 

GA0-18·507T social Steulity Administration 
29 


ralbany on LAP520R082 with HEARINGS33871.022

eligibility. According to these officials, program applicants and recipients 

may provide the card as a source of identification, but the SSN is verified 

through electronic systems. A stakeholder representing state Medicaid 

agencies also told us that the card is not required for Medicaid services 

and requesting one would, in their opinion, be a very unusual practice. 

Page 10 0A0·18·507T Social Sec.urlty Administration 
30 


ralbany on LAP520R082 with HEARINGS33871.023

Eliminating the Card 

Likely Would Have a 

Limited Effect on 

Stakeholders' 

Processes and SSA 

Cost Savings, While 

Paperless 

Alternatives Raise 

Issues to Consider 

Most Stakeholders 

Indicated Eliminating 

Cards Would Not Affect 

Processes 

Most of the federal, state, and private sector stakeholders we interviewed 

who have reason to collect SSNs said their current processes would not 

change if the card was eliminated. For example, officials from one 

association w e spoke with stated that without the card, individuals could 

continue to use the SSN and verify their identity using other governmentissued documents such as a passport or drive~s license. 

Several stakeholders mentioned that a card can help to verify the SSN 

rather than accepting a person's recollection, which may be incorrect, and 

helps those who may not have committed it to memory. This can help 

ensure the SSN is recorded accurately, which can help avoid fines or 

time-consuming efforts to determine whether an incorrect SSN was 

fraudulent or simply an error. One stakeholder said that in light of recent 

data breaches, it could be helpful to have a physical record to show that 

an SSN was originally linked to the person named on the card. Another 

stakeholder said it can also be helpful for those who may need access to 

accounts of deceased family members. 

Stakeholders also raised disadvantages of continued use of the card, 

including that the card itself is not sufficient to authenticate someone's 

identity. SSA officials acknowledged that the card is not an identity 

document; it is merely a record of the SSN issued to the person whose 

name is shown on the card. Even when someone presents a card, it may 

be difficult to determine whether the card is valid, in part because people 

sometimes laminate the card, which invalidates certain card security 

features. Stakeholders we interviewed said they need electronic 

verification of SSNs even when a person presents a card. SSA services 

GA0 ·18..S07T Social seeurtty A<fmlnlst«ttlon 
31 


ralbany on LAP520R082 with HEARINGS33871.024

According to SSA Officials, 

Eliminating the Card May 

Not Result in Cost Savings 

allow employers and others to determine whether an SSN matches 

information in SSA's records." These efforts help to link the SSN to the 

person presenting the documents. Finally, a card can be lost or stolen, 

which can contribute to disclosure of the SSN and identity thef1.

16 

SSA officials said that eliminating the card may result in only limited cost 

savings, if any. According to SSA officials, the costs of printing and 

mailing the cards are small compared to other costs associated with 

producing the card, and an alternative approach likely would introduce 

new costs that would offset any savings. They said the total cost varies by 

the circumstances of the card request, which can happen by: (1) visiting 

an SSA field office; (2) birth of a newborn; (3) admittance of a lawful 

permanent resident; and (4) using SSA's internet application for 

replacement cards. In fiscal year 2016, SSA estimated that its cost for 

producing a card requested at a field office was about $34, while the cost 

for one requested online was about $6 (see table 2). According to SSA, 

the agency's costs vary because SSA field offices handle the SSN 

application, whereas for the other methods, the application information is 

provided by another entity outside SSA. 

'

5 The Social Se-curity Number Verification Service aiJows registered employers 10 quickly verify whether a person's name and SSN match Social Security's records, without needing 

the Social Security card, This servioe is used for wage reporting purposes only, The 

Consent·Sased SSN Verification Service is typically used by companies that provide 

banking and mortgage services, process c:tedit checks, provide background checks. and 

satisfy ltcensing requirements. This service does not verify identity, citizenship, or 

employment eligibility. Accotdlng to SSA, which administers both servius. in fiscal year 2017, these two $ystems reeelved over 2.1 billion queries to verify SSNs. 

16 SSA officials sakf that the agency has included language in certain SSA publications to 

promote safeguarding the Social Security card and keeping it in a secure plaoe to prevent 

identity theft. See for example, SSA. Understanding the Benefits. Pub. No. 05· 10024. 

Page 12 GA0·18..$07T soet.al security A<tminlstretlon 
32 


ralbany on LAP520R082 with HEARINGS33871.025

Table 2: SSA Fiscal Year 2016 Estimated Total Cost per Social Security Card 

Card request method 

SSA Field Offiee 

Enumeration at Birth (EAB) 

Enumeration at Enlly (EAE) 

nt~met Social Security Numbe:r 

Replaeement Card (iSSNRC) 

Application 

so..U'"SSAC1~ IGA0-18.607T 

Cost per card Number of cards issued 

12,212,643 

$10 4,001,936 

$6 326.767' 

$6 98,967 

•According 10 SSA omdals. approxmattfy 7$ ptte.nt of el SOCI:al S.Writy eer<lS ere r.cJutsttd and 

lssu*CI throug.h field om-e. ... The majority or tltkl omee r.cJuests are fOt replAcement eards. With 

respe<:t to eerd:S tsu~ in response to tleJcl offlet requtsts:. SSA is unabCt to dlsttngutsn betwHn 

Otiglnal Md rtpteeetMnt Soelal s.eutity cards In estimating its ootts.. 

• The number of cards issued for the Enumeration at Entry program includes both original and 

replacement cards, 

cAceordlrtg to SSA ottlcials.lnfY2016.1SSNRCwas • va.llableln 14 $tates and the Olstrf<:tof 

Columbia. As of FY 2017 it has been rolled out to an additional 10 stales. 

SSA's cost estimate of producing a card includes staff time devoted to 

taking and processing the application for the card; infonmation technology 

(IT) support associated with maintaining SSN records; and the actual cosl 

of printing, paper, and delivery of the card.

17 Agency officials said that the 

main portion of the cost is the staff time to interview applicants and review 

their documentation. Of the $34-per~rd estimate for a field office, 

approximately $28 was attributed to operational costs, such as front-line 

personnel who take applications and review documentation, and 

associated management costs. Costs associated with IT systems used 

for enumeration account for another $5 of this total. This amount also 

includes personnel costs for staff who produce cards at SSA facilities. 

Postage, printing and paper costs account for only about 60 cents per 

card. In fiscal year 2016, SSA officials stated that the agency spent about 

$8 million on printing and delivery of Social Security cards. 

According to agency officials, SSA is required to create and deliver the 

card, and therefore has not developed a formal proposal or cost estimate 

for eliminating the card or any replacement delivery system. However, the 

agency pointed out that while eliminating the card could reduce some 

costs, such as printing and some personnel costs, it could also create 

17 SSA estimat~s operational and systems costs using the a~ncy s cost aUocation 

methodology. while postage. printing and paper oosts are actual oosts incurred. 

Page 13 GA0·18..S07T Soelal Security Administration 
33 


ralbany on LAP520R082 with HEARINGS33871.026

Federal Agencies and 

Others Already Use Some 

Paperless Alternatives to 

Verify Identity, and 

Stakeholders Raised 

Issues to Consider in 

Developing Alternatives 

costs, depending on what alternative replaced the cards. SSA officials 

noted that current agency systems do not support electronic or paperless 

delivery of SSNs; if this type of alternative was chosen, the officials said 

the agency would have to design, build, and maintain a new system to 

support it. Officials further stated that in addition to cost considerations, 

SSA would need time to develop new processes. Even if no alternative 

replaced the card, the agency would still have to inform people of their 

SSNs-for example, by mailing a letter with the SSN to each personwhich could also create costs. Officials said that any change is likely to 

result in transition costs. such as increased traffic at the SSA field offices 

and phone calls to customer service because people would call with 

questions about the change in policy. 

Several government entities, including federal agencies and foreign 

governments, have begun to use electronic methods, rather than cards, 

to identify and authenticate individuals (see table 3). Although these 

methods apply to systems that are very different in purpose and scale to 

SSNs, they could provide insight into some considerations to moving to a 

paperless system. For example, one of these methods allows users to 

print a copy of the document if needed, although the document is 

maintained in an electronic system. Others capture biometric data, such 

as a fingerprint, upon enrollment that is later used to authenticate identity. 

Table 3: Examples of Government ..Sponsored Papet1ess Identity Alternatives 

Agencylgovemment entity Purpose of program 

Department of Homeland Immigration/travel 

Security (DHS). Customs and 

Border Proteetion (CBP), 1·94 

OHS, CBP, Global Enby Travel 

OHS, Transportation Security Travel Administration, Pre .,l'u 

State Departments of Motor Mobile identification Vehicle$ (DMV) 

Page 14 

Description 

CBP issues an 1·94 number to oertain people legally visiting the United 

States. Previously. the 1·94 number was provided on a hard copy form that 

was attached to the person's passport. Now, for entries at air and sea 

ports. CBP eteates an electronic record, and a pa~r oopy ean be 

downloaded from a website if needed as pi'OOf of ~l vlsitor status. 

Participants submit an on-fine application and complete enrollment with an 

in-person appointment. 'htlich includes a background cheek and 

fingerprinting. When arriving at the airport, participants present a pa$$p0f1 

or permanent resident catd and place fingerprints on a scanner fOf 

verification. 

Participants submit an on-line application and complete enrollment with an 

fn.person appointment. which includes a background check and 

fingerprinting. Accepted applicants receive a Known Traveler Number; no 

card ts issued. 

Some state departments of motor vehicles are piloting a Mobile Ortver"s 

license concept W'her~ driving credentials are accessed via an application 

on a smartphone. 

GA0-18-507T Soelal secu:tfty Admlnl.strallon 
34 


ralbany on LAP520R082 with HEARINGS33871.027

Agency/government entity Purpose of program Description 

Austria, Citizen Card Mobile identification Despite its name. the Citizen Card is a virtuaJ. technology--neutral concept 

that can be imp~~n ~ on a smart phone, smart card ot other device. 

The user authenticates his/her identity usillg their cf'losen device and a 

secure Personal IdentifiCation Number. 

Estonia. Mobiii·ID Mobile identification Estonia has created a govemment.-issued, digital identity tnat alkt-Ns people to use a mobile phone as a form of sectJre digital I D. which can be used to 

access government services. bank accounts, voting and other secure 

services. 

New Zealand, ReaiMe® Mobile identification Users sign up for a Real Me acoount online by providing personal 

information such as passport and birth information. A mobile phone is used in the verification prooess. Mer the user's identity has been verified by the government, the ReaJMe account can be used to access government 

services, including registering to vote, opening a bank account. and 

reoewfng a passport. 

So.rW OAO~QI ~~It:$IAS.-s$~~ )GA.0-18-007T 

Note: We conducted a 11terature search to Identify paperless Identification alternatives In use ()(being 

developed by government. both In the United States and abroad. To describe the programs used 

abroad, we relied excluslv&ty on secondary ma1eriats end did not dO any Independent legel reHarch. 

Stakeholders we spoke with provided general views on card less systems 

that can electronically authenticate an individual's identity. They 

suggested a variety of issues that should be considered in developing any 

such electronic approach: 

Vulnerability of such a system to data breaches; 

Privacy considerations (i.e., control over personal information); 

The need for strong authentication systems; 

Ae<:eptance by federal regulators (for example, related to oversight of 

financial institutions or federal financial aid); 

Costs of implementation for institutions and individuals; and 

Effect on vulnerable populations, such as those with limited access to 

electronic technology. 

SSA officials also noted several issues that would need to be considered 

in developing an alternative to the current card. While SSA officials 

indicated that the agency continues to look for ways to reduce external 

reliance on cards, they noted that any alternative must be as secure as 

the current Social Security card and processes. In particular, an SSA 

official said that SSA and the U.S. Postal Service have protocols in place 

so that Social Security cards are delivered to the intended recipients, and 

Page 15 GA0 ·18·507T Social Security Administration 
35 


ralbany on LAP520R082 with HEARINGS33871.028

GAO Contact and 

Staff 

Acknowledgments 

that they get returned if they cannot be delivered to a secure location. 

18 

Further, SSA officials stated they were unsure about potential effects on 

fraud and identity theft if paper cards were no longer used, and they 

stated that an electronic system would need to address concerns about 

personally identifiable information and security. 

Chairman Johnson, Ranking Member Larson, and Members of the 

Subcommittee, this concludes my prepared statement. I will be pleased to 

answer any questions that you or other members of the subcommittee 

may have. 

For future contact regarding this testimony, please contact Elizabeth 

Curda at (202) 512-7215 or curdae@gao.gov. Contact points for our 

Offices of Congressional Relations and Public Affairs may be found on 

the last page of this statement. Key contributors to this testimony were 

Mark Glickman (Assistant Director), Dana Hopings, and Vernette Shaw. 

In addition, key support was provided by John de Ferrari, Holly Dye, 

David Forgosh, Rebecca Gambler, Sarah Gilliland, Gina Hoover, 

Lawrence Malenich, Sheila McCoy, Almeta Spencer, and Adam Wendel. 

'

8 SSA Offtee of Inspector General (OJG) found in 2018 that about 360,000 undeliverable 

Soci<ll Security cards are relurned to SSA each year, and Ulat about 150,000 of Ulese 

cards coukl have been delivered to the torrect address had there been a prooess in plaoe 

to vaiKfate the address. See SSA OIG, Undeliverable Social Security Number Cards 

(Limited Di•tri~ution). A-15·17 -50279 (Battimore, Md.: April 2. 2018). 

Page 16 GA0·18.S07T Soelat Seeurtty Administration 
36 


ralbany on LAP520R082 with HEARINGS33871.029

Appendix 1: Examples of Federal Statutes 

that Authorize or Require the Collection or 

Use of Social Security Numbers (SSNs) 

Federal statute 

7 U.S. C.§ 2025(e) 

20 U.S.C. § 1090(a)(12) 

26 u.s .c . § 6109(d) 

42 U.S.C. § 405(c)(2)(C)Q) 

42 U.S.C. § 405(c)(2)(C)(oi) 

42 U.S.C. § 405 )( )(C) ) 

42 u.s.c. § 405(c)(2)(0 )(i) 

42 u .S.C. § 405(c)(2)(E) 

42 U.S.C. § 666(a)(13) 

42 U.S.C. § 1320b·7(a) (1) 

42 U.S.C. § 3543(a) 

Government entity and authorized or required use 

Requires the Secretary of Agriculture and state agencies to require SSNs fot participation in the Supplemental Nutrition Assistance Program. 

Authorizes the Secretary of Education to include the SSNs of parents of dependent students on 

certain financial assistance fonns. 

Authorizes the Commissioner of the Internal Revenue SeMce to require that tilx.payers inclvde 

their SSNs on tax returns. 

Authorizes states to oollect and use SSNs in administering any tax. general public assistance, 

driver's license. or motOf vehicle registration law, 

Requires states to obtain parent's SSNs before iMuing a birth certificate unless there is good 

cause for not requiring the number. 

Authorizes the Secretary of Agricuhure to require the SSNs of officers or owners of retail and 

whOI~sale food conoems that ac~pt and rede~m food stamps. 

Authoriz~s states and political subdivisions to require that blood donors pcovide their SSNs. 

Authorizes states and political subdivisions of states to use SSNs to determine e-ligibility of 

potential jufors. 

Req1.1ires states to inc::fude SSNs on applications for driver"s licenses and other licen$(!:$: on 

records relating to dlvoroe dectees, child support otders, ot paternity determinations; and on death recotds. 

Requires that. as a condition of eligibility for certain program benefits, including Medicaid benefits. 

applicants for and recipients of these benefits furnish their SSNs to the state administering 

program. 

Authorizes the Sectetacy of the Department of Housing and Urban Development to require program applicants and participants to submit their SSNs as a condition of eligibility fC){ housing 

assistance. 

Page 17 GA0-18--501T Social Security Administration 
37 


ralbany on LAP520R082 with HEARINGS33871.030

This is a WOI'1t of the U.S. govemment and is not subject to oopyright protection in the 

United States. The ptJblished product may be reproduced and distributed in its entirety 

without furthe:r permission ftom GAO. However. because this WOf'k may contain 

copyrighted images or oltler material, permission from the copyright holder may be 

necessary if you wish to reproduoe this material separately. 
38 

f 


ralbany on LAP520R082 with HEARINGS33871.031

GAO's Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone 

Connect with GAO 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

Strategic Planning and 

External Liaison 

The Government Accountability Office, lhe audit evalualion, and Investigative 

arm or Congress, exists to support Congress In meeting its constitutional 

responsibilities and to help lmptove the performance and accountability or lhe federal government ror the American people. GAO examines lhe use or public 

funds; evaluates federal programs and policies: and provides analyses. recommendations, and other assistance to help Congress make Informed 

oversight, policy, and funding decisions. GAO's oornmitment to good government 

is reftected in its core values or accountability, Integrity, and reliability. 

The fastest and easiest way to obtain ooples or GAO dOcuments at no oostis 

through GAO's website (https·tlwww gao gov). Each weekday al\ernoon. GAO 

posts on its website newty released reports. testimony. and oorrespondence. To 

have GAO e.mafl you a lost or newty posted ptoducts. go to httpsllwww.gao.gov 

and select ' E-mail Updates." 

The price or each GAO publ~catlon renects GAO's actual cost of ptOductJon and 

distribution and dependS on the number or pages in the publocation and whether 

the pubrlC8hon IS pnnted 10 color or bladt and ...tlote Pricing and ordering 

information is posted on GAO's website. hltp$Jiwww gao govlordemg htm. 

Place orders by canong (202) 512.$lOO.toll free (866) 801-7077. or TOO (202) 512-2537. 

Orders may be paid lor using American Express. Ooscover Cerd. MasterCard. 

VIS&. check. or money order C8J lor additoonallnlormatoon. 

Connect wt1h GAO on Facebook, AICI<r. TWitter. and You Tube 

Subscribe to our RSS FeedS or E-rnaH Updates LISien to our Podcasts 

Visit GAO on the web at hltp$Jiwww gao gov. 

Contact: 

Website: hltp$1/www gao.govlfraudnel/lraudnethlm 

Automated answering system: (800) 424·5454 or (202) 512-7470 

Orice Williams Brown. Managing Director. WilllamsO@gao.gov. (202) 512-4400, u.s. Government Accountability Offioa, 441 G Street NW. Room 7125. 

Washington. DC 20548 

Chuck Young. Managing Director. youngct@gao.gov. (202) 512-4800 

U.S. Government Accountability Offloa, 441 G Street NW. Room 7149 

Washington. DC 20548 

James-Christian Blockwood, Managing Director. spel@gao.gov. (202) 512-4707 u.s . Government Accountability Offioa, 441 G Street NW. Room 7814. Washington, DC 20548 

.... 

.... ~ 

Plei1$e Print on Recycled P•per. 
39 

Chairman JOHNSON. Mr. Lester, welcome. Please go ahead. 

STATEMENT OF SAMUEL LESTER, CONSUMER PRIVACY 

COUNSEL, ELECTRONIC PRIVACY INFORMATION CENTER 

Mr. LESTER. Chairman Johnson, Ranking Member Larson, 

Members of the Subcommittee, thank you for the opportunity to 

testify today. My name is Sam Lester. I am the consumer privacy 

counsel at the Electronic Privacy Information Center. EPIC is an 

independent, non-profit research organization here in Washington, 

D.C. established in 1994 to focus public attention on emerging privacy and civil liberties issues. 

I appreciate your interest in this critical topic. I cannot overstate 

the urgency that we update our privacy laws. There is no other 

form of personal information that poses a greater threat to privacy 

than the Social Security number. The recent Equifax breach exposed the Social Security numbers of over half of the U.S. adult 

population. 

The SSN was never meant to be an all-purpose identifier in the 

private sector. When it was first introduced in 1936 it was to be 

used only for the administration of Social Security taxes. The fact 

that it is now so pervasive as both an identifier and authenticator, 

a user name and a password, has undoubtedly contributed to the 

alarming rise in data breaches, identity theft, and financial fraud. 

SSNs are the keys to the kingdom for identity thieves. A criminal 

in possession of your SSN can file fraudulent taxes in your name, 

open new accounts in your name, take out lines of credit, and many 

other forms of fraud. 

If you are about to buy a home, for instance, you could experience your worst nightmare when a lender pulls your credit and 

sees that your FICA score is too low to qualify for a loan because 

someone has fraudulently run up debt in your name. For someone 

who has experienced new account fraud, it can take years to recover, financially. 

In 2017 identity theft impacted almost 17 million consumers. 

More importantly, consumers cannot protect themselves from the 

misuse of the SSN. As others have stressed, the Social Security Administration will only replace your SSN in the most extreme circumstances. 

And furthermore, the credit reporting industry makes it even 

more difficult for consumers. A credit freeze is burdensome and 

costly, and credit monitoring and fraud alert services do not adequately protect consumers. The CEO of LifeLock had his identity 

stolen 13 times after he displayed his real Social Security number 

in a commercial that was supposed to demonstrate how effective 

his product was at preventing identity theft. 

There have been recent efforts to limit the use of the SSN, but 

much more needs to be done. For example, in 2017 Medicare finally 

announced it would remove SSNs from cards, the result of an effort 

led by Chairman Johnson and Representative Doggett of this Committee. 

Also, a number of states have taken steps in the right direction. 

For instance, Alaska now prohibits the use of SSNs by both private 

companies and the government without explicit legal authorization. 

This would be a good model for federal legislation, and also shows 


ralbany on LAP520R082 with HEARINGS
40 

why federal law should not prevent states from enacting their own 

safeguards. 

To limit the devastating financial harm caused by the misuse of 

the SSN, Congress should take the following measures. 

Firstly, the SSN should be prohibited in the private sector without explicit legal authorization, and companies should be prohibited from compelling consumers to disclose their SSN as a condition 

of sale or service unless authorized by law. 

Secondly, Congress should promote the development of contextspecific identifiers. For example, if you are going to do banking, you 

have a bank account number. If you are obtaining a driver’s license, you have a driver’s license number. The advantage of these 

context-specific identifiers is that if one number gets compromised, 

an identity thief does not have access to all your accounts. 

Finally, Congress must not replace the SSN with a national biometric identifier. This would be a very bad idea. This approach 

would pose serious privacy and security risks. In the massive 

breach of the Office of Personnel Management in 2015, foreign 

hackers targeted digitized fingerprints stored in federal databases. 

These risks would only be compounded if the U.S. were to move towards a national biometric identifier. 

Thank you for the opportunity to testify today, and I will be 

happy to answer your questions. 

Chairman JOHNSON. Thank you, sir. I appreciate your testimony, as well. 

[The prepared statement of Mr. Johnson follows:] 


ralbany on LAP520R082 with HEARINGS
41 


ralbany on LAP520R082 with HEARINGS33871.032

epic.oro ELECTRONIC PRIVACY 

!!) INFORMATION CENTER 

Testimony and Statement for the Record of 

Sam Lester, EPIC Consumer Privacy Counsel 

Electronic Privacy lnfo1mation Center 

Hearing on "Securing Americans' Identities: The Future of the Social Security 

Number" 

Before the 

House Committee on Ways and Means 

Subcommittee on Social Security 

May 17, 2018 

II 00 Longworth House Office Building 

Washington, DC, 20002 
42 


ralbany on LAP520R082 with HEARINGS33871.033

Mister Chainnan and Members of the Commiuce, thank you for the opporrunity to testify 

today on securing Americans' identities: the fillure of the Social Security Number ("SSN"). My 

name is Sam Lester. I am the Consumer Privacy Counsel at the Electronic Privacy Information 

Center ("EPIC"). EPIC is an independent nonprofit research organization in Washington, DC, 

established in 1994 to focus public attention on emerging privacy and civil liberties issues. EPIC 

has urged Congress to establish privacy safeguards for the SSN for two decades. 1 EPIC has also 

participated in leading cases involving the privacy of the SSN and maintains an archive of 

information about the SSN online.

2 

It is important to emphasize the unique status of the SSN in the world of privacy. There is 

no other form of personal identification that poses a greater risk to privacy. The recent Equifax 

data breach exposed the SSNs of abnost half of the U.S. population. The SSN was never meant 

to be an all-purpose identifier. The fact that the SSN is now so pervasive as both an identifier and 

an authenticator in both the public and private sector has undoubtedly contributed to the alarming 

rise in data breaches, identity theft, and fmancial fraud. 

In my testimony today, I will outline the steps Congress can take to protect the privacy of 

the SSN. Congress should ( I) prohibit the use of the SSN in the private sector without explicit 

legal authorization; (2) prohibit companies from compelling consumers to disclose their SSN as 

a condition of service or sale unless there is a statutory basis for the request; and (3) promote 

technological innovations that enable the development of context specific identifiers. Congress 

should not. however. replace the SSN with a national biometric identifier, which would raise 

serious privacy and security risks. 

I. Ol'iginal purpose of the SSN and the danger·s of a national identification number 

A. The SSN was never meant to be an all-purpose identifier or to be used in the private 

lli!Qr 

Social Security Nwnbers are a classic example of"mission creep," where a program with 

a specific, limited purpose is transfonned for additional, unintended purposes, often with 

disastrous results. When the SSN was first introduced in 1936, it was to be used only as a means 

1 See, e.g. , Protecting Seuiorsfrom/delllil)• n1ifl: Is the Federal Goverumelll Doing Enough: Hearing Before the S. 

Special Comm. 011 Aging, 114UJ Cong. (Oct. 7, 2015) (statement of Marc Rotenberg, Exec. Dir., EPIC), 

hnps://epic.orglprivacy/ssn!EPIC-SSN-Testimony-Senate-I 0-7-1 5.00f; Protectiug the Privacy of the Social Security 

Numberfromldelllity 171eft: Hearing Bifore the H. Wnys & Menus Subcom. 011 Social Security, II Otb Cong. (Jun. 

21 , 2007) (statement of Marc Rotcpberg), bttps://epic.orglprivacylssnfidtheft test 062107.pdf; &cia/ Security 

Numbers & Identity 171ef/: Joilll Hearing Before the H. Fin. Sen•. Subcom. ou Oversight & Investigations aud the H. 

W.:ry•s & Means Subcom. 011 Social Security, 104tb Cong. (Nov. 8, 2001) (statemelll of Marc Rotenberg), 

htm;//www epjc.orglpriyacy/ssn/Jestimony II 08 200!.htm]; Preserviug the lmegrity a/Social Security Numbers 

aud Prevellliug n1eir Misuse by Ten·orists and Identity n1ieves: Joint Hearing Before the H. Ways & Means 

Subcom. 011 &cia/ Security & the H. Judicimy Subcom. oulmmigmtiou, Border Sec. & Claims. I 05th Cong. (Sept. 

19, 2002) (statement of Chris Jay Hoofuaglc, EPIC), hnp:f/IWM.roic.org/privacyfssufssntestimonv9.19.02.html. 1 See, e.g .• Greidiuger v. Davis, 988 F.2d 1344 (4th Cir. 1993); BeacouJouma/ v. Akrou, 70 Ohio St. 3d 605 (Ohio 

1994); EPIC, Social Security Nnmbers, hl!ps:ffepic.orglmivacy/ssn/. 

Testimony ofEPIC (Lester) 

The Future of the Social Security Number 

House Ways and Means Collllllittee 

May 17, 2018 
43 


ralbany on LAP520R082 with HEARINGS33871.034

of tracking earnings to determine the amount of social security taxes to credit each worker's 

account. At the time, public concem over potential abuse of the SSN was so high that the Social 

Security board had to reassure Americans that it was for the exclusive use of the Social Security 

system. Over time, however, Congress allowed SSNs to be used for purposes unrelated to the 

administration of the Social Security system. In 196 1, Congress authorized the IRS to use SSNs 

as taxpayer identification numbers.3 In the 1980s, Congress passed a series of bills authorizing 

the SSN for purposes such as opening an interest-bearing account. cash transactions over 

$10,000, and applying for numerous types of federal benefits.• 

Congress attempted to rein in the widespread use of the SSN with the Privacy Act of 

1974. A landmark 1973 report on privacy prepared by Willis Ware and the Department of 

Health, Education and Welfare ("'HEW'') described how the increasing use of the SSN in the 

private sector was promoting invasive profiling, and recommended legislation "prohibiting use 

of an SSN, or any number represented as an SSN for promotional or commercial purposes." 

The HEW report laid the groundwork for the Privacy Act.5 Specifically, Section 7 of the 

Privacy Act provides: 

(a)(1) It shall be unlawful for any Federal, State or local 

government agency to deny to any individual any rigbt. benefit, or 

privilege provided by law because of such individual's refusal to 

disclose his social security account number 

(b) Any Federal. State, or local government agency which requests 

an individual to disclose his social security account number shall 

inform that individual whether that disclosure is mandatory or 

voluntary, by what stanttory or other authority such number is 

solicited, and what uses will be made of it. 6 

This provision is critica1to keep in mind today, because conswners are so often compelled to 

disclose their SSN to obtain a product or service. 

As originally conceived, the Privacy Act would have applied to both the public and 

private sector. However, negotiations with the White House led to the removal of provisions that 

' Pub. L. No. 87-397, 75 Stat. 828 (codified as amended at 26 U.S.C. §§ 6113. 6676). 

• See, Carolyn Pucken, 111e Srory ofrhe Social Securiry Number, Soc. Sec .. Bulletin, Vol. 69, No.2, Soc. Sec. 

Admin., (2009), htruS'I/www ssa.gov/po!jcWdocs/ssblv69n2/v69n2p55 html. 

s Dep't ofHeahl~ Educ. & Welfare, Secretary's Advisory Couun. on Automated Personal Data S)~tems, Records. 

Complllers, nnd the Rights o/Citi=eus 125-35 (MIT 1973), nvailable nt 

btm://www.epic.org/privacwl•ewt973report/. 

• Pub. L. No. 93-579, 7. This provision of the Privacy Act was never codified, but is instead set out as a historical 

note to 5 U.S.C.A § 552(a) (2016). 

Testimony of EPIC (Lester) 

The Future of the Social Security Number 

2 House Ways and Means Committee 

May 17, 2018 
44 


ralbany on LAP520R082 with HEARINGS33871.035

covered the private sector. 7 As a consequence, the SSN has been allowed to proliferate as an a llpurpose identifier in the private sector. 

B. EPIC has repeatedly urged Congress to restrict the use of the SSN in the private 

sector 

In 2007, EPIC testified before this Comminee on how the proliferation of the SSN in the 

private sector has exposed consumers to unprecedented risks. We said: 

[T]he reality is that today the SSN is the key to some of our most sensitive 

and personal infonnatioa The financial services sector, for instance, has 

created a system of fi les, keyed to individuals' SSNs, conta ining personal 

and financial in fonnation on nearly 90 percent of the American adult 

population. This infonnation is sold and traded freely, with virntally no 

legal limitations. In addition, credit grantors rely upon the SSN to 

authenticate a credit applicant's identity. 8 

In October 2017, EPIC testified before the Senate Banking Comminee following the 

Equifax breach. We again emphasized how " the unregulated use of the social security number in 

the private sector has contributed to record levels of identity theft and fraud" and again urged 

Congress to restrict its use.~ Earlier this year, EPIC reinforced the urgency of legislation to limit 

the use of the SSN in testimony before the House Financial Services Committee, explaining, " the 

more the SSN is used, the more insecure it becomes. " 1

0 

II. Consumers face an epidemic of data breach, identitv theft and fin ancial fraud as 

a result of the pervasive use of the SSN in the private sector 

The ubiquity of the SSN in the private sector has created unprecedented risks for 

conswn ers. Incidents of data breach continue to rise in the United States, and the prevalence of 

the SSN in consumer databases undoubtedly contributes to this alanning epidemic. Last year was 

aga in the worst year ever for data breaches, as the number of breaches a lmost doubled from 

7 EPIC, n1e P,·ivacy Act of /974, ht!J>s://epic.oWprivacWI974act/; Roberl Ellis Smith, Gerald Ford: P>·ivacy 's 

Godfather, Forl>es (Jan. 5, 2017), https:l/www.forbes.com/2007/01104/privacy-protection-ford-ooedcx res 0 I 05privacy.hunl. 

'ld. 

~ Consum111· Dora Security and the Credit Bureaus: Hellriug Before the S. Co11m1. 011 Baking, Housing, and Urban 

Affairs, I 15th Cong., (Oct. 17, 2017), (statement of Marc Rotenberg, EPIC), 

https:l/cpic.onlfptivacyltestimony/EPIC-Testilllony-SBC -I 0-17 .pdf. 10 Examiuing the Currelll Data Security and Breach Notification RegulatOI)' Regime: Hearing Before the S. Conm1. 

on Financial Services. I 15th Cong. (Feb. 14, 2018) (statetnent of Marc Rotenberg, EPIC), 

htws:l/cpic.orgltestimonWcongress/EPIC-Testimony-HFS-2-14 -18.!ldf. 

Testimony of EPIC (Lester) 

The Future of the Social Security Number 

3 House Ways and Means Committee 

May 17, 2018 
45 


ralbany on LAP520R082 with HEARINGS33871.036

2016. 11 73% of all U.S. companies have now been breached.12 As a consequence, identity fraud 

reached an all-time high in 2017. with 16.7 million victims and a total of$16.8 billion stolen. 13 

A. SSNs are the most valuable piece of personal data for identity thieves 

SSNs are the "keys to the kingdom" for identity thieves. 14 The SSN is so valuable 

because it can be used to open new accounts without any other identify ing infonnation. Many 

retailers and banks will extend offers of credit to individuals with an SSN attached to a good 

credit score, even if the names do not match. 

15 Those whose SSNs have been breached are more 

than six times as likely to suffer new account fraud. 16 

This is particularly important in light of the Equifax breach, in which almost half of all 

Americans had their SSN stolen. In a recent SEC filing, Equifax provided the most detailed 

analysis to date of the information that was stolen. 17 Of the 146.6 million victims, 145.5 million 

had their SSN stolen. 

18 Compare that with only 20.3 million who had their phone number stolen, 

17.6 million who had their driver's license number stolen, and 1.8 million who had their email 

address stolen. 19 

Criminals in possession ofSSNs can completely derail a person's financial future. The 

Bureau of Justice Statistics reported that " ( v]ictims experiencing the opening of a new account or 

the misuse of personal information had greater [out-of-pocket] loss than those experiencing 

misuse of an existing credit card or bank account. "20 The IRS estimates that it paid out $3.1 

billion in fraudulent tax refunds for the 2014 filing season. 21 A criminal in possession of your 

stolen SSN can: 

11 Online TntSI Alliance, Cyber Jncitlelll and Breach Trend Reporl, (Jan. 25, 2018), 

https://www ola lliancc.orsls)~tcm fi es files initiative/documcutslola cvt>er incident trends report jan2018.pdf. 11 /d. 

" Javelin, ldelllily Fraud Hils All Time High Willi 16.7 Milliou U.S. Viclims iu 2017, Accordiug /o New Javelin 

Slra/egy & Research Swdy. (Feb. 6. 2018), bnps:(!www.javelinstrntegy,com/prcss-relcasclidentjtv-frnnd-ltits·alllime--hish-16 7-million-us-victims-201 7 -according-new-javelin. 

"Fed. Trade Conun'o., Securily iu Numbers: SSNs a11d ID 17Jef/2 (Dec. 2008), 

ltltps://www.ftc.gov/sitesldefuult/filesldocwueutslreportslsecurity-nmnbers-social-security-numbers-aud-identitylhcft -federal·trnde-conmlission-reoon/o07 5414ssnrepot1.pd E 

" Bob Sullivan, Your Social Securily Number Isu'l a Secre1. N.Y. Times (Sept. 13, 2017), 

hltps:J/www.tl}times.com/2017109/13/ooinion/your-social-security-nwnber-isul-a-secret.lttm. 16 Identity Theft Resource Center, New Accoull/ Fraud- A Growing Treud iuldelllily 17•ef/at 3 (November 2016), 

https:J/www.idtbeftceuter.orglimageslpage-docs!NewAccomttfrnud.pd( 17 Brian Fung, 145 Milliou Social S<>.curily uumbers, 99milliou addresses aud more: Every Jype of personal daJa 

&[uifax los110 hackers. by the numbers, Washington Post, (May 8, 2018), 

ltttps://www wasltinglonpost.com/news/the-switclt/wnf20 18/05108/everv-tvoe-of.personal-data-oouifux-lost-tohackers·by·)he-muubers/ . .. /d. 

,. Id. 

20 Etika Harrell, ViCJims of ldemily 17tef/, 2014, Bureau of Justice Statistics, (revised Nov. 14, 2017), 

ltttps:l/www.bjs.gov/conlent/pub{pdf7vit J4.pdf. 

" U.S. Gov't Accotmtability Office, GA0-16·589T, IRS Needslo Furlher Improve Comrols Over Ta.<payer Da/a 

aud Couliuue 10 Comba/ Jdeuliry 17tef/ Riftmd Fraud 1-2 (2016), https:l/www.gao.gov/assets1680/676493.pdf. 

Testimony of EPIC (Lester) 

The Future of the Social Security Number 

4 House Ways and Means Conunittee 

May 17, 2018 
46 


ralbany on LAP520R082 with HEARINGS33871.037

File fraudulem tax renrrns in your name 

Open new accounts in your name 

Take out lines of credit in your name 

Receive unemployment, food stamps and Social Security benefits in your name 

• Apply for student loans, obtain driver's licenses and passports in your name 

For example, a retired certified public accountant in Colorado received a F onn SSA-1 099 

for $19,236 in Social Security benefits earlier this year, even though he had never applied for 

benefits.22 A home buyer can experience their worst nightmare when a lender puUs their credit to 

discover that their FICO score is too low to qualify for a loan because someone has fraudulently 

run up debt in their name2 3 It can take years for individuals who have experienced new account 

fraud to recover financially. 24 

SSNs are routinely bought and sold on the black market. These illicit marketplaces are 

"growing in size and complexity" and are now dominated by "fmancially driven, highly 

organized and sophisticated groups."25 Complete dossiers of personal data that contain SSNsreferred to as " fullz"- are sold in bulk for as little as $15 per victim. demonstrating how 

inexpensive it can be to commit identity theft, yet how lucrative it can be for a hacker who has 

stolen data on millions of individuals. 26 

Children in particular are targets for identity theft and fraud using tbeir SSN because tbey 

do not have a credit history. Among the notified breach victims in 2017, 39 percent of minors 

were victims of fraud compared with 19 percent ofadults.l' Earlier this year, employees at the 

cybersecurity firm Terbium Labs spotted a set of stolen data- titled " infant fullz"- that 

comained a baby's full name, SSN, date of birth and mother's maiden name. The listing price 

was $312- significantly more than the S5 requested for similar bundles of information for 

adults28 

22 Susan Tornpor, Social Security Beuefits Stolen By Hackers. Leaviug Families With Bill, Detroit Free Press (Feb. 

28, 20 18), bttps://www.freep.com/story/ntoney/persoual-finance/susan-tompor/20 J 8/02128/identity-tbefi -crookssteaJ-sociaJ-securiry-bencfits.l354307002/, 21 Kenneth R. Hantey, 17•efl of Equifa.< da((l could lead to years of grief for home buyers aud mortgage applicams, 

Washington Post, (Sept. J 3, 20 J 7), bttps://www. washiustonpost.com/realestatellhefl-of-data-could-lead-t<>-years-ofgrief-for-homc-buvers-and-mortgage-applicams/20 17/09/ J 2/cd0f66fc-97 J a-J J e 7 -82e4-fl 076f6d6 J 52 storv.html. 

2'Jd. 

25 Lillian Ablon. Mrutin C. Libiclti, & Andrea A. Oolayix, RAND Corp., Markets for Cybercrime Tools and Stoleu 

Data, at ix (2014), 

https·//www.rand.orWcontentldam/randlpnbs/research reports!RR600/RR6101RANJ) &R610.pdf. 26 Dell Secure Works, Underground Hacker Markers 14 (2016), hnps: //\\~Vw.secureworl:s com resourceslrn-2016-

LJDdemQlYld-hacker·. 

2' Kelli 8. Grant, Jdemiry thefi lsn'tjust au adult problem. Kids are vicTims, too, CNBC, (Apr. 24, 2018), 

httl)s://www,cnbc.com/20 J 8/04/24/child-identi!y-theft-is-a·growing·and-expensive-problem.hnnl. 

lS Bree Fowler, J1171y Child Identity 17•eflls a Gro-.iug Concem Duriug Tax SetJSOn, Coustuner Reports, (Apr. 12, 

20 J 8), bttps://W\,~v.cousumen·eports.ofg/identity lhefllwby-chi ld-ident ity-tbeft-is-a-growing-concem-during-tax-

. 

Testimony of EPIC (Lester) 

The Future of the Social Security Number 

5 House Ways and Means Committee 

May 17,2018 
47 


ralbany on LAP520R082 with HEARINGS33871.038

B. Consumers carmot protect themselves from the misuse of their SSN 

The SSN is so coveted by identity thieves because, unlike a credit card number, it is 

almost impossible to change. In 2014, the Social Security Administration replaced only 250 

SSNs due to identity theft or misuse.

29 The SSA will only replace an individual's SSN in the 

most extreme circumstances, such as "harassment, abuse, or life endangerment." 30 Even then, the 

SSA will only assign you a new number if"you' vc done all you can to fix the problems resulting 

from misuse of your SSN, and someone is still using your number."3 1 

The credit reporting industry also makes it difficult for conswners to protect themselves. 

Credit freezes are burdensome and costly. Consumers wishing to freeze their credit must contact 

all three credit bureaus and pay a fee to each company every time they freeze and unfreeze their 

credit. Credit monitoring and fraud alerts are far less effective, and do not prevent thieves from 

accessing credit files or opening new accounts. The CEO ofLi.feLock had his identity stolen 13 

times after he displayed his real SSN in a conun ercial that was supposed to demonstrate how 

effective his product was at preventing identity theft. 32 

ill. T here have been recent efforts to limit the use of the SSN, but much more need s 

to b e d one 

In 20 IS, we explained to the Senate Special Committee on Aging that identity theft 

disproportionately targets seniors.33 In 2017, Medicare fmally armounced that it would remove 

SSNs from Medicare benefits cards, the result of an effort led by Senators Susan Collins and 

Claire McCaskill. 34 And the Social Security Number Fraud Prevention Act of2017, sponsored 

by Representative David Va1adao of this Committee, prohibits federal agencies from including 

anyone 's SSN on any document sent by mail unless authorized by law.

35 

29 Aarti Shahani, 111eji of Social Security Numbers is Brooder 171(111 You Might 171illk, NPR, (Jtm. 15, 20 15), 

htn>S'i/www npr,org/sectjoos/al!techconsjdered/20 15106/15/414618292/Jhel! -of.socja!-security-numbcrs·is-brooderthau-vou-might-thitlk. 30 Soc. Sec. Admin., Gmt! Ch(luge My Soci(ll Security Number? (Mar. II, 20 16), 

hnps:f/faq ssa.govlliuk/portaV340 11/340 19/ Articlef3 789/Can-1-chauge-my-. 31 Soc. Sec. Admin., ltfelllity T11eji (llld Your Soci(ll Security Number 6 (Feb. 20 I 6), https:f/vm•w.ssa.gov/pubsfEN· 

05-1 0064.00( 32 Kim Zener, LifeLock CEO's JdemiryStoleu 13 Times, Wired {May 18, 2010), 

h!tvs:l!www wjre<f comf2010/051Jjfejock-jdentjtv-[hel!l. 

H Protectiug Seniors from Idelllity 111eji: Is the Federal Govemmem Doiug Enough: Hearing Before the S. Special 

Comm. 011 Agiug, 1141.b Cong. (Oct 7, 2015) {stalemeut of Marc Rotenberg. EPIC), 

bttps://epic.ont!pri vacy/ssnfEPIC-SSN-Testimony-Senate-! 0-7 -1 5.00f. 34 EPIC, Medicare to Remove SSN fromiD Cnrds, (Sep. 5. 20 17), https:f/epic.orgl2017f09fmedicare-to-remove-ssnfronJ·iclhtml. 

" Pub. L. No. 115-59, 131 Stat 1152 (20 17). 

Testimony of EPIC (Lester) 

The Future of the Social Security Number 

6 House Ways and Means Committee 

May 17, 2018 
48 


ralbany on LAP520R082 with HEARINGS33871.039

In addition, a number of state laws limit the use of the SSN in higher education,36 by 

private businesses,37 by state agencies,

38 and financial institutions.39 For example, Arizona 

prohibits state universities and community colleges from using the SSN as an ID munber. 40 

Rhode Island prohibits businesses from requiring consumers to disclose all or part of their SSN 

to purchase most goods or services4 1 A number of states prohibit private insurers from printing 

SSNs on identification cards. 

Many private organizations have also curtailed or eliminated the use of the SSN. 

Georgetown University prohibits use of the SSN "as the primary record key, or sort key, in aoy 

University database or other business system or operation." 42 ln lieu ofSSNs, Georgetown uses 

the "Georgetown University ID," a "nine digit number beginning with the numeral 8" listed on 

each person's GU identification card. 43 And nearly a decade ago, the Blue Cross Blue Shield 

Association mandated that its members replace SSNs with Subscriber ID numbers.

44 

IV. Solutions to nnvent misuse of SSNs and pt·otect consumers 

There is widespread support for legislation limiting the use of the SSN. According to a 

Pew Research Report, 90% of adults said they were "very sensitive" about their SSN, the highest 

percentage for any form of pei'Sonal data45 Pew Research Center also found that 91% of 

consmners say they have lost control over how their personal information is collected, and 64% 

support greater regulation over how companies handle their personal information. 4

6 Even leading 

CEOs now support stronger privacy protections in the United States. Congress should adopt the 

following measures to limit the use of the SSN and protect consumers from identity theft and 

financial fraud: 

• Prohibit the use of the SSN in the private sector without explicit legal authot·ization. 

While an employer should be pennitted to ask ao employee for an SSN for tax-repon ing 

purposes, a health club should not be pennitted to ask a customer for an SSN as a 

condition of membership. Even if a service is not conditional on someone providing their 

'

6 See e.g. N.Y. Educ. Code sec. 2-b; W.Va. Code Aim. sec. 18-2-Sf; Ariz. Rev. Stat. Sec. 15-1823. 

" See e.g. RI. Gen. Laws 6-13-17; Vt. Stat. Aim. til. 9. § 2440; N.C. Gen. Stat.§ 75-62. 

'* See e.g. Ala. Code sec. 41-13-6; Cal. Civ. Code sec. 1798.85. 39 See e.g. Mass. Gen. Laws. Aim. ch. 167B, sec. 14. 

"'Ariz. Rev. Stal. Sec. 15-1823. 

" R.I. Gen. Laws6-13-17. 

" Georgetown University !nfo1mation Secm·ity Office, Policy 011tlte Use, Collectioll, a11d Retemioll of Sccial 

Security Numbers by GeorgeiOlVII Universityt htlps:l/secwity.georgetown.edttlit-oolicies·procedw·esluse-colleclion· 

retention-policy#. 

" /d. 

" Empire Pltysiciall Sourcebook, EMPIRE B W'E CROSS Bl.IJ'E SHIELD, 

https:l/www I l.erupireblue.com/provider/noapplicatiou/f4/s2/t0/. 

" Mary Madden, Public PercepliOIIS of Privacy 011d Security in the Post-Snowden Era, Pew Research Center (Nov. 

14, 2014), hup://www.pe,vintemet.org/2014111/12/public-privacv-perceptiousl. 

"'George Gao, Mary Madden, Privacy and Cybersecurity: Key Findings From Pew Research, Pew Research 

Center, (Jan. 16, 2015). http·//www pewresearch ors/fact-lankf?OJ SIQJ/)6/priyacv/. 

Testimony of EPIC (Lester) 

The Future of the Social Security Number 

7 House Ways and Means Committee 

May 17, 2018 
49 


ralbany on LAP520R082 with HEARINGS33871.040

SSN, having that field on a fonn causes many people to provide it anyway, assuming it is 

required. 

• Prohibit companies from compelling consumers to disclose theit· SSN as a condition 

of service or sale unless there is a statutory basis for the request. Representative 

Patrick McHenry has proposed the PROTECT Act of2017, which would prohibit 

consumer reporting agencies from using a consmner's SSN as a method to identify the 

consumer.47 Congress should go much further, however, and prohibit its use for all 

commercial transactions unless the use is explicitly authorized by statute. 

• Promote technological innovations that enable development of context-specific 

identifiet·s. A system of decentralized identification reduces the risks associated with 

data breaches and the misuse of personal infonnation. Such a decentralized approach is 

consistent with our couunousense understanding of identification. If you're going to do 

banking, you should have a bank account number. If you're going to the library, you 

should have a library card number. Utility bills, telephone bills, iJ.lSurance, the list goes 

on. An example of this approach is the Medical Identification Number used in Canada. 

These context-dependent useruames and passwords enable authentication without the 

risks of a universal identification system. That way, if one number gets compromised, all 

your other numbers are not spoiled, and identity thieves cannot access all your accounts. 

All of your accounts become compartmentalized, enhancing the ir security. 

• Do not replace the SSN with a national biometric identifiet·. There have been 

proposals recently to replace the SSN with a national biometric " identity framework," 

with fingerprints and facial recogtlition48 This is the wrong solution and would raise 

serious privacy and security risks. In passing the Privacy Act of 1974, Congress was 

specifically reacting to and rejecting calls for the creation of a single entity for the 

reference and storage of personal information. There are also significant problems that 

would arise with the breach of a biometric identifier. Iu fact, in the massive OPM data 

breach, foreign hackers targeted the digitized fingerprints stored in federal databases. 

49 

That risk would be compounded if the US were to move to a national biometric 

identification system. 

Conclusion 

There is linle dispute that identity theft is one of the greatest concerns tor consumers in 

the United States today. There are many factors that have contributed to this problem, but the 

" H.R. 4028, !15th Coog. (2017). 

"See, e,g., Protecting Consumers iltthe Ero of Major Do to Breaches: Heori11g Before the S. Comm. 011 Commerce. 

Science ond Transportation, I 15th Coug. (Nov. 8, 2017), (statement of Todd Wilkinson, President and CEO, Entn!St 

Datacard), https://www.conunercc.scnarc.gov/public/ cacheffilesl9348fllb-19a4-4c47-922e13cc98d6Jb54/469C33D8104lfABI51DC6BIE6608Al8B.II .08.2017--wjlkinson·testimony.pdf. 

" David E. Sanger, Hackers Took Fi11gerprinrs o/5.6 Million U.S. Workers, Govemmem Says, N.Y. Times, (Sept. 

23, 2015), bttps:/fwww.uVIimes.com/2015/09/24/worldfasialhackers-took-fingernrints-of-5-6-million-us-workers80Vemmenl-savs.btntl. 

Testinlony of EPIC (Lester) 

The Future of the Social Security Nwnber 

8 House Ways and MeaJ.lS Comminee 

May 17,2018 
50 

f 


ralbany on LAP520R082 with HEARINGS33871.041

widespread use of the SSN in the private sector and the failure to establish privacy safeguards are 

key parts of the problem. It is time that Congress passed strong and effective legislation that will 

limit the use of the SSN, encourage the development of more robust systems for identification 

that safeguard privacy and security, and not limit the ability of states to develop better 

safeguards. Congress must not, however, replace the SSN with a new national identification 

system. 

Thank you for the opportunity to testify today. I will be pleased to answer your questions. 

Testimony of EPIC (Lester) 

The Future of the Social Security Number 

9 House Ways and Means Committee 

May 17, 2018 
51 

Chairman JOHNSON. Mr. Rosenzweig. 

Mr. ROSENZWEIG. Thank you very much. 

Chairman JOHNSON. Is that the right pronunciation? 

Mr. ROSENZWEIG. Rosenzweig, but—— 

Chairman JOHNSON. Weig, okay. 

Mr. ROSENZWEIG. Thank you very much. 

Chairman JOHNSON. Pardon me. Well, please proceed. 

STATEMENT OF PAUL ROSENZWEIG, SENIOR FELLOW, R 

STREET INSTITUTE 

Mr. ROSENZWEIG. Thank you very much, Chairman Johnson, 

Ranking Member Larson, Members of the Subcommittee. I too am 

pleased to be able to speak with you today about the future of the 

Social Security number. 

The Social Security number has a long history of utility as an 

identifier. I don’t think that is the problem. The use of it as an 

identifier is no different than the use of my phone number as an 

identifier or the use of my name as an identifier. The problem is 

that the Social Security number has mutated in its use, so it is now 

also an authenticator of my identity. 

Authenticators are classically only useful if they involve something that you know exclusively, something you have, or something 

you are, and they are kept confidential. Today Social Security numbers are so deeply compromised and so widely available in public— 

albeit often through criminal means—that they can no longer be 

used as an authenticator. This is because recent incidents like the 

Equifax breach that we have already spoken of, and whose anniversary occurs this week, have effectively disclosed the vast majority 

of previously confidential Social Security numbers. My own Social 

Security number, to my knowledge, has been breached at least 

three times in the past four years. So I feel this quite personally. 

As a result, in my view, any enterprise that continues to use a 

Social Security number as an authenticator is engaging in borderline privacy and security malpractice. Yet some do. Just the other 

day I was shocked that a bar renewal membership used my—the 

last four of my Social Security as a way of authenticating my identity. And this was a governmental use. 

So what should we do about that? What should we do in response 

to the problem? In my judgement, Congress has three logical options. 

The first is to, as Mr. Lester has just suggested, regulate or outlaw Social Security numbers. That is a plausible solution, but one 

that I respectfully think is not appropriate. That comes with all the 

usual disadvantages of government intervention: regulatory gridlock, administrative costs, enforcement mechanisms that are necessary, along with procedural safeguards, as well. 

In short, I think a regulatory response will come with a great 

deal of expense and be a relatively slow result, perhaps even no 

quicker than the next solution, which is to do nothing. 

In a lot of ways, the market is addressing this problem. The disutility of SSNs as an authenticator has become widely known and 

is increasingly on the decline (sic). Eventually, the market will take 

care of the problem. The problem with that answer, of course, is 

that before it does, a great number of Americans will suffer from 


ralbany on LAP520R082 with HEARINGS
52 

data breach and identity theft. So I think that is a second-best solution. 

The best solution, in my judgement—and one of the joys of being 

in a think tank is your ability to think creatively about problems 

and think outside the box—is to eliminate the utility of the Social 

Security number as an authenticator. Make it impossible, in practice, for anyone to continue to use it in this way. 

One simple and quite elegant solution that I offer both as a 

thought experiment and also as a possible practical solution is to 

simply publish a phone book with every citizen’s Social Security 

number in it. In other words, by publishing it publicly, we would 

make it impossible for any enterprise to continue to legitimately 

use it as an authenticator of identity. To continue to do so after 

that and after a suitable transition time would, in my judgement, 

be per se negligence of the sort that ought to involve liability for 

the enterprise. 

One final point that I would make. Congress needs to look to its 

own house. Repeatedly in law we have mandated the collection of 

Social Security numbers as identifiers, and sometimes continued to 

use them as authenticators, as my colleague has already testified 

to. At a minimum, I think it is incumbent upon Congress to review 

government’s use of the Social Security number and its processes, 

if only so that by cleaning up our own house we can speak to the 

private sector with authority. 

I thank you for the opportunity to testify before you, and I look 

forward to the chance to answer questions. 

Chairman JOHNSON. Thank you, sir. I appreciate your testimony. 

[The prepared statement of Mr. Rosenzweig follows:] 


ralbany on LAP520R082 with HEARINGS
53 


ralbany on LAP520R082 with HEARINGS33871.042

Introduction 

STATEMENT 

of 

Paul Rosenzweig 

Senior Fellow, R Street Institute 

Red Branch Consulting, PLLC 

Professorial Lecturer in Law, George Washington University 

Washington, D.C. 

before the 

Subcommittee on Social Security 

Committee on Ways and Means 

United States House of Representatives 

May 17,2018 

The Future of the Social Security Number 

Chairman Johnson, Ranking Member Larson, and Members of the Subcommittee, I thank you for your 

invitation to appear today and present testimony on the question of data security and the use of Social 

Security Numbers (SSNs). My name is Paul Rosenzweig and I am a Senior Fellow at the R Street 

Institute.'! am also the Principal and founder of a small consulting company, Red Branch Consulting, 

PLLC, which specializes in, among other things, cybersecurity policy and legal advice; a Senior Advisor to 

The Chertoff Group and a Professorial Lecturer in Law at George Washington University, where I teach a 

course on Cybersecurity Law and Policy and another on Artificial Intelligence Law and Policy. From 2005 

to 2009, I served as the Deputy Assistant Secretary for Policy in the Department of Homeland Security. 

1 The R Street Institute is a public policy, research, and educational organization recognized as exempt 

under section 501(c)(3) of the Internal Revenue Code. It is privately supported and receives no funds 

from any government at any level, nor does it perform any government or other contract work. 

Information about our fund ing is available at: http:lfwww.rstreet.org/about-rstreet/funding-andexpenditures. My Truth in Testimony Disclosure accompanies this testimony. 

M embers of R Street t estify as individuals discussing their own independent research. The views 

expressed are their own and do not reflect an institutional position for the R Street Institute or its board 

of trustees. I thank my colleagues at R Street for their research assistance and for helpful comments on 

an earlier draft of this testimony. 

1 
54 


ralbany on LAP520R082 with HEARINGS33871.043

My testimony today is in my individual capacity and does not reflect the views of any institution with 

which I am affiliated or any of my various clients. 

In my testimony today, I want to make a few points, which I can summarize as follows: 

The Social Security Number has a long history of utility as an identifier. Over time, however, the 

use case for SSNs has mutated so that now it is frequently used both as an identifier and as an 

authenticator. 

Authenticators of identity only have utility to the extent they rely on confidential, non-public 

information. This is classically defined as something you know, something you have or 

something you are. Initially SSNs appeared to be a suitable authenticator since they were nonpublic information that only a Social Security recipient would know. 

Today, however, SSNs are so deeply compromised and so widely available to the public (albeit, 

often through criminal settings) that they can no longer be used as an authenticator. This is 

because recent incidents, such as the Equifax breach (the anniversary of which occurs this 

week), have effectively disclosed the vast majority of previously confidential SSNs. 

As a result, any enterprise that continues to use an SSN as an authenticator is engaging in 

borderline cybersecurity malpractice. Yet, some do. Just the other day, for example, the lastfour digits of my own SSN were used to verify my identity when I went to renew my Bar 

membership. 

In my view, Congress has the following three options for dealing with this problem. They range 

from worst to best. 

o Regulate or outlaw the use of SSNs. This is a plausible solution but one that comes with 

all of the usual disadvantages of government intervention: regulatory gridlock, 

administrative costs, and enforcement systems that necessitate procedural safeguards. 

In short, a regulatory response would come at great expense with a slow result, perhaps 

even no quicker than doing nothing. 

o Do nothing. The disutility of the SSN as an authenticator continues to become widely 

apparent. Eventually, the market will take care of the problem, but not before many 

more Americans suffer from data breach and identity theft. 

o Eliminate the utility of the SSN as an authenticator. Make it impossible, in practice, for 

anyone to continue to use it in this way. One simple, indeed quite elegant, solution (that 

I offer as both a thought experiment and as a possible practical answer) is to simply 

publish a phone book with the name and SSN of every citizen. In other words, make it 

clear that SSNs cannot be used as authenticators by making them radically publicly 

available. 

A Short History of SSNs 

Starting in 1936, most workers were required to participate in the Social Security program. As a result, 

the government needed a system to track all the participants. While the Social Security Act of 1935 did 

2 
55 


ralbany on LAP520R082 with HEARINGS33871.044

not specifically call for a numbering system, it did require the federal government to create a tracking 

method for record purposes-' 

Many ideas were considered, including the use of participants' names and addresses or a fingerprint 

system similar to what some federal agencies already had in place. Name identification proved unwieldy 

and ineffective' And even though fingerprinting had a proven track record in the federal government, 

the public had an unfavorable view of the association between fingerprints and criminal activity. Fearing 

a backlash, the Social Security Administration (SSA) settled on the numbering system we use today. 

SSNs were never designed for or intended to be national identification numbers (or cards) and were 

never supposed to be used to confirm a person's identity' However, only a few years after the passing 

of the Social Security Act, President Roosevelt issued Executive Order 9397 that instructed federal 

agencies to use SSNs to identify individuals in any new system the agency was creating.' Few, if any, 

federal agencies complied with the new rule untill961 when the Civil Service Commission adopted the 

practice. The Internal Revenue Service followed in 19626 The trend only accelerated with the 

deployment of new electronic record keeping systems for which numerical identifiers were ideal, though 

the Privacy Act of 1974 did attempt to limit it somewhat. 7 

Once SSNs became universal identifiers, it was only a matter of time before they also became a universal 

authenticator. 

Starting in the 1970's, Congress mandated the use of SSNs in any number of laws (for example, to 

combat welfare fraud and to stop undocumented workers from seeking employment). Over the next 

two decades, a series of laws required people to provide their SSNs to be verified with the government 

in order to receive benefits other than Social Security or to be hired. Today, SSNs are used in everything 

from banking to insurance to healthcare- often at the mandate of the federal government. 

2 Robert Pear, "The Nation; Not for Identification Purposes (Just Kidding)," The New York Times, July 26, 

1998. htt ps ://www. nyti mes.com /1998/07 /26/weeki n review /the-n at ion-not-for -ide ntifica ti on-purposesjust-kidding.html. 

3 This was the so-called "Fred Smith" problem: too many similar names existed for them to be used as a 

unique identifier. See Carolyn Puckett, "The Story of the Social Security Number," Social Security Bulletin 

69:2 (2009). https://www.ssa .gov/policy/docs/ssb/v69n2/v69n2p55.html. 

4 Indeed, from 1946 untill972, Social Security cards explicitly disclaimed that they were for "Social 

Security purposes-not for identification." See Adria nne Jeffries, "Identity Crisis: how Social Security 

numbers became our insecure nationaiiD," The Verge, Sep. 26, 2012. 

https: //www. th everge .com/20 12/9/2 6/33 84416/soc ia 1-secu rity- numbers-nation a 1-1 D-id entity-theftnstic. 

5 "Executive Order 9397 Numbering System for Federal Accounts Relating to Individual Persons," The 

White House, Nov. 22, 1943. https://www.ssa.gov/foia/htmi/E09397.htm. 

6 Pear. https: //www. nyti mes.com I 1998/07/2 6/weeki n review/the-n at ion-not-for -ide ntifica ti onpurposes-just-kiddi ng.htm I. 

7 A good summary is provided in Flavia L. Komuves, "We've Got Your Number: An Overview of 

Legislation and Decisions to Control the Use of Social Security Numbers as Personal Identifiers," The 

John Marshall Journal of Information Technology and Privacy Law 16:3 (1997-1998). pp. 529-574. 

3 
56 


ralbany on LAP520R082 with HEARINGS33871.045

Meanwhile, Congress has allowed private companies to use Social Security Numbers as both identifiers 

and authenticators without any restrictions. However, the private marketplace is neither specifically 

authorized nor restricted in asking for a person's SSN for record keeping purposes or authentication.• 

Data Breach and the loss of Confidentiality 

Recent history is replete with examples of data breaches and the harm they cause. Especially relevant to 

this subcommittee is the Equifax breach that resulted from poor data security practices and 

compromised the sensitive, personal data of over 140 million Americans. Moreover, some of these 

data-like SSNs-cannot be changed, which means that individuals may face a long period of frustration 

and vulnerability to identity theft. This event was largely preventable had Equifax implemented 

reasonable security measures, such as encrypting relevant data. 

The federal government itself has not been immune to cyber-attacks. A few years ago, for example, a 

breach at the Office of Personnel Management compromised the records of over 20 million people that 

also contained sensitive information, such as SSNs and fingerprints. Although it was made public in 

2015, the attack occurred more than a year earlier and went unnoticed by the OPM. I, personally, was a 

victim of both of these breaches. 

These attacks are emblematic of the fact that U.S. companies and the U.S. government have been and 

remain vulnerable to attacks, many of which are by actors linked to nation-states that are adversaries of 

the United States. Nor are these isolated incidents. As the most recent annual Verizon Data Breach 

Investigations Report notes, 2017 (the last year for which data is available) saw more than 53,000 

incidents and over 2,200 confirmed breaches.9 So, make no mistake, cyber threats are real, and recent 

experience has shown that neither the private nor public sectors are fully equipped to cope with them. 

Indeed, it does not matter if your personal data is held by a private business or the government, as both 

have lost millions of SSNs to hackers. Indeed, even before the Equifax breach, experts hypothesized that 

between 60 • 80% of all Americans have had their SSNS stolen.10 After Equifax, that number is surely a 

low estimate. 

Given the prevalence of data breaches, it is no surprise that SSNs are not expensive on the Dark Web. 

Indeed, the SSNs of newborns, which are highly coveted by bad actors because, in essence, they are 

8 "The Expansion of the SSN as an Identifier," U.S. Social Security Administration. 

https:ljwww.ssa.gov/history/reports/ssnreportc2.html. 

9 "2018 Data Breach Investigations Report," Veri zon, 2018. 

https:ljwww.verizonenterprise.com/resources/reports/rp 081R 2018 Report execsummary en xg.pd 

f. 

10 Aarti Shahani, "Theft of Social Security Numbers is Broader Than You Might Think," NPR, June 15, 

2015. https://www.npr.org/sections/alltechconsidered/2015/06/15/414618292/theft-of-social-security· 

numbers-is-broader-than-you-might-think. 

4 
57 


ralbany on LAP520R082 with HEARINGS33871.046

clean slates, only cost around $300. 11 By contrast, an adult's Social Security Number can sell for as little 

as $1 each. 

In short, the modern rule of thumb is simple: assume your SSN is insecure. 

The SSN Authenticator Nightmare 

The idea of an SSN as an identifier is not t erribly problematic. Everyone in America has a half dozen 

identifiers that are ways of uniquely denoting their identities to other people. I, for example, am Paul 

Samuel Rosenzweig. That's my primary identifier. 

But I am also a number of other identities. For example, I am my email address: 

prosenzweig@rstreet.org. That identifier changes more often than my name, but it is, nonet heless, a 

unique way of pointing to me. A much more permanent identifier that most Americans have today is 

their mobile phone number. Ever since Congress made sure t hat we could transfer our number when we 

changed mobile carriers (thank you!), it has become a commonplace for people to keep their cell phone 

number, even if they move across country. I took my (202) number with me when I went on sabbatical 

to Chicago, and most people today anticipate never giving up the number they started with. That unique 

ten-digit string of numbers is me and only me. 

In much the same way, my 9-digit SSN is also a unique string of numbers that is tied inextricably to me, 

and only to me. The problem is not, however, that the SSN identifies me. I need an identifier for the 

purposes of accessing my government social security account and, in this way, the SSN is really no 

different than my account number at the bank where I keep my checking account. It is merely a number 

linked to my name. But that numerical symbol is as much me as my name or my SSN is. 

Nor is the problem that, 20 years ago, some enterprises started to use the SSN as an authenticator. After 

all, at the time they did so, the SSN was a confidential number known only to the issuer (the federal 

government) and to the beneficiary. If I, as the beneficiary, shared that SSN with an enterprise to use as 

my password for an account, I did decrease its confidentiality. But as an approximation of a confidential 

random password, the SSN was accurate. M ore importantly, at least at the outset it was efficient. 

Almost everyone has an SSN and almost everyone could remember it, which created a ready-made 

password authentication system. 

The problem is that our initial assumptions about the confidentiality of the SSN (and thus about its utility 

as an authent icator) have, over time, proven not to be robust. As the SSN became more and more 

widely used for authentication, it became more and more widely known. Indeed, the concern about 

widespread use of a password/authenticator is why one of the cardinal rules today in password 

management is to try to avoid reusing the same password in multiple settings. This is, of course, 

because, when compromised, reused password/authenticators become a ready pathway to widespread 

access. 

11 Emma Z., "Excuse Me, Are You Using That Child Tax Credit?," Terbium Labs, January 18, 2018. 

httos://terbiumlabs.com/2018/01/18/excuse-me-are-you-using-that-child-tax-credit.html. 

5 
58 


ralbany on LAP520R082 with HEARINGS33871.047

And, wit h widespread use comes widespread vulnerability. A reused password is only as secure as the 

least-secure place that it is stored. As we have already discussed, it turns out that almost no storage 

location is secure enough - and even those like Equifax in whom we m ight repose greater confidence 

prove quite vulnerable. 

Despite this, for reasons that surpass comprehension, some enterprises still use the SSN to authenticate 

my identity and prove that I am who I say I am. In fact, every Member of this subcommittee has, I am 

certain, been asked to provide the last-four digits of his or her SSN not to denote an ident ity but rather 

to prove it conclusively. 

But, in a post -Equifax world, SSNs are so widely known and so readily available on the Deep Web or 

Black Market that they effectively provide no security at all. It would almost be as if my User Name for a 

login were my email address and the website allowed me to use the last-four letters of my last name as 

my password. That would be ludicrous, but the last-four digits of my SSN are as w idely known and as 

readily available publicly as the last-four letters of my last name. 

Ending the Nightmare 

So, what then, should be done? If SSNs are valueless as authent icators, why do we continue to use t hem 

this way? The answer seems relatively clear- momentum or, if you prefer, legacy costs. Having built 

systems that rely on the SSN, too many users have sunk costs in their security architecture. Changing 

how identities are verified is costly. It may require significant expenditures of time and money. New 

systems may not be backward compatible with older ones, which necessitates wholesale rearchitecture. In short, it is sometimes easier to do nothing than t o change. 

Of course, that is not t he whole story. Increasingly, companies in America are beginning to bear the 

costs of their security failures. Data-breach insurance is now becoming commonplace and it comes at a 

real cost to those who purchase it. As t ime passes, we can anticipate that insurers will come to more 

closely grade the security of the enterprises to whom they issue insurance and charge differential rates 

based on that assessment. 

Thus, over time, t he market will come to value greater security against identity theft through insurance 

pricing. One perfectly plausible solution, then, to the SSN problem is simply to do nothing and over time, 

t he insecurity of SSNs as authenticators will come to be so great a cost that enterprises will migrate 

away from them. Though 1 have not seen any data on the subject, it does seem anecdotally that this is 

already happening. Fewer enterprises today are using SSNs than were doing so ten years ago. And that 

is a good t hing. 

But waiting for the market to fix the problem has a cost. As I have already noted, the market is "sticky." 

Wit h sunk costs and barriers to change, many enterprises will be slow to modify t heir practices. The 

question then, is whether or not Congress has a role in moving this process forward more rapidly in the 

interest of avoiding continued harm to social security registrants. 

To this end, one can envision two possible ways forward. 

6 
59 


ralbany on LAP520R082 with HEARINGS33871.048

The first, more typical one would be for Congress to directly regulate the matter in the form of a law 

that directs companies to stop using the SSN as an authenticator. Such legislation would necessarily 

come with all of the regulatory baggage that attends all such laws. For example, there would be noticeand-comment rulemaking, followed by some form of audit and ultimately regulatory enforcement. If the 

task were given to the Social Security Administration (a natural choice since they "own" the SSNs), t his 

would become an administrative requirement that would likely distract the SSA from its current duties. 

The SSA is not set up to handle most issues outside their core mission of helping seniors and disabled 

Americans. Indeed~ while the Social Security Trust Fund is runded by dedicated taxes, administration 

money is appropriated. Any additional regulatory requirement would flounder unless Congress were to 

accompany it with additional funding; a problematic thought in these times of deficit spending. 

Thus, I offer you a second possibi lity derived from the ground breaking work of Nobel prize winning 

economist Richard Thaler:12 Simply publish the Social Security Numbers. In other words, instead of 

continuing to treat them as confidential numbers that are "secret" when they manifestly no longer are, 

instead change the paradigm. Make them public numbers that are identifiers in the same way that my 

telephone number is an identifier published in the phone book. Doing so would demonstrate, in a 

definitive way, that SSNs are not suitable for identify verification or authentication (any more than my 

phone number is). 

Admittedly, this idea may seem a bit outside the box at first. However, if the goal is to move the markets 

to more quickly discontinue use of the SSN as an authenticator, we need to make its disutility even more 

clear than it is now. This would raise the costs of maintaining it to a point where the incentive to stop 

using it is greater. Such a method simply helps to push the markets in the wiser policy direction without 

being overly directive in a regulatory way. 

Of course, some individuals might object. I suppose we could add an opt-out provision that came with 

personal liability for identity theft. But my preference would be to see the publication of SSNs as a public 

good-much like vaccination- that the government could undertake on its own initiative. 

I feel confident in predicting that within three to five years of publication in a public SSN log, their use as 

an identity authenticator would be a thing of the past . And that would be a good thing. 

One final thought: As the brief history we recounted at the beginning of this testimony reflects, 

Congress itself bears much of the blame for the use of SSNs as identifiers and authenticators. We have 

legislated uses for SSNs that range from welfare fraud and bank identification to certifications of 

healthcare insurance compliance. In many ways, then, Congressional concern over SSN usage has an air 

of unreality given this history - and so another first step or nudge would be to systematically reduce and 

ultimately eliminate all use of SSNs as authenticators w ithin government programs. As in the case of 

most federal programs, U.S. government leadership could also drive private sector change. 

12 These are summarized for popular consumption in Richard H. Thaler and Cass R. Sunstein, Nudge: 

Improving Decisions about Health, Wealth, and Happiness (Penguin Books, 2009). 

7 
60 

f 


ralbany on LAP520R082 with HEARINGS33871.049

Conclusion 

In any event, the bottom line is simple. SSNs should no longer be used as a method of authenticating 

identity. The sooner we get to a place where this is universally true, the more secure our systems will 

be. While I have offered one creative way forward, others can also be imagined. The singular key is for 

Congress to take the initiative and lead the charge. Exactly how we get there in the end matters far less 

than the fact that we start down the road. 

8 
61 

Chairman JOHNSON. Mr. Grobman, you are recognized. 

STATEMENT OF STEVE GROBMAN, SENIOR VICE PRESIDENT 

AND CHIEF TECHNOLOGY OFFICER, MCAFEE, LLC 

Mr. GROBMAN. All right, good morning, Chairman Johnson, 

Ranking Member Larson, and Members of the Subcommittee. It is 

a proud honor to testify today. And Chairman Johnson, it is an 

honor to work in your district. McAfee actually has its largest U.S. 

location in Plano, Texas. So it is an honor to testify today. 

As McAfee’s senior vice president and CTO I set our technical 

strategy to protect connected computing worldwide for both consumers and business architectures. I have worked in the field of 

cyber security for 2 decades, and have 24 U.S. and international 

patents in the fields of security, software, and computer architecture. 

McAfee is one of the world’s leading independent cyber security 

companies providing solutions for both business and consumers. 

The nine-digit Social Security number first appeared as an identifier in 1936, but has since become the de facto national identifier 

and federal credential, uses for which it was never intended. Simply knowing a Social Security number has become accepted as a 

mechanism to impersonate an individual, and the Social Security 

number has become the premier target for cyber criminals. 

Social Security numbers are sold in bulk in the black market for as little as $1 each. And once stolen, a Social Security number cannot easily be reissued or replaced. Last year’s Equifax breach resulting in 145 million U.S.-based users having their personal information compromised reminds us that the U.S. needs to modernize 

its national identification standard. 

There are three elements that need to be discussed when we 

transition to a next-generation personal identifier: identity, authentication, and authorization. In our current model Social Security 

numbers play a role in all three. Identity is an identifier that can 

be public. It is like an individual’s Twitter handle; it identifies an 

individual, but simply knowing the handle doesn’t enable someone 

to impersonate the account holder. 

Whereas, authentication is the process of proving that you are a 

specific identity, and generally relies on one of three types of factors: either something you know, like a password; something you 

have, like a smart card; or something you are, such as a biometric. 

An authorization is granting a specific capability or benefit to a 

specific entity. All three parts need to be in scope for a next generation system. 

We have all the technology pieces to move towards a high-quality, high-security, well-thought-out, next-generation identity management system based on strong authentication. What is more difficult is understanding the requirements that will be acceptable for 

both government and the citizens. 

We need to ask questions such as is this a solution exclusively 

for government-related services? How can a system be inclusive to 

all citizens, regardless of wealth or access to advanced technologies? Does a government biometrics database create unacceptable privacy issues? How will recovery mechanisms work when 

technology assets are lost or stolen? What are the cost constraints, 


ralbany on LAP520R082 with HEARINGS
62 

funding options, and timelines for implementing and maintaining 

a solution into the next generation, and how long does the underlying cryptography need to last? 

This last question is interesting, in that we are on the verge of 

quantum computing becoming a viable reality. Quantum computing 

is well suited to break the underlying cryptography that protects 

the world’s data. Specifically, RSA, but public key algorithm which 

is the heart of most protection and identity solutions. A next-generation architecture must comprehend the quantum computing 

world we will likely face in the next few decades. 

We need to look at what technology options are available, and I 

have been asked whether things such as blockchain could be useful. I do not recommend it. While a powerful technology providing 

properties such as decentralized trust, blockchain also brings 

scalability, complexity, and its own security challenges. In the case 

of our next-generation system, we do have a trusted central authority: the U.S. Government. We need to focus on the problem that we 

are trying to solve, and the one thing that we must do is not use 

the current system that we have. 

A few quick recommendations: We need an identity management 

executive order that outlaws the use of Social Security numbers as 

authenticators; We need to push federal agencies to act as 

validators of identity and mandate all federal e-government services require the use of strong authentication; We need to let innovation flourish. NIST and the private sector can work together on 

this. And we need to move faster in implementing quantum-safe algorithms to protect both data protection and identity solutions. 

It is an honor to testify to this Subcommittee. I appreciate your 

interest in considering my recommendations, and look forward to 

answering your questions. 

Chairman JOHNSON. Thank you for coming all the way from 

Plano. 

Mr. GROBMAN. You bet. 

[The prepared statement of Mr. Grobman follows:] 


ralbany on LAP520R082 with HEARINGS
63 


ralbany on LAP520R082 with HEARINGS33871.050

STATEMENT FOR THE RECORD OF 

STEVEN GROSMAN, SENIOR VICE PRESIDENT AND CHIEF TECHNOLOGY 

OFFICER, MCAFEE, LLC 

BEFORE THE WAYS AND MEANS SUBCOMMITTEE ON SOCIAL SECURITY 

May 17, 2018, 10:00 AM 

Good morning, Chairman Johnson, Ranking Member Larson and members of the 

subcommittee. Thank you for the opportunity to testify today. McAfee has over 1,000 

employees based in Plano Texas, in Chairman Johnson's congressional district. We 

have found the district, with its strong base of IT professionals, to be a very friendly 

business environment. We also appreciate Chairman Johnson's long dedication to the 

district and our country, and I know he will be missed when he retires from Congress at 

the end of the year. 

I am pleased to address the subcommittee on modernizing the identity and authentication 

system for citizens of the United States. This will have a profound impact on our citizens, 

our security and our economy. The Committee's focus on holding a "big think" hearing 

makes a great deal of sense. Before developing policy and operational solutions to 

solving our nation's identity management challenge, we need to make sure we're asking 

the right questions so the right identity management system requirements can be defined 

and the right roles and responsibilities for both the public and private sectors can be 

delineated. 

First, I would like to provide some background on my experience and McAfee's 

commitment to cybersecurity. As McAfee's Senior Vice President and Chief Technology 

Officer (CTO), I set our technical strategy, ensuring that we create technologies that 

protect smart, connected computing devices and infrastructure worldwide. A large part of 

my role as CTO is driving innovation at McAfee, and my team includes: McAfee Labs, 

R&D, threat research and McAfee's internal CISO organization. 

Prior to joining McAfee, I spent over two decades in senior technical leadership positions 

at Intel Corporation related to the field of cybersecurity, resulting in being named an Intel 

Fellow and worldwide McAfee CTO in 2014. I have 24 U.S. and international patents in 

the fields of security, software and computer architecture. I earned my bachelor's degree 

in computer science from North Carolina State University. 

MCAFEE'S COMMITMENT TO CYBERSECURITY AND IDENTITY MANAGEMENT 

McAfee is one of the world's leading independent cybersecurity companies. Inspired by 

the power of working together, McAfee creates business and consumer solutions from 

device to cloud that make the world a safer place. By building solutions that work with 

other industry products, McAfee helps businesses orchestrate cyber environments that 

are truly integrated, where protection, detection and correction of threats happen 

simultaneously and collaboratively. By protecting consumers across all their devices and 

in the cloud, we secure their digital lifestyle at home and while on the go. By working with 
64 


ralbany on LAP520R082 with HEARINGS33871.051

other security players, we are leading the effort to unite against state-sponsored actors, 

cybercriminals, hacktivists and other disrupters for the benefit of all. McAfee is focused 

on accelerating ubiquitous protection against security risks for people, businesses and 

governments worldwide. 

McAfee has also made a commitment to helping our customers address their identity 

management challenges. McAfee's Identity Theft Protection allows users to take a 

proactive approach to protecting their identities with personal monitoring, financial 

monitoring and recovery tools needed to keep identities personal and secured. Key 

features include: 

Cyber Monitoring - Scans the online black market and the Dark Web and alerts 

users when their personal information is at risk. 

Social Security Number Trace- Delivers reports of known aliases and addresses 

tied to a users' Social Security Number so they can review for potentially fake 

identities. 

Credit Monitoring - Sends reports based on lending and credit history, and alerts 

users to changes to their creditworthiness. 

24/7 Dedicated Agent Support - Allows users access to agents who can answer 

questions and provide guidance on topics from using credit responsibly to handling 

identity theft. 

Identify- Provides complete visibility into data, context and user behavior across 

all cloud services, users and devices. 

In addition, we've done a lot of thinking about identity management and what problems 

we as a nation need to solve. Here are some of our thoughts. 

THE SOCIAL SECURITY NUMBER CAN NO LONGER BE USED AS AN EFFECTIVE 

AUTHENTICATOR 

The once venerable nine-digit Social Security number first appeared as an identifier in 

1936. It has become the de facto national identifier and a federal credential that people 

use for a range of both governmental and commercial purposes - uses for which it was 

never designed. Simply knowing an SSN has become accepted as a mechanism in many 

cases to impersonate an individual; it's also become a premier target for cybercriminals. 

SSNs are sold in bulk on the cybercrime black market for as little as one dollar. Once 

stolen, the SSN cannot easily be reissued or replaced, making it a weak foundation upon 

which to build identity. 

The steady stream of major breaches where consumers' SSNs have been stolen creates 

a compelling opportunity for change. Last year's Equifax breach resulted in 145 million 

US-based users having their personal information compromised. Attackers reportedly 

exploited a vulnerability on the company's website to steal names, Social Security 

numbers, birthdates, addresses and, in some cases, driver's license numbers and 

passport numbers. Breaches like this remind us that the United States needs to 

modernize the national identification standard for its citizens. It is unrealistic for a Social 
65 


ralbany on LAP520R082 with HEARINGS33871.052

Security number (SSN) to be shared and distributed to many parties and stay confidential 

for the better part of a century. 

Policymakers need to modernize the systems and methods that identify citizens as well 

as enable citizens to prove their identity with minimal risk of impersonation and without 

overtly compromising privacy. A good start is to determine what digital technologies offer 

strong security to create renewed confidence in the modemized credential system that 

must replace our current paradigm of using the current SSN across public and private 

ecosystems. 

The growing cyber threat makes finding a solution even more urgent. McAfee Labs logged 

63.4 million new samples of malware -an all-time high- in the fourth quarter of 2017. 

We found that cyber criminals are increasingly targeting the healthcare sector, where 

information, including personal identifiers, is non-perishable. The sale of personal 

information, including Social Security numbers, has become a lucrative business in 

underground markets. 

NOT A NEW PROBLEM 

While we're hearing more about it now because of recent breaches, the matter of using 

the SSN as a personal identifier is not a new problem. Twenty-five years ago, computer 

scientists voiced concerns about sharing a single piece of permanent information as a 

means of proving a person's identity. Simply having this piece of information was 

sufficient for an individual to prove his or her identity. Part of the problem is that there 

hasn't been an incentive, orforcing function, to change the way identity transactions work. 

Ironically, we have not taken steps to develop better standards for protecting personal 

identity, yet we've taken these steps in other areas, such as credit card security. For many 

years, individuals' credit card numbers, the card expiration date and CID (card 

identification) number were all that was necessary to prove individuals could charge 

against an account. The massive retail breaches forced a reconsideration of this practice. 

The financial services industry recognized that this model needed to be changed and 

transitioned to chip-based technology or smart card- based credit card capabilities. 

In Europe and much of the rest of the world, the transition was to a system known as chip 

and PIN, where the card not only has a computer chip, but the individual also must enter 

a unique PIN that is stored on the card. In the United States, the transition has been first 

to a partial improvement where a chip in a credit card can be used to prove physical 

possession of the card by having the smart card respond to a cryptographic challenge 

that it uniquely can respond to. This system can be enhanced in the future with the full 

adoption of "chip and PIN," which will have the chip only respond if the correct PIN is 

entered as well. 

With chip and PIN, there is never any disclosure of the secret information to parties with 

whom individuals are transacting. It is simply a matter of using math -- cryptography 

algorithms- to prove that individuals are who they say they are, as opposed to giving the 

parties something that would let them impersonate the individual. The simplest technical 
66 


ralbany on LAP520R082 with HEARINGS33871.053

requirement truly boils down to that. The question we need to ask as U.S. citizens is, why 

would we move forward to a more secure system for financial instruments such as credit 

cards but lag in our progress toward a more secure system for proving our identities as 

individuals? 

DEFINING REQUIREMENTS 

We must recognize that there are three elements that need to be discussed: identity, 

authentication and authorization. In our current SSN system, the simple number plays a 

role in all three, while in the field of computer science, we recognize the criticality of 

looking at these independently. Identity is the identifier that should be public and not pose 

a risk to the individual if many parties know it. The President of the United States' 

@POTUS Twitter handle is an identity. It identifies the President; however, knowing the 

Twitter handle does not let you impersonate the president. 

Authentication is the process of proving you really are a specific identity. Authentication 

typically relies on something you know (a password}, something you have (for example, 

a smart card} or something you are (such as a biometric). The strongest form of 

authentication requires multiple forms of authentication, such as a PIN {something you 

know) combined with a smart chip card {something you have). Authorization is granting 

a capability to a specific identity - for example, allowing a user to receive benefits or have 

access to specific information such as private medical data. All three - identity, 

authentication and authorization - must be part of a new personal identification system. 

We have all the technology pieces to begin the journey to a high-quality, high-security 

and well-thought-out identity solution for U.S. citizens. We understand the cryptography, 

biometrics, how to build hardware devices and how to deploy them to scale to millions of 

people. We can apply the lessons we have learned, using proven technologies, from 

mechanisms such as our financial instruments, as well as looking at what has and has 

not worked in countries that have moved to more modern identity systems. 

There are several ways to do this, from simply implementing proven credit card 

technologies such as "chip and PIN" for personal IDs, to employing technologies that are 

directly based on who someone is, such as biometrics {which makes it more difficult for 

a thief to use a stolen card or token). Chip and PIN technologies could allow individuals 

to electronically authenticate with a higher level of security than if they simply asserted a 

number {such as our existing SSNs). 

What's going to be more challenging, however, is coming up with a solution that strikes 

the right balance between security and privacy, and deciding what the scope of this should 

be. Is this a solution for individuals to prove their identity for government-related services 

and transactions, Social Security and other government benefits? Or is this the solution 

for individuals to prove who they claim they are for other types of transactions? States 

currently provide identity solutions such as driver's licenses or ID cards. Does the new 

standard complement that? Does it replace elements of that? 
67 


ralbany on LAP520R082 with HEARINGS33871.054

These are some of the difficult questions that need to be debated: What is the intent? 

How do we want to protect privacy? What is a reasonable requirement to ensure that all 

citizens of the United States can prove their identity regardless of wealth or access to 

advanced technologies? Is it a reasonable requirement to have the federal government 

maintain a biometrics database for citizens such as fingerprints, iris scans or facial 

features? How will citizens Who are disabled or require someone to legally act on their 

behalf utilize a next-generation authentication system? How will recovery mechanisms 

work when technology assets are lost, stolen or socially engineered? As a technologist 

in the field of cybersecurity, I have many building blocks at my disposal that can be used 

to define a next generation system; however, answering these questions is critical to 

choosing an appropriate solution. 

We also must understand the pragmatic requirements of a next generation system. What 

are the cost constraints and funding options? How quickly must we move to this new 

system, and what does that migration plan look like? How many years does the 

underlying cryptography need to be secure? 

This last question is interesting in that we are on the verge of quantum computing 

becoming a viable reality, likely within the next two decades. Quantum computing relies 

on the principles of quantum physics to solve specialized classes of mathematical 

problems that are not practical to solve on traditional computers. Quantum computers 

use quantum bits (qubits), unlike digital computers, Which are based on transistors and 

require data to be encoded into binary digits (bits). These qubits can exist in multiple 

states simultaneously, offering the potential to compute a large number of calculations in 

parallel, speeding time to resolution. One of the key workloads that quantum computing 

is well suited for is to break the underlying cryptography that protects the world's data -

specifically, the RSA public key algorithm, which is at the heart of most protection and 

identity solutions. RSA public key is at a high risk of compromise When quantum 

computing becomes a reality. 

While we applauded the work by NIST to start the process to look for quantum-safe 

algorithms, we must understand that adversaries can place data on the shelf now 

(especially if it has long- term value such as national secrets) and attack it later When 

quantum computing becomes viable. Similarly, a next generation identification system 

should last 100 years or more, such that the next generations can prosper from the 

systems we invest in today. Careful consideration needs to be made about whether this 

new capability needs to be quantum safe - or at a minimum, have an architecture that 

allows the replacement of algorithms as quantum safe capabilities become available, 

even if we start with well-understood and tested components of today. 

MOVING TOWARD A SOLUTION 

I've been asked if blockchain technology could help put us on a path toward a secure 

identifier. I do not recommend this approach. Blockchains are a powerful technology that 

solves some very specific problems. They enable a trust model for an immutable ledger 

When a trusted party does not exist. In the case of cryptocurrency, this is exactly the 

problem you are trying to solve: you want to ensure that you can create transactions 
68 


ralbany on LAP520R082 with HEARINGS33871.055

without reliance on any trusted agency or government. Part of what drives the viability of 

cryptocurrency is incentives for individuals to run the distributed infrastructure that powers 

the blockchain. We find, however, that blockchain has performance, scalability and 

privacy challenges that are not easily overcome. 

During the cryptographers' panel at this year's RSA conference, Ron Rivest, a well-known 

cryptographic expert whose name accounts for the "R" in "RSA," discussed some of the 

failings of blockchains for certain security applications. He noted that they "fail miserably 

in terms of scalability, throughput and latency ... [and) in certain applications [such as) 

voting they are a very poor fit... .[l)n many applications they are a bad database choice .... 

[T]hey have limited security properties that may or may not fit your need." 

In the case of our next generation ID system, we have a trusted central authority (the US 

Government) and require significant scale for the infrastructure that would not be served 

well by a blockchain distributed system and architecture. Instead, we should focus on 

well understood tools and principles that our knowledge of cryptography, authentication 

and identity technologies provide, as opposed to falling victim to the "blockchain" hype. 

We need to focus on what problems we are trying to solve. If a key requirement is that 

an individual's identity is not transferable, or that an individual can't have multiple IDs, 

then biometrics may be worth considering. India has moved to a national biometric identity 

program, allowing 1.3 billion citizens to prove their identities through fingerprints, facial 

recognition and eye iris scans. The country faced an even more difficult problem than 

compromised SSNs because there was no single starting database of citizens. Because 

benefits came with being a citizen, there were concerns that an individual might attempt 

to register in one town under one name and then register in another town under another 

name. The Indian government addressed this issue by creating a biometrics database to 

register its population. If your biometrics were already in the database, the government 

would know that you were a duplicate person. It also provided a mechanism that let you 

walk into any government office and reprove that you were you. 

In the U.S., we need to move to a system in which an individual can prove their identity 

to someone, but not make it such that when proving their identity, they're giving the other 

party the ability to impersonate them. If we continue to rely on private pieces of information 

to prove our identity, we will continue to have those pieces of information stolen and 

misused-which will impact millions of individuals in the United States. 

Yet there will certainly be an interim period during the transition that will require SSNs to 

play a role. There is a difference between using a number as an identifier and having that 

identifier be considered sensitive information. Given that lots of data already exists in all 

sorts of databases, and SSNs are used as a part of those datasets, it would be unrealistic 

to ban their use overnight. But they should be used strictly as an identifier, so they cannot 

be used to prove that imposters are the genuine individuals. 

It is reasonable that the IRS uses an SSN as a part of its tax accounting solution, at least 

for the near term. But if somebody calls the IRS and simply gives their SSN and date of 

birth, that in and of itself should no longer be sufficient for the IRS to believe that the 
69 


ralbany on LAP520R082 with HEARINGS33871.056

individual is definitively who they claim to be. It is the difference between using something 

as a reference to an individual as opposed to being an authenticator - an instrument that 

proves an individual identity. 

We need to debate if keeping the SSN as an identifier is acceptable as long as it is not 

used for authentication or direct authorization. As mentioned earlier, a piece of data that 

is only an identifier does not pose a security risk even if it is widely known. The most 

critical focus should be on eliminating the SSN for authentication. We do need to 

recognize that we are running out of SSNs. The number of permutations in a 9-digit 

number is 1 billion. There are now about 325 million citizens in the United States, which 

could exhaust the pool of SSNs within a few generations. Is this acceptable? If we 

determine it is OK to re-use SSNs, we have some headway, but if we are re-architecting 

the system, it may be a good time to consider a larger namespace that eliminates the 

need for re-use in the long run. 

Change will require a good partnership between the private sector and federal, state and 

local governments, given that identity is something that is used where citizens interact 

with many forms of government. Even within the private sector, we will need partnerships 

to determine what is appropriate for different types of private transactions. 

We need to move quickly, however. Every day that we do not solve this problem sets up 

the opportunity for criminals to use compromised consumer data for the impersonation of 

individuals whose data has been breached. Granted, the world needs to operate during 

the transition, and we need to have a high level of pragmatism to work through this. At 

the same time, we should not indefinitely kick the can down the road and ignore the 

problem, forcing ourselves to default to systems that are inherently insecure. 

The mega retail breaches of a few years ago changed financial institutions' perspectives 

and pushed U.S. merchants to move to chip-based credit cards. That series of events 

was the catalyst that made major industries take a step forward in using available 

technology. The Equifax event is very similar; it is a catalyst that should make us say, 

"Lefs talk about this." 

Now I'd like to make some policy recommendations. 

POLICY RECOMMENDATIONS 

Issue an Identity Management Executive Order - The Administration's executive 

orders on IT modernization and cybersecurity focused attention on modernizing our 

federal IT and cybersecurity capabilities. While these orders touched on identity 

management, the state-of-affairs in identity management is at such a critical stage that 

the President should issue an up-to-date executive order on this topic. An executive order 

on identity management would be a powerful call to action to all federal departments to 

leverage existing authorities to drive real change. Such an order would reinforce the 

Office of Management and Budget's (OMB) recent identity management guidance, 

"Strengthening the Cybersecurity of Federal Agencies through Improved Identity, 

Credential, and Access Management". 
70 


ralbany on LAP520R082 with HEARINGS33871.057

Examples of initiatives should include: 

• Developing model legislation to ban the simple knowledge of a Social Security 

number as an accepted form of authentication throughout our economy. 

• Doubling down on privacy - what works in some countries will not work in the 

United States, given our long-held aversion to the type of system India has 

developed. 

• Reinvigorating the National Strategy for Trusted Identities in Cyberspace, NSTIC, 

by funding and staffing it properly to continue progress between the public and 

private sectors on identity management standards. 

• Encouraging and enabling federal agencies to act as validators of identity, given 

the many credentials over which the federal government has authority, including 

passports. 

• Mandating all federal a-government services provided directly to citizens require 

the use of strong authentication to enhance trust in government services. 

The latter action would improve citizen trust and satisfaction in government services and 

set an example the private sector is likely to replicate, given the power of the government 

to influence adjacent markets. But achieving success will require federal agencies, 

particularly the Social Security Administration, to double down on their IT and 

cybersecurity modernization efforts. Agencies should leverage IT modernization 

innovation funds to ensure their authentication systems are both modern and secure. 

Care needs to be taken to ensure cloud services that help enable citizen authentication 

are secure end-to-end, given the risk of assuming that just because personal identifying 

information (PI I) is in the cloud, it is secure. 

Let Innovation in the Private Sector Flourish - The private sector has not stood still. 

The FIDO (Fast IDentity Online) Alliance has made progress toward addressing the lack 

of interoperability among strong authentication devices and solving the problems users 

face creating and remembering multiple usemames and passwords. The Organization for 

the Advancement of Structured Information Standards (OASIS) has developed the 

Security Assertion Markup Language, an open standard for exchanging authentication 

and authorization data between identity providers and service providers. A standard 

called OAuth has also been developed - an open standard for access delegation, 

commonly used as a way for Internet users to grant websites or applications access to 

their information on other websites but without giving them the passwords. 

Yet more needs to be done. To date, the private sector has not solved the authentication 

challenges needed to build a truly modern identity management system. More private 

sector collaboration is needed to construct all the technical components - all the truly 

open and interoperable standards needed to give American citizens the high-quality 

identity management environment they deserve. If more progress is made in creating 

interoperable standards based on collaboration, a single, more proprietary, de-facto 

identity management system could develop. 
71 

f 


ralbany on LAP520R082 with HEARINGS33871.058

While there are examples of de-facto standards, in the PC industry for instance, the risk 

of de-facto standards, particularly in an area as vital to the national interest as identity 

management, is that vendor lock-in could slow down innovation and progress. The 

government, led by NIST, should collaborate with FIDO and the other private sector 

identity management alliances and working groups, to share best practices and 

encourage the development and deployment of truly open standards and technologies. 

An identity management ecosystem based on open architecture solutions will promote 

innovation and increase the freedom of citizens to choose the identity management 

approach that meets their own needs. 

Invest in Research and Development - The government has a fine track record of 

supporting basic research and development managed by universities and other centers 

of learning such as think tanks. These investments have enabled the United States to 

lead the world in semiconductors, software and bio-medicine. Investments in identity 

management research and development can produce similar results, particularly in a 

world where such stair-step innovations as quantum computing have the potential to 

disrupt our current and future identity management models. 

Move Faster in Driving Quantum-Safe Algorithms and Integrating into Identity and 

Crypto Solutions - The government needs to incentivize and fund aggressive research 

into quantum computing. The private sector has already put a good deal of effort behind 

developing a quantum computer, with companies like Intel and Microsoft making good 

progress. Other nations realize that the country that develops the first quantum computer 

will have a significant advantage over others. The U.S. should take note of this and - at 

a minimum - make sure quantum-safe algorithms are integrated into network protocols 

and data protection algorithms as well as identity solutions. It is a matter of when, not if, 

quantum computing will be available to break current quantum-unsafe algorithms. A new 

identity architecture should at least allow the replacement of algorithms as quantum-safe 

capabilities become available. 

CONCLUSION 

It is an honor to testify before this subcommittee. We face identity management and 

cybersecurity challenges that merit immediate and sustained attention and investment. 

The fact that this committee, with its Social Security oversight and policy authority, is 

focused on solving the identity management challenge is truly encouraging. I appreciate 

your interest in considering my recommendations and look forward to answering your 

questions. 
72 

Chairman JOHNSON. Mr. Grant, welcome. Please go ahead. 

STATEMENT OF JEREMY A. GRANT, COORDINATOR, BETTER 

IDENTITY COALITION 

Mr. GRANT. Thank you. Good morning, Chairman Johnson, 

Ranking Member Larson, Members of the Committee. Thank you 

for the opportunity to discuss the future of the Social Security 

number with you today. 

I am here on behalf of the Better Identity Coalition, an organization launched earlier this year focused on bringing together leading 

firms from different sectors to develop a set of consensus, cross-sector policy recommendations that promote the adoption of better solutions for identification and authentication. 

The Coalition’s founding members include recognized leaders 

from diverse sectors of the economy, including financial services, 

health care and technology, telecommunications, fin tech, payments, and security. Our members are united by a common recognition that the way we handle identity today in the U.S. is broken, and by a common desire to see both the public and private sectors each take steps to make identity work better. 

As background I have worked for more than 20 years at the 

intersection of identity and cyber security. In 2011 I was selected 

to lead the National Strategy for Trusted Identities in Cyber Space, 

which was a White House initiative focused on improving security, 

privacy, choice, and innovation through better approaches to digital 

identity. In that role I also led the identity team up at NIST. 

I left government three years ago, and now lead the technology 

business strategy practice at Venable, a law firm here in town with 

the country’s leading privacy and cyber security practice. And in 

that role I serve as the coordinator of the Better Identity Coalition. 

Let me say I am grateful to the Committee for calling this hearing today. The SSN is a key component of our identity infrastructure, and the future of this number impacts every American. Up 

front, I would submit that many of our challenges here are linked 

to more than 80 years of contradictions in policy around how this 

number should be managed and used. 

Among the biggest contradictions, the SSN is simultaneously 

presumed to be both secret and public: secret, because we tell individuals to guard their SSN closely; public, because we have multiple laws that require individuals to give it out to facilitate all 

sorts of interactions with industry and government; secret, because 

we then tell those entities to ensure that, if they store it, which the 

law often requires them to do, that it be protected; and public, because that has proven quite hard to do, to the point that the majority of Americans’ SSNs have been compromised multiple times over 

the last several years, amidst a wave of data breaches. 

Now, these contradictions are not the result of anything malicious. On the contrary, they reflect years of trying to balance several important roles played by the SSN and the Social Security Administration. What is most important now is that the government, 

one, recognizes these contradictions and, two, takes steps to put 

policies in place that are more consistent, and that put us on a 

path towards a system that enhances security, privacy, and convenience for Americans. 


ralbany on LAP520R082 with HEARINGS
73 

I believe there are five areas where change is needed. 

Firstly, when talking about the future of the SSN and whether 

it needs to be replaced, it is essential, as Chairman Johnson noted 

and many members of the panel have noted, to understand the difference between the number’s role as an identifier, which is a number used to sort out which Jeremy Grant I am among the hundreds 

in the U.S., and its use as an authenticator, which is something 

that can prove I am actually this Jeremy Grant. 

SSNs should no longer be used as authenticators. That means, 

as a country, we stop pretending this number is a secret, or that 

knowledge of an SSN can be used to prove that someone is who 

they claim to be. 

Secondly, just because SSNs should no longer be used as authenticators does not mean that we need to replace them with some 

sort of new SSA-issued identifier. I have yet to see any proposal 

here that does not involve spending billions of dollars and confusing hundreds of millions of Americans with very little security 

benefit. 

Rather than create a new identifier, our focus ought to be on 

crafting better authentication solutions that are not dependent on 

the Social Security number and are resilient against modern vectors of attack. 

Thirdly, on the authentication topic, there is good news. Multistakeholder efforts like the FIDO Alliance and the World Wide Web 

Consortium have developed standards for next-generation authentication that are now being embedded in most devices, operating 

systems, and browsers in a way that enhances security privacy and 

the user experience. The government can play a role in accelerating 

the pace of adoption. 

Fourthly, even if we assume the SSN is publicly known, that 

does not mean it needs to be used everywhere. Many of the members of the Better Identity Coalition would love to reduce where 

they use the SSN, due to the risks that it presents to them, relative to other identifiers. However, they are running up against 

laws and regulations that require them to collect and retain the 

SSN. 

Finally, we need to focus not just on the SSN, but also the future 

of the Social Security Administration. The issue here goes beyond 

the future use of a nine-digit number to encompass a broader topic: 

What role should the government play in the future of the identity 

ecosystem? 

Now, while identity may not be a part of the SSA’s mission statement, there is no question that in 2018 the SSA is in the identity 

business. It is time to acknowledge that fact and then take a step 

back to contemplate what that means. 

Having agencies like SSA accept their role here may be the most 

impactful thing that the government can do to help solve our identity challenges. Specifically, like allowing consumers to start asking 

agencies that have their personal information to vouch for them to 

parties they seek to do business with. 

The SSA and state departments of motor vehicles have the most 

to offer here, and this concept was embraced in the 2016 report 

from the Bipartisan Commission on Enhancing National Cyber Security. The Federal Government should work to, one, develop a 


ralbany on LAP520R082 with HEARINGS
74 

framework of standards and rules to make sure this is done in a 

secure, privacy-protecting way; and second, fund work to get it 

started. 

I appreciate the opportunity to testify today and look forward to 

answering your questions. 

Chairman JOHNSON. Thank you, sir. 

[The prepared statement of Mr. Grant follows:] 


ralbany on LAP520R082 with HEARINGS
75 


ralbany on LAP520R082 with HEARINGS33871.059

Jeremy Grant 

Coordinator, The Better Identity Coalition 

and 

Managing Director, Technology Business Strategy, Venable LLP 

U.S. House Committee on Ways & Means 

Subcommittee on Social Security 

""Securing Americans' Identities: The Future of the Social Security Number" 

May 17, 2018 

Chairo1an Johnson, Ranking Member Larson and members of the couunittee, thank you for the 

opportunity to discuss the future of the Social Security Number (SSN) with you today. 

I am here today on behalf of the Better Identity Coalition1 - a new organization launched earlier 

this year focused on bringing together leading finns from different sectors to develop a set of 

consensus, cross-sector policy recommendations that promote the adoption of better solutions for 

identity verification and authentication. The Coalition's founding members include recognized 

leaders from diverse sectors of the economy, including financial services, health care, 

technology, telecommunications, Fin Tech, payments, and security. 

As our name would suggest, the Better Identity Coalition is not seeking to push the interests of 

any one technology or industry. Instead, our members are united by a common recognition that 

the way we handle identity today in the U.S. is broken - and by a common desire to see both the 

public and private sectors each take steps to make identity systems work better. 

As background, I've worked for more than 20 years at the intersection of identity and 

cybersecurity. Over the course of my career, I've been a Senate staffer, led a business unit at a 

technology company architccting and building digital identity systems, and done stints at two 

investment banks helping investors understand the identity market - cutting through what works 

and what doesn't, and where they should put capital. In 20 II, I was selected to lead the National 

Strategy for Trusted Identities in Cyberspace (NSTIC), a White House ioitiative focused on 

improving security, privacy, choice and innovation online through better approaches to digital 

identity. In that role I worked with industry and govenunent to tackle major challenges in 

identity, built out what is now the Trusted Identities Group at the National institute of Standards 

and Technology (NIST), and also served as NISI's Senior Executive Advisor for Identity 

1 More on the Beller Identity Coalition can be fotmd at https;//www.beuerirlentity.org 
76 


ralbany on LAP520R082 with HEARINGS33871.060

Management. I left govenunent in2015 and now lead the Teclmology Business Strategy 

practice at Venable, a law finn with the country's leading privacy and cybersecurity practice. In 

that role at Venable I serve as the Coordinator of the Better Identity Coalition. 

Setting the stage 

Let me say up front that I am grateful to the Committee for calling this hearing today. The SSN 

is a key component of America's identity infrastmcture, and the sometimes conflicting roles that 

the SSN plays - which I will outline today - are a topic that impacts every American. At a high 

level, the way we handle identity in America impacts our security, our privacy, and our liberty. 

And from an economic standpoint, particularly as we move high-value transactions into the 

digital world, identity can be the great enabler - providing a foundation for digital transactions 

and online experiences that are more secure, more enjoyable tor the user, and ideally, more 

respectful of their privacy. 

But when we don't get identity right, we enable a set of great attack points for criminals and 

other adversaries looking to execute attacks in cyberspace. And unfortunately, we have not been 

doing well here. Last year, a whopping 81% of backing attacks were executed by taking 

advantage of weak or stolen passwords, according to Verizon's annual Data Breach Investigation 

Report. 8 1% is an enom1ous number - it means that it's an anomaly when a breach happens and 

identity does not provide the attack vector. 

And outside of passwords, we' ve seen private and state-sponsored adversaries seek to steal 

massive data-sets of Americans, including their SSNs. With these stores of data, they have an 

easier time compromising the questions used in "identity verification" tools like KnowledgeBased Authentication or Verification solutions (KBNKBV). We 've seen an uptick in breaches 

that exploit these tools as a result. 

A key takeaway for this Committee to understand today is that attackers have caught up with 

many of the "first-generation tools" we have used to protect and verify identity - and one's 

knowledge of his or her SSN bas been a key component of these tools. The recent Equifax 

breach may have driven tllis point home, but the reality is that these tools have been vulnerable 

for quite some time. There are many reasons for this - and certainly blame to allocate - but the 

most important question is: "What should government and industry do about it now?" 

I believe we are at a juncture where the government will need to step up and play a bigger role to 

help address critical vulnerabilities in our "digital identity fabric." To that end, it is inlportant to 

talk not only about the future of the SSN, but also the role of the Social Security Administration 

(SSA). 

2 
77 


ralbany on LAP520R082 with HEARINGS33871.061

The role of the SSA- and the future of the SSN 

Up front, I would submit that many of our woes in identity are linked to the rather bizarre way 

the United States has treated the Social Security Number over the last 80 years. I expect the 

history of the SSN is well known to tbis Committee, but I do think it's worth briefly pointing out 

some of the contradictions in policy around how it should be managed and used. 

l. First, the SSN is simultaneously presumed to be both secret and public. Secret because 

we tell individuals to gnard their SSN closely. Public, be.cause we also tell individuals to 

give it out to faci litate all sorts of interactions with industry and government. Secret 

because we tell those entities in both govenunent and the private sector to ensure that if 

they store it - which the law often requires them to do - that it be protected. And public, 

because that's proven quite hard to do: to the point that the majority of Americans' SSNs 

have been compromised multiple times over the last several years amidst a wave of data 

breaches. 

2. Second the SSN is commonly used as both an identifier and an authenticator. As I will 

discuss today, years of breaches mean the SSN is oflittle value for authentication - but it 

is still quite valuable in the role it was first created for, as a unique identifier. 

Understanding this difference is key to crafting a solid strategy for the SSN's future. 

3. Third, the SSN system is managed by an agency not formally tasked with providing an 

essential element of the country's identity infrastructure. Yet the SSA finds itself in that 

role by default - and is increasingly being asked to do more. 

These policy contradictions are not the result of anything malicious; on the contrary, they reflect 

years of trying to balance several important roles played by the SSN and the SSA. What's most 

important now is that the government I) recognizes these contradictions, and 2) takes steps to put 

policies in place that are more consistent, and that put us on a path toward a system that enhances 

security, privacy and convenience for Americans. 

That process starts by changing how we view the SSN and how we use it. 

I believe there are five areas where change is needed - and where this change can contribute to 

material improvements in the confidentiality, reliability and integrity of America's identity 

ecosystem, wl1ile also improving privacy and eliminating barriers to digital commerce. 

l. Up front, government should acknowledge that there is not a need to "replace" the Social 

Security Number (SSN) - at least not in the way that some have suggested in recent 

months. Rather, government should take steps to change how we usc it. 

3 
78 


ralbany on LAP520R082 with HEARINGS33871.062

There's been a ton of discussion on this topic over the last few months as some industry 

and government leaders, along with security and privacy experts, have called for the 

country to come up with "something to replace the SSN." 

Unfortunately, the debate has been muddled by people failing to differentiate between 

whether the SSN is an identifier or an authenticator. Part of the confusion is that SSN has 

been used as both identifier and authenticator in recent years. 

At its core, the SSN was created as an identifier. It is a 9-digit code, issued by the Social 

Security Administration at birth, that is used to help the govemment know "which Jeremy 

Grant" they should associate wage and tax data with, and to help administer the delivery 

of Social Security benefits. Over time, use of the SSN has expanded beyond the purposes 

for which it was intended, with thousands of private sector entities collecting the SSN as 

part of the account opening experience - and by credit reporting firms, data brokers, and 

other private finns, who have used the SSN as one way to aggregate and match data 

about a person. 

These expanded uses of the SSN are all as an identifier. But where things have really 

changed is the practice of using the SSN as an authenticator. Every time a party asks for 

the last four digits of that number, for example, the premise is that the SSN is a secretand thus possession of the SSN could be used to authenticate a person. 

There was a time when SSN as authenticator made sense: someone's SSN was not widely 

known or publicly available, so it was safe to presume that it was a secret. But in 2018 -

after several years of massive data breaches where millions of SSNs have been stolen -

the notion that SSNs are a secret is a fa llacy. The Equifax breach may have woken people 

up to this fact, but for several years now, SSNs have been widely available on the dark 

web for just a dollar or two. 

The message is clear: data breaches have gotten bad enough that we should assume an 

attacker can get someone's SSN with only minimal etTort. The attackers have caught up 

to authentication systems that use SSN as a factor - it's time to move on to something 

better. 

With this, we need to move beyond using the SSN as an authenticator. Beyond 

delivering immediate in1provements to security, such a move would also lessen the value 

ofSSNs to criminals and other adversaries. 

2. Just because SSNs should no longer be used as authenticators does not mean that we need 

to replace them as identifiers. When architecting a system for security, identifiers don't 

have to be a secret - and many times it is desirable that they be known. Given that -

4 
79 


ralbany on LAP520R082 with HEARINGS33871.063

rather than replace the SSN as an identifier, instead, let's start treating SSNs like the 

widely-available numbers that they are. 

Doing tlus is the single best way to reduce the risks associated with use of the SSN as an 

identifier. Tfwe shift everybody's mindset to one where everybody understands that 

SSNs are widely known - and de.sign security systems that don't allow someone with just 

an SSN to use it to gain access to data or services - it effectively devalues the SSN as an 

attack point. 

There have been a number of proposals suggesting that America should instead scrap the 

SSN and invest in creating a new, revocable identifier administered by the SSA. 

I've yet to see any proposal that does not involve spending tens of billions of dollars and 

confusing hundreds of millions of Americans- with very little security benefit. The 

reality is that both government and industry would simply map that new identifier back to 

the SSN and other data in their systems. Because the new and old identifiers would be 

connected, the security benefits would be close to nil. 

Moreover, the possibility of chaos due to errors in mapping and matching these additional 

identifiers would be quite high, given that many government and conunercial systems 

deliver less than 100 percent accuracy today; think about what might happen when a 

system fails to associate a new identifier with the right person. 

Winston Churclllll once said: "Democracy is !he worst form of Government except for all 

!hose other forms !hat have been tried." So it is with the SSN - it's not a perfect 

identifier, but keeping it beats the altematives. 

Rather than create a new identifier, the focus ought to be on crafting better authentication 

solutions that are not dependent on the SSN, and are resilient against modem vectors of 

attack. 

3. On the authentication topic - we need to recognize that the problems with using SSNs as 

an authenticator extend to using any "shared secret" for authentication. It doesn't matter 

if the so-called "secret" is the SSN or passwords - they both are terrible. 

As I mentioned earlier, 81% of 20 16 breaches were enabled by compromised passwords, 

which is about as clear a sign as you can ask for that things need to change. There is no 

such thing as a "strong" password or "secret" SSN in 20 18 and we should stop trying to 

pretend otherwise. We need to move the country to stronger fom1s of authentication, 

based on multiple factors that are not vulnerable to these common attacks. 

There is good news in this regard: parts of govemment and industry have recognized the 

problems with old authenticators like passwords and SSNs - as well as other forms of 

5 
80 


ralbany on LAP520R082 with HEARINGS33871.064

authentication using "shared secrets" - and worked together these past few years to make 

strong authentication more secure and easier to use. Multi-stakeholder groups like the 

Fast Identity Online (FIDO) Alliance and the World Wide Web Consortium (W3C) have 

developed standards for unphishable, next-generation multi-factor authentication (MFA) 

that are now being embedded in most devices, operating systems and browsers, in a way 

that enhances security, privacy and user experience. Government should recognize the 

significance of this market development that is enabling authentication to move beyond 

the password, and embrace it. 

What makes this possible is the fact that the devices we use each day have evolved. Just 

a few years ago, MFA generally required people to carry some sort of stand-alone 

security device with them. This added costs and often degraded the user experience. 

Moreover, these devices were generally not interoperable across different applications. 

Today, however, most devices - be they desktops, laptops or mobile devices - are 

shipping from the factory with a number of elements embedded in them that can deliver 

strong, multi-factor authentication that is both more secure than legacy MFA technology 

and also much easier to use. 

What are these elements? 

I) Multiple biometric sensors - most every device these days comes with 

fingerprint sensors, cameras that can capture face and sometimes iris, and 

microphones for voice. 

2) Special tamper-resistant chips in the device that serve as a hardware based 

root of trust - such as the Trusted Execution Environment (TEE) in 

Android devices, the Secure Enclave (SE) in Apple devices, and the 

Trusted Platform Module (TPM) in Windows devices. These elements are 

isolated from the rest of the device to protect it from malware, and can be 

used to l) locally match biometrics on the device, which then 2) unlocks a 

private cryptographic key which can be used for authentication. 

Together, these two elements enable the ability to deliver authentication that is materially 

more secure than older authentication technologies, and also easier to use. Because rather 

than require the consumer to carry something separate to authenticate, these solutions are 

simply baked into their devices, requiring them to do nothing more than place a finger on 

a sensor or take a selfie. 

The rest of the authentication (the other factors) automatically happens "behind the 

scenes" - meaning that the consumer doesn't have to do the work. A biometric matched 

on the device then unlocks a second factor - an asymmetric, private cryptographic key, 

6 
81 


ralbany on LAP520R082 with HEARINGS33871.065

that can then be used to securely log the consumer in, without a password or any other 

shared secret. 

While the actual composition of these two elements - both biometric sensors and security 

chips - varies across manufacturers, most of the companies involved in making these 

devices and elements have been working together to create the FIDO and related W3C 

Web Authentication standards. The power of these standards is that they enable all of 

these elements all to be used - interoperably - in a conunon digital ecosystem, regardless 

of device, operating system or browser. Which means that it's become really easy for 

banks, retailers, governments and other organizations to take advantage of these 

technologies to deliver better authentication to customers. Firms such as Aetna, PayPal, 

Google, Microsoft, Cigna, Intel, T-Mobile, Samsung, and several major banks are among 

those enabling consumers to lock down their login with FrDO authentication; the 

Department of Veterans Affairs recently enabled Veterans logging into the Vets.gov 

website to protect their accounts with FIDO as well. 

Government can play a role in accelerating the pace of adoption of strong authentication 

through two key actions: 

I) First, agencies should look to make usc of the FIDO and W3C Web 

Authentication standards in more of its own online applications. ll1is will 

set an example for the private sector to follow - and ensure that citizenfacing applications are more secure and convenient to use. The SSA 

should be among the first here, given the importance of its MySSA online 

portal. 

2) Second, through the regulatory proc.ess, government should ensure that 

regulated industries are keeping up with the latest threats to ftrStgeneration authentication - and implementing the latest standards and 

technologies to address these threats. 

4. Back on the topic of identifiers: even if we assume that the SSN is publicly known, that 

doesn't mean that it needs to be used everywhere. Many of the members of the Better 

Identity Coalition would love to reduce where they use the SSN, due to the risks that 

collecting and retaining SSN may create relative to other identifiers. However, in some 

cases, they are rulllling up against laws and regulations that require companies to collect 

and retain the SSN. 

Among the legal requirements here: 

• The Federal government requires employers to collect SSN each time they hire 

someone 

7 
82 


ralbany on LAP520R082 with HEARINGS33871.066

• The Federal govemment requires financial institutions to collect the SSN as part 

of account opening or applying for a mortgage - and requires them to retain it for 

up to five years after the account is closed 

• The Federal government requires college students to provide their SSN when 

applying for student loans 

• The Federal govemment requires state govemments to collect the SSN when 

Americans apply for a driver's licenses 

• Health insurers are required by the govemment to collect the SSN of each person 

they insure 

• Many states require blood donation services to collect and retain the SSN of blood 

donors 

• The Coast Guard requires SSN to be collected as part of its Vessel Identification 

System 

Much of industry's ability to reduce their reliance on the SSN will be dependent on the 

government changing its requirements for them to collect it. 

Moreover, this list also demonstrates just how embedded the SSN is as an identifier in so 

many of our identity processes - and helps to frame the complexity and cost associated 

with any effort to replace it. 

5. Finally, any discussion of the future of the SSN also ought to include a discussion on the 

future of the SSA. The issue here goes beyond the future use of a 9-digit number to 

encompass a broader topic: what role should the govemment play in the future of the 

identity ecosystem? 

While identity may not be a part of the SSA's mission statement, there is no question that 

SSA is in the identity business. It's time to acknowledge that fact - and then take a step 

back to contemplate what that means. 

One of the biggest challenges the U.S. faces when it comes to digita l identity is that the 

country has a number of authoritative govemment identity systems - the SSN included -

which c-onsumers, agencies and businesses have been able to leverage for in-person 

transactions. However, these systems are largely rooted in the physical world - based on 

cards and paper- at a time when commerce is moving to the online world. 

Industry has tried to fill the gap with tools like so-called Knowledge-Based Verification 

(KBV) systems that attempt to verify identity online by asking an applicant several 

8 
83 


ralbany on LAP520R082 with HEARINGS33871.067

questions that, in theory, only he or she should be able to answer. But as I noted earlier, 

adversaries have caught up with these systems, and other first-generation tools that 

America bas used for remote identity proofing and verification. 

Against this backdrop, governments at both the Federal and State level should look to 

modernize their legacy identity systems around a privacy-protecting, consumer-centric 

model that allows consumers to ask the government agency that issued a credential to 

stand behind it in the online world - by validating the infonnation from the credential. 

The Social Security Administration (SSA) and state governments - the latter in their role 

as issuers of driver's licenses and identity cards - are the best positioned entities to offer 

these services to consumers. 

To that end, the recent action by this Committee - and the full House - to advance H.R. 

5192, the Protecting Children from Identity Theft Act, was a welcome development. The 

legislation would allow consumers to electronically request that the SSA validate whether 

SSA bas a name, SSN and date of birth on file that matches the one they provide to a 

financial institution for certain kinds of account openings covered under the Fair Credit 

Reporting Act (FCRA). 

Tbe lack of such a service makes it much easier today for criminals to set up fraudulent 

accounts with " synthetic identities" using a fake name and a real SSN - often the SSN of 

a child. 

Note that this new bill is not targeting SSN's use as an authenticator, only as an 

identifier; the goal is to enable consumers to request that SSA verify to a financial 

institution that a particular person with their name, date of birth and SSN actually exists. 

Enabling SSA to validate th.is infonnation wiU lower the cost of digital transactions and 

close off a loophole that is commonly exploite.d by criminals to steal identities and fund 

illicit activities. 

The bill is a great start, and I hope to see it become law this year. That said, it does not 

go far enough: 

1) First, because as a consumer, I'd like to be able to ask SSA to help prove I 

am really me for a variety of different purposes online, not just opening a 

bank account. 

2) Second, because it limits SSA to only validating three core attributes -

Name, date of birth and SSN - when SSA also may have the ability to 

assist consumers by validating other attributes in SSA 's systems. 

9 
84 

f 


ralbany on LAP520R082 with HEARINGS33871.068

Note that this concept was embraced in the 20 16 report from the bipartisan Commission 

on Enhancing National Cybersecurityl, who, in response to the wave of attacks 

leveraging compromised identities, stated "The govenunent should serve as a source to 

validate identity attributes to address online identity challenges." Per the report: 

"The next Administration should create an interagency task force directed to find 

secure, user-friendly, privacy-centric ways in which agencies can serve as one 

authoritative source to validate identity attributes in the broader identity market. 

This action would enable government agencies and the private sector to drive 

significant risk 0111 of new account openings and other high-risk, high-value 

online setvices, and it would help all citizens more easily and securely engage in 

transactions online. 

"As part of this effort, the interagency task force should be directed to incenrivize 

states to participate. States- by issuing drivers' licenses, birth certificates, and 

other identity documents- are already playing a vital role in the identity 

ecosystem; notably, they provide the most widely used source of identity proofing 

for individuals. Collaboration is key. Indus fly and government each have much to 

gain from strengthened online identity proofing. The federal government should 

support and augment existing private-sector efforts by working with indust1y to 

set 0111 rules of the road, identifY sources of atlribllles controlled by indus(ly, and 

establish pam meters and tmst models for validating and using those induslly 

aflributes. " 

Government should act on this recommendation, with a particular focus on having the 

Federal govenunent 1) identify how SSA and other agencies can otTer these services; 2) 

lead development of a framework of standards and operating rules to make sure this is 

done in a secure, privacy-enhancing way, and; 3) fimd work to get it started. 

As part of that effott , the SSA should be directed to outline what other attributes they 

may be in a position to validate. 

In closing, while our current use of the SSN poses some challenges, they are not insurmountable. 

On the contrary, we have before us a series of ideas on the future of the SSN that can be used to 

address these challenges - and that are actionable today. I am grateful for the Committee's 

invitation to offer recommendations on how government can improve the SSN - and SSA's role 

in the identity ecosystem - for the fitture, and look forward to your questions. 

2 httns://www.nist. gov/sites/defaul!lfilesldocume•Jts/20 16/12/02/cybersecuritv-conunission-report-fmal·posl.odf 

10 
85 

Chairman JOHNSON. Mr. Lewis, welcome. Thank you for being 

here. Please proceed. 

STATEMENT OF JAMES LEWIS, SENIOR VICE PRESIDENT, 

TECHNOLOGY POLICY PROGRAM, CENTER FOR STRATEGIC 

AND INTERNATIONAL STUDIES 

Mr. LEWIS. Thank you, Mr. Chairman and Ranking Member 

Larson. I thank the Committee for the opportunity to testify. 

One of the leading scientists of the 20th century said that an expert is a individual who has made all possible errors in a particular 

field. And I think that qualifies me as a expert in this issue, since 

I have been involved in programs like this since 1992, none of 

which have worked. 

So let’s give it a try. 

We have all heard how the SSN is the key identifier. It is unique 

to each individual. It is issued by a trusted source. And most importantly, it links to different databases. So your SSN can link to 

your bank, your tax account, your driver’s license. It is irreplaceable. 

It is invaluable for business. But as we have heard, it is also invaluable for crime. One estimate is that somewhere between 60 

and 80 percent of all Social Security numbers have been stolen. Another estimate puts the cost of stolen Social Security numbers at 

$16 billion annually. I think the Committee is on the right track 

here by looking at ways to modernize and strengthen the SSN, the 

Social Security number, because this will provide real benefits and 

reduce crime. 

Our goal should be to provide the same level of service and security that citizens expect from the private sector, or that citizens 

enjoy in other developed economies. 

There are several options for modernizing the SSN. These include federated authentication of identity, public encryption, 

blockchain, and smart cards. Some of these have been tried in the 

past, but they faced problems of complexity, cost, and they raise 

privacy concerns. 

Simply publishing the SSN, as you heard, is a—is the least expensive option, but it doesn’t fix all the problems we face. 

An easy first step would be to replace the Social Security card 

with a smart card, a plastic card with an embedded chip, like the 

credit cards that most of us carry. Millions of commercial transactions are carried out with these cards every day. Most people are 

familiar with them, which would ease the burden of both acceptance and transition. 

A smart card provides a foundation for a secure Social Security 

number. When your credit card is stolen, your financial institution 

cancels the old one and issues you a new number. You are still 

linked to your account, you are still responsible for any legitimate 

charges, but you are not linked to the old number. And a similar 

approach might help us in thinking about how to streamline, modernize, and make the Social Security number more secure. 

Social Security Administration could use a similar approach. It 

could administer a smart card approach, or it could contract it out 

to the private sector, a solution that other countries have used. 

Further debate is required, and I think we all recognize that, to deVerDate Sep 11 2014 05:09 Apr 25, 2019 Jkt 033871 PO 00000 Frm 00089 Fmt 6633 Sfmt 6602 I:\WAYS\IN\33871\33871.XXX 33871

ralbany on LAP520R082 with HEARINGS
86 

cide which modernization option is best and, equally important, 

how we will pay for it, because there is no free replacement for the 

SSN. 

Blockchain technology may offer an option for a modernized SSN, 

but it is not ready, as you have heard. It is not yet mature. 

The best argument for smart cards is that we already use them 

on a massive scale. Companies and citizens are familiar with them. 

Implementation, of course, would be difficult. Any change for so 

venerable an institution is going to be difficult. But we have the 

advantage of knowing the technology and processes already work 

because of our experience with credit cards and banks. 

Thank you for the opportunity to testify. I look forward to your 

questions. 

[The prepared statement of Mr. Lewis follows:] 


ralbany on LAP520R082 with HEARINGS
87 


ralbany on LAP520R082 with HEARINGS33871.069

CSIS I CENTER FOR STRATEGIC • 

INTERNATIONAl STUOi ts 

Statement Before the 

House Ways and Means 

Subcommittee on Social Security 

"Securing Americans' Identities: The Future of 

the Social Security Number" 

A Testimony by: 

James A. Lewis 

Senior Vice President 

Center for Strategic and International Studies 

May 17,2018 

1100 Longwol'th House Office Building 

------------WW'W,($1$.0'-G 1616 RHOOt: !Sl.ANO AVC:HUE HW rt&,. (J:O.l) C87.0l:OO 

WA'(HINOTGH:. 0( 201))6 , AX ()01) ''7S.)1'9~ 
88 


ralbany on LAP520R082 with HEARINGS33871.070

Lewis: Written Testimony, House Ways and Means Subcommiuee on Social Secm'ity 05/17/2018 2 

Mr. Chainnan and Mr. Ranking Member, I thank you and the Committee for the opportuuity to 

testify. The Social Security Number (SSN) is the key identifier for the United States. In many 

ways, it is also out of date. The SSN is widely used for commercial purposes. The prime reason 

for this is that the SSN is a free credential that is unique to each individual, issued by a trusted 

source, and links records held in different private and govermnent databases back to the same 

person. In reality, this makes the SSN indispensable. 

The SSN is invaluable for businesses. but it is also invaluable for criminals. One estin1ate is that 

60% to 80% of all SSNs have been stolen. SSN's can be bought in bulk in the cybercrime black 

market, along with other personal information. Since they are used not only to identify an 

individual, but to authorize online transactions, stolen SSNs or fake SSNs are a potent source of 

fraud and identity theft. 

SSNs were never designed for online commerce. They were created in 1936, and originally 

intended only to link citizens to federal benefits. Over time, its use has expanded in both 

government and private transactions and it has been adopted for online use. SSNs still come on a 

paper card that is not intended to be either a credential or an identifier. Once stolen, the SSN is 

very difficult to be replaced. This makes the current SSN system ineffective for electronic 

commerce. While there have been good steps to let people verify SSNs, fraud is still possible. 

Modernizing the SSN is a good goal for action and there are several options for replacement. 

What I will not discuss is a national 1D system, however. I encourage the Commiuee to avoid 

going down this rabbit hole. The U.S. has made several efforts over the last twenty years to create 

a secure digital identifier, but each of these efforts has run into problems of complexity, cost, and 

privacy concerns. The authentication of identity online is an intricate process. Many smaller 

countries have solved the problem by creating national identity systems that lets people securely 

identify themselves online. These are often based on a National Identity card, but the U.S. is not 

ready for such a bold step. 

The committee should avoid a discussion of authentication of identity online and instead focus on 

modernizing and strengthening the SSN, a more achievable goal that will in itself provide real 

benefits and reduce the risk of online fraud. Modernizing the SSN could be a first step toward 

better digital authentication in the U.S The goal should be to provide citizens with the same level 

of service they would expect from a credit card company or a major online retailer. 

In thinking about how to do this. we need to consider how to manage continuity, cost, and 

complexity in any new system. The most important aspect of this is that any modernization should 

not break the SSNs critical role as a unique national identifier. A modernized SSN would require 

decisions on several elements. 
89 


ralbany on LAP520R082 with HEARINGS33871.071

Lewis: Wrinen Testimony, House Ways and Means Subcommittee on Social Security 05/17/2018 3 

There are basically two approaches to reducing the risk of using the SSN as an identifier. The fust 

is to strengthen the SSN to make it harder to steal or use fraudulently. The second is to reduce or 

eliminate its value as a credential. Moving to a more secure and modern SSN will be a difficult 

and complex transition. The central goals are to take advantage of the growth in internet 

connectivity that has occurred in the last decade and to model a modernized SSN on existing online 

systems and their safeguards. There are several decisions required on what comse to take and 

what optiollS to select. We can sketch out one path (among several) for SSN modernization. 

The first step is to replace the paper SSN card with a "smart card," a plastic card with an embedded 

integrated circuit (a "chip"), like the credit cards most of us carry. This is the solution adopted by 

credit card companies some time ago as a way to reduce fraud. Most people are familiar with this 

kind of card, which would ease the bmden of both acceptance and trallSition for SSN holders. 

Even if nothing else was changed, a smart card would be an improvement over the current paper 

card. A smart card provides the foundation - for use now or for later - to build a more secure 

system. Iftbe Congress decided to take advantage of a smart cards additional capabilities, it could 

model a modernized SSN on the credit card system and its safeguards. When your card is stolen, 

your financ ial institution cancels the old one and issues you a new card number. You are still 

linked to your account, but not to tbe old credit card number. 

SSA could use a similar approach. SSA should have some way to replace an SSN when it is 

compromised, since compromise is unavoidable. The added complexity is that a replacement SSN 

must preserve the ability to link multiple records to the same individual. There are ways to do this 

but they involve additional cost and responsibility for the SSA. 

The SSN itself would not be used in commercial trallSactiollS. It would instead be used to generate 

a number associated with the SSN accOLmt. Ifrhis number was compromised, a new number could 

be generated using the SSN ''root." The SSN itself could be kept secret, encrypted, and the 

generation of the replacement number could be controlled by the SSA. 

For example, the new smart card SSN could use a proxy number, a replaceable number linked to 

your SSN account. You would still be issued an SSN at birth, but it would not be made public. 

Instead, you would get a proxy number, stored on the new smart card and linked to your SSA 

account number. People are already familiar with this from credit card or debit card use. Your 

credit card has a number used to authorize transactiollS. It is linked to an account at a fmancial 

institution that has its own account number. Tltis account number is linked to your SSN, for tax 

and verification purposes. When your credit card is stolen or compromised, you notify the card 

company, which generates a new credit card with a new number for you, linked to yotu account, 

whose number does no! change. 
90 


ralbany on LAP520R082 with HEARINGS33871.072

Lewis: Written Testimony, House Ways and Means Subconuoittee on Social Security 05/17/2018 4 

For the SSN, this means the number on your SSA-issued smart card will not be your SSN. Instead, 

it will be a "proxy" number that links to your SSN. The proxy number could use a different format 

than the nine-digit SSN to avoid confusion, and the SSN itself would not be used for commercial 

purposes - this might require legislation to require companies to transition to the new system and 

to replace the SSN in their account with the new proxy number. 

For tll.is to work, merchants, banks and others who now use the SSN will need some way to verify 

that the proxy number links to a real SSN account. This means SSA will need some sort of 

verification process sinl.i.lar to that used by credit card companies. When you present your credit 

card, the number is automatically checked to see if the card has been reported stolen or if there are 

indications of fraud. An SSN verification system could build off existing verification systems 

already in use by SSA, where an employer submits an SSN to see if it is a real number, except now 

these systems would need to be expanded to confirm that the proxy number is linked to a real 

account. At some point in the future, SSA could even develop a mobile "app" for the verification 

process. 

SSA currently operates two verification services that confirm the social security number and name 

for wage reporting purposes. If it was to move to a sy-stem similar to that used by credit card. it 

would need to frrst use the SSN issued at birrh to generate another number (a "pseudo-SSN") that 

could be used for identification purposes (and which could be replaced if compromised), and then 

adapt the existing verification system to allow people to check if the pseudo-SSN was still valid. 

SSA could develop additional measures (similar to those used by fmancial institutions) to identify 

possible fraudulent use. SSA would also need some system for citizens to report when their 

number has been compronl.ised and needs to be replaced. 

Exchanging a compromised proxy number would require a citizen going to SSA and requesting a 

replacement. Before issuing a replacement. SSA would need to verify that the request was 

legitin1ate. This requires some kind of process for the authentication of identity. The system that 

banks and online merchants use is multifactor authentication. This uses a "shared secret," usually 

a password, and then some other some other secret to verify identity. Again, the transition burden 

would be reduced as may citizens are already fanlliiar with these systems. 

To replace an SSN, a citizen could call or log onto the SSA website. There are several different 

approaches to multi-factor authentication that could be used to ensure that the replacement request 

was legitimate. SSA could issue a PIN number with the smart card, and the PIN would need to be 

entered to request a new number. SSA could use the mobile texting system many banks and online 

service provider use. where you enter a request and then are sent a code to verify identity, such as 

with Gmail or Office 365. 

SSA would need to assign a password to each account, and then take additional steps depending 

on what authentication method Congress chases, whether it is a PIN, additional shared secret (like 
91 


ralbany on LAP520R082 with HEARINGS33871.073

Lewis: Written Testimony, House Ways and Means Subcommittee on Social Secluity 05/1712018 s 

asking user to identify the color of their first home) or to generate an authorization code. SSA 

would need the ability to receive a request, verify the password, and have on file an email address 

or phone number to which an authorizing code could be sent. 

This sounds complicated, but hundreds of millions of commercial transactions are carried out every 

day using these systems. Congress needs to move the social security system into the 21" century. 

There are costs. however. Non-recurring costs include replacing paper cards with plastic smart 

cards, building an online account verification system at SSA, and the cost to firms and agencies to 

change their number used in existing accounts from the real SSN to the proxy. Recurring costs 

would include providing the verification service and the cost of regenerating a new proxy number. 

Given the complexity of these systems, and the immense experience of the private sector in 

implementiug them, Congress could choose to rely on private sector service provides to supply the 

smart card and the proxy number. Commercial venders already have the "backroom" processes 

needed for this smart card approach. Private sector suppliers would still rely on SSA to create and 

hold the "real" SSN. This would reduce the burden on SSA, but ra ises the question of who pays 

for all thi.s? Does SSA subcontract the issuance process to the private sector, should there be user 

fees (something almost certain to be unpopular, although we charge for passports and driver's 

licenses), or should a new system be subsidized from general revenues. 

The options are to have SSA do this. to contract to the private sector, or to piggy-back on the 

existing driver's license issuance process (where states could either charge customers or be 

subsidized). States have not yet moved to smart cards, however, and an effort to mandate this 

would almost certainly run into opposition. Further debate is required to decide which might be 

bets, but 110 modern system comes without cost. 

One consideration to bear in mind is that in the past. interoperability bas been the principal flaw in 

private credential systems. Countries with smaller populations face a lesser burden as they have 

fewer companies involved (often only three or four), but the UK, with a population of 65 million, 

found it difficult to implement a " federated," private sector authentication system, as did the U.S. 

in the mid-2000s. A bad outcome would be a world where each individual required multiple 

credentials • this is one of the advantages of the SSN and a replacement system would have to 

duplicate this. 

If the Congress chooses to let private sector entities issue an SSN-based credential, it will need to 

create incentives for companies to offer this service. lncentivizing consumers might require some 

kind of appropriate liability limitation, mirroring that used in the Fair Credit Billing Act. Congress 

will also need to develop privacy rules that restrict the ability of a private sector provider to 

"harvest'' user data for commercial purposes. 
92 


ralbany on LAP520R082 with HEARINGS33871.074

Lewis: Writlen Testimony, Honse Ways and Means Subconunitlee on Social Secmity 05/ 17/2018 6 

Congress would need to set a transition period for the move to a smart-card based system, and it 

would have to create negative incentives for companies and individuals to move from the SSN to 

the proxy number, perhaps by forbidding SSN use perhaps by publishing SSNs, which would 

lower their value as an identifier. Publication would force companies to find an alternative solution 

and, judging from the Swedish and Norwegian experiences, could incentivize a market for private 

credentials. Private credential issuers could be required to meet identification standards such as 

HSPD- 12 or NIST's SP 800-63 Digital Identity Guidelines. 

The security risks of publishing SSN could be reduced after publication, by replacing SSNs with 

a proxy number and its more robust identity verification system. For citizens, the would receive a 

new smart card in the mail with a new proxy number, perhaps followed by separate mailings with 

the PIN needed to access their account. There are ways to automate the replacement process that 

could be developed to ease the transition burden. This smart card approach would permit the 

adoption of blockchain technology should blockcbain ever mature to the point where large scale 

deployments are possible. 

Simple publication ofSSNs is the least expensive option for the Federal government and for the 

private sector and would create incentives to use something other than the SSN as an identifier (it 

would still need to work as an identifier for tax and benefits purposes). While creating a searchable 

database bas associated costs for SSA, it would be cheaper than the atmual cost of fraud and 

identity theft (an estimate in the economist pegs this at $16 billion). 1 

The effect would be to make the SSN more secret. If a consumer was notified of a data breach 

that compromised their proxy SSN, they could go to au SSA website and generate a new number. 

To request a new nwnber, SSA would need to move to some kind ofmultifactor authentication 

such as that now use by many banks, so that a consumer requesting a replacement would need a 

password, a PIN, and an access number sent to their cellphone or email (this would have to be the 

cellphone of a parent or guardian for minors). 

This approach would retain the SSNs critical fimction as a unique identifier of an individual while 

providing some way to replace an SSN when it has been compromised - and compromise is 

unavoidable. The goal, as many have said is to separate the SSN as an identifier from its use as 

an authorizer. 

I have not discussed a public key infrastructure or federated identity system. Having been deeply 

involved in earlier federal effort to create PKl or federated identity systems, I believe they are too 

complex and costly to be successfully implemented. Perhaps the best argument for this smart card 

approach is that we already use it 0 11 a massive scale, for credit or debit cards or for online accounts. 

1 hnps://www.economisl.comlnewslleaders/21739961-gdprs-premise-consumers-should-be-charge-lheir-ownpersoual-dala-rigbl 
93 

f 

Chairman JOHNSON. Thank you, sir. I appreciate that. We will 

now look to questions. 

As is customary, for each round of questions I will limit my time 

to five minutes, and I ask my colleagues to also limit their questioning time to five minutes, as well. 

Acting Commissioner Berryhill, the alarming story about the 

child in Arizona raises many questions about how Social Security 

treats identity theft victims. Are you taking a close look at how you 

handle requests for new Social Security numbers? 

Ms. BERRYHILL. Mr. Chairman, I am very aware of the case 

that you are referencing in Arizona, and thank you for bringing 

that to our attention. We have worked very hard with our staff to 

issue clarification policies to all of our front-line employees. We 

have also held national calls with all managers, area directors, and 

we also decided that we would have regional experts available to 

the front-line employees at the time, when the time comes, where 

they have a complex case. In this situation, we would consider that 

a complex case. 

So having those regional experts that are well-trained on enumeration, on replacement cards, on new—issuing new SSNs I think 

will help. So we took that immediate action, and all those actions 

have been accomplished. 

Chairman JOHNSON. Well, with more than 1,200 field offices, 

what are you doing to make sure that your policies are being followed? 

Ms. BERRYHILL. That is why we held national calls with all of 

our managers and our area directors that have oversight to our 

managers, and we will continue to do checks and balances to make 

sure that those policies are followed. 

I really believe having a regional expert there so the front line 

employees can consult if they have questions is really going to be 

a key change for SSA. 

Chairman JOHNSON. You know, I was shocked to learn that Social Security employees’ voicemails tell callers to record their Social 

Security number with their name and phone number to get a return call. How is that a good practice, given all the concerns with 

identity theft and phone scams? 

Ms. BERRYHILL. I certainly understand that, and I am aware 

of that situations that we have (sic). 

We do use the Social Security number to look up our records. 

Certainly, if an individual is not comfortable leaving their Social 

Security number, they should not do that. However, it does expedite the transaction when they call us back. We can certainly, in 

the front line, pull up someone’s record, have that available so 


ralbany on LAP520R082 with HEARINGS33871.075
94 

when we return that call we can quickly go through the process 

with them and answer any questions. 

But again, if someone is uncomfortable, they should not leave 

their Social Security number. 

Chairman JOHNSON. Okay. Well, maybe we ought to take another look at that. 

Mr. Grobman, this panel has talked about some big ideas today. 

What do you think? 

Mr. GROBMAN. I think the—— 

Chairman JOHNSON. Is now the time to take action? 

Mr. GROBMAN. Absolutely. I think the one thing that we heard 

universally across this panel is using Social Security numbers as 

authenticators is something that needs to be addressed as the most 

time-critical element of the issue. 

There are clearly other issues on the fringe of Social Security 

number as an identifier. But from a magnitude perspective, looking 

to remove Social Security knowledge as an authenticator is something that we must act on immediately, and invest whatever it 

takes in order to make that a practical reality. 

Chairman JOHNSON. Yes, we have been trying to do that for 20 

years. 

Mr. Larson, you are recognized. 

Mr. LARSON. Thank you, Mr. Chairman. I want to thank the 

panelists. It is—we have an awful lot of hearings, but it is always 

refreshing when you actually have panelists who give you some solutions, as well. 

Acting Secretary Berryhill, first of all, let me commend you for 

your service. 

Let me also acknowledge that there is no one who has been 

working harder to make sure that we have a permanent chair of— 

the Secretary of Social Security than the chairman himself. And we 

have—support him in those efforts, and hope that the administration will act soon, but want to thank you for your service. 

I think there is unanimity on the Committee with respect to 

authentification (sic). How would you go about implementing that? 

And what is the cost of that? 

Ms. BERRYHILL. So certainly, any ideas—I think there has 

been some great ideas listed by the panel Members today—we will 

take all of them and review them and cost them out. Certainly not 

something I could address today. Lots of ideas are good, but then 

you have to look at the price tag that is attached to them. 

So again, we will go back and take a look at any ideas that the 

Committee would like us to look at. 

Mr. LARSON. Any idea on that price, Mr. Grobman? 

Mr. GROBMAN. I think one thing that we need to recognize 

when we look at the price is the price of not taking action. 

So if you look at the cost related to fraud or misuse of Social Security numbers as authenticators, my opinion is that is a staggering figure that needs to be comprehended when looked at the 

cost of implementing a new plan. 

Mr. LARSON. Mr. Lester, you had the—a number of solutions. 

But one of the things that you emphasized is that you—we make 

sure that we steer clear of any biometric solution. Would you explain why? 


ralbany on LAP520R082 with HEARINGS
95 

Mr. LESTER. When Congress passed the Privacy Act in 1974, 

they were explicitly responding to and rejecting calls for a national 

identification system. There are national identification systems 

that rely on biometrics in other countries that raise really grave 

civil liberties and privacy concerns. 

For example, in India their new biometric system—AADHAR, I 

think—was recently breached, compromising the biometric data on 

its 1.2 billion citizens. I think that any problems with a biometric 

system are demonstrated by the recent breach of the OPM. 

Mr. LARSON. Would all the panelists agree that that is a reasonable concern? 

Mr. GROBMAN. I think it very much depends on the problem 

that you are trying to solve. In India, part of what they were trying 

to solve was there was no starting point, and they needed to ensure 

that an individual only registered a single time for benefits. So, by 

using biometrics, it prevented an individual from registering in one 

town and then walking down the road to another town and registering again. 

So, in that case, biometrics was a practical technology in order 

to solve that specific problem. I don’t believe we have that problem 

at scale in the U.S. And therefore, I think the points are well taken 

that we should look for other, less privacy-intrusive mechanisms as 

a first step. And as Mr. Lewis mentioned, things such as smart 

cards can be a much more rapid practical option that could be distributed without requiring every citizen to have biometrics—— 

Mr. LARSON. Is there consensus amongst the panel with respect 

to smart cards? 

Mr. Rosenzweig. 

Mr. ROSENZWEIG. I—Rosenzweig. I think it is a good interim 

solution. But to be honest, you know, the smart card security system is not itself terribly robust. We have all experienced credit card 

fraud, as well, that is a result of a lot of that. 

On the issue of biometrics, I think it really is the difference between a centralized database and a distributed database. Biometrics, as a localized identifier, is actually something that the— 

President Obama’s White House supported as a substitute for passwords because they are more readily usable by most citizens than 

the password system. 

So I wouldn’t write with such a broad brush—— 

Mr. LARSON. You also objected to one of Mr. Lester’s solutions. 

Could you explain why? And hopefully Mr. Lester will get a chance 

to reply. 

Mr. ROSENZWEIG. Well, I don’t so much object. Regulation is 

clearly one of the normal tools in our toolkit here in Washington, 

alongside taxation—— 

Mr. LARSON. Is it regulation or the efficiency of the ability to 

regulate? 

Mr. ROSENZWEIG. Well, we all live in Washington. I am not a 

fan of our efficiency in the regulatory system. To take just—to be 

brief about it, we have already acknowledged that it would have to 

exclude legal uses—— 

Mr. LARSON. City of northern charm and southern efficiency? 

Mr. ROSENZWEIG. Indeed. 

Mr. LARSON. No disrespect to anyone from the South, but—— 


ralbany on LAP520R082 with HEARINGS
96 

Mr. ROSENZWEIG. I think it would cost us quite a bit and take 

far too long. 

Chairman JOHNSON. The gentleman’s time has expired. 

Mr. Kelly, you are recognized. 

Mr. KELLY. I thank you, Chairman, and thank you all for being 

here today. 

Mr. Rosenzweig, I had a coach in high school had the same 

name, we just called him Rosie. So maybe the rest of the panel can 

do that. 

[Laughter.] 

Mr. KELLY. First of all, thank you all for being here. But, you 

know, Ms. Berryhill, I am—I think when we look at the size and 

scope of the program, and the number of beneficiaries, is there anybody in the private sector that even comes close to facing these 

types of problems, as far as making sure we are sending the right 

money to the right people, and the fact that there is so much fraud 

in the system already? 

Is there any approach out there that people are looking at that 

would make sense? 

Ms. BERRYHILL. So, you know, first of all, we need to protect 

our records. And our focus for the Social Security number has been 

collecting wage information and paying benefits. 

We have a robust, anti-fraud process that we put in place, so we 

review claims ahead of time, we will flag certain high-risk claims. 

But as far as comparing that to the private sector, we have to 

make sure that, in government, that our beneficiaries, our recipients are protected, and their data is protected. 

Mr. KELLY. Well, it just seems to me the very nature of the way 

we do things today—we have a safe that we put things into that 

we cannot lock. There is somebody finding a way to get into this 

data all the time, and yet we keep thinking, well, you know what? 

This is just the way we do things today. We are going to just have 

to keep going down that path. I just—I am really fascinated. 

Mr. Grobman, you said something I have written down here. Is 

there any information that indicates the cost of not finding a remedy to this? I think those numbers would be so staggering that 

most of us would not even want to discuss it. 

Is there any idea of what the cost of not fixing this is—because 

it seems to me—there is an old saying. You keep doing the same 

thing over and over again, expecting a different result—I don’t see 

how we fix this the way we are going right now. So that cost of 

not fixing it, any ideas? 

Mr. GROBMAN. I don’t have a quantitative number. 

Mr. KELLY. Yes. Nobody does. 

The Chairman is right; it is the definition of insanity, but—— 

Mr. GROBMAN. There is one estimate, and it was from The 

Economist, and it was $16 billion a year. 

Mr. KELLY. Sixteen? 

Mr. GROBMAN. Billion. 

Mr. KELLY. Billion, with a B. That is—down here. One, six, and 

with a B, billion. So—okay. 

Mr. Grant, some companies have recognized problems with the 

Social Security number and have shifted their business models in 


ralbany on LAP520R082 with HEARINGS
97 

response. Can you share some examples in the private sector of 

how people are addressing this? 

Mr. GRANT. Sure. So one of the founding members of our coalition is Aetna, who—their chief security officer, Jim Routh, and the 

team there led an effort I think they launched in 2014 focused on 

reducing the instances of the Social Security number within their 

systems. Talking about costs, this is a 6-year, roughly $60 million investment that the company is voluntarily undertaking because they 

think that they can reduce their risk profile by reducing the instances of the SSN across their enterprise. And I think to date they 

have eliminated about 10 billion instances, which—not that they 

have 10 billion beneficiaries, but it shows you, if I am one of theirs, 

that I probably had my SSN in a dozen different systems. 

So, you know, companies are willing to do this today, and I think 

you are starting to see, you know, particularly Fortune 500 companies who are holding on to SSN are looking at it as a liability. But 

the cost is significant. It can’t happen overnight. 

They are also hindered in that, as a health insurer, they are required by the government to leverage the SSN for pretty much all 

of their government business, as well as any beneficiary who they 

have to report to the government had health insurance. 

So, you know, I highlighted this a little in my opening testimony. 

There is a lot of government requirements that are out there that 

state that private industry has to collect the SSN. As long as we 

have those out there, it is going to be quite hard to eliminate it entirely. 

Mr. KELLY. As we keep going forward, then, I—and we all look 

at this program and we refer to it as an entitlement, and some people say that is a negative term. No, entitlement means you are entitled to this benefit because you have paid into it your whole life. 

I think there is total agreement on this Committee and throughout the whole Congress that we have to protect this program because it is so vital to our folks. 

Listen, I really appreciate you all being here today, but could you 

please continue weighing in and give us other examples and other 

solutions to what it is we are trying to fix? It is just this is so massive right now, I think it is one of those things you sit back and 

say it is too big for us to work with. 

But I like Mr. Grobman—it is only going to get bigger and bigger 

and more expensive if we don’t do it. 

Mr. GROBMAN. Absolutely. And I think, following up on that 

comment, one of the things we need to look at is the opportunity 

cost of continuing to try to protect Social Security numbers from 

becoming public, when we know that they are already public in so 

many cases. 

So, although there are a number of interesting efforts put forward in the last few years to reduce the disclosure of Social Security numbers, what I would ask is what if we re-purposed all of 

those efforts into building a modern authentication system so that 

we just simply use Social Security number as an identity, not an 

authenticator. 

Mr. KELLY. Very good. Thank you. 

Chairman JOHNSON. The gentleman’s time has expired. 


ralbany on LAP520R082 with HEARINGS
98 

Mr. Pascrell, you are—— 

Mr. PASCRELL. Thank you, Mr. Chairman. A great panel. 

I want to start by—Mr. Lester, would you respond to Mr. 

Larson’s question that you didn’t get a chance to respond to before? 

Mr. LESTER. Sure. So I think you are talking about the cost—— 

Mr. PASCRELL. You got 30 seconds. 

Mr. LESTER. I think you are talking about the costs of regulation, right? So Mr. Rosenzweig talked about the cost of regulating 

this, and I would just like to mention a cost which is 16.7 billion, 

to be precise. That is the amount that was stolen as a result of 

identity theft in 2017. The cost of not regulating is in the billions. 

And furthermore, what we are talking about is restoring the Social Security number to its original purpose, which is to be used 

only by the Social Security Administration. That is what it was intended for. Congress has many times looked at this. When they 

passed the Privacy Act in 1974, that is originally what it was intended to do. So—— 

Mr. PASCRELL. Thank you. 

Mr. LESTER. Yes. 

Mr. PASCRELL. Thank you. 

Last month, Mr. Grant, the Ways and Means Committee marked 

up a bill to protect children and consumers from identity theft— 

it was H.R. 5192—by helping reduce the prevalence of synthetic 

identity fraud. The bill would do this by facilitating the validation 

of identifying information provided by lenders, and upon the consent of the customer—consumer, rather, I am sorry—through a 

database maintained by the Social Security Administration. The 

bill is considered an important step that Congress took to help prevent identity theft. 

But I wanted to get your view very quickly about what the extent 

this validation system will solve the problem or not. What is your 

thoughts? 

Mr. GRANT. So I actually talked about this a bit in my written 

testimony, but didn’t get to it in my opening statement. I think it 

is a great first step. 

The idea actually goes to a key point that I flagged in my opening statement, which is can we shift the model a little bit when it 

comes to identity verification services, so that government agencies 

like the SSA that are the authoritative roots of trust when it comes 

to my data—they have got the truth, in terms of what my name 

and my SSN are—why can’t I ask them when I am opening an account to let my bank check to see if there really is a Jeremy Grant 

with my SSN and date of birth in their system? 

And so this new bill, if it passes—and I think it is also in the 

Senate reg reform package for banking that is currently in front of 

the House—will be a good first step. 

But two things I would add to that. It is only limited to account 

openings covered under the Fair Credit Reporting Act. I can’t imagine, as a consumer, why I wouldn’t want to ask SSA to validate 

that for everybody. And then I think the other question that has 

come up is if we are worried about synthetic identity fraud, this 

will take care of new account openings going forward. But there is 

probably, you know, thousands, if not millions of synthetic accounts 

that are out there today. 


ralbany on LAP520R082 with HEARINGS
99 

And so, one question has been should financial institutions have 

an opportunity to have a one-time window where they could retroactively put existing accounts out there to make sure that things 

match? 

Mr. PASCRELL. Thanks, Mr. Grant, I appreciate that. Look, 

there is widespread data breaches at the Office of the Personnel 

Management, Home Depot, J.P. Morgan, Target, U.S. Postal Service, and, of course, Equifax. And they highlight the need to focus 

our attention on how better to authenticate identities. 

From a consumer protection standpoint, this is outrageous. Hackers assessed—accessed personally-identifiable information from 

millions of customer accounts. In the wrong hands, access to Social 

Security numbers, birth data, address, driver’s license number 

could turn someone’s life upside down. We must do everything possible to establish privacy safeguards Social Security (sic). Protecting the individual’s personal information to ensure their identities are protected must be one of our top priorities. 

Should the burden be on the government to create a unique identifier to identify individuals, or should it be on the private corporations to establish unique identifiers with their clients? Anybody? 

Mr. Lester. 

Mr. LESTER. Right. So I think that is where the importance of 

context-specific identifiers comes into play. So if you are 

transacting with a company you have a unique identifier for that 

company. That way, if an identity thief steals that identifier, they 

do not have access to all your accounts, and they cannot open new 

accounts in your name and destroy your financial life. 

Mr. LEWIS. Congressman, if I could just add, in the many attempts we have had to come up with a national identifier, we have 

learned that there is only one trusted source, and that is the government. And that is why SSA is the default identifier. People 

don’t trust other sources. 

Mr. PASCRELL. Mr. Chairman—thank you, but I must add this 

point to you. Are we really serious about doing this? Are we really 

serious about changing the culture, which is a different thing? And 

why haven’t we done more? We need to ask ourselves that question. 

Chairman JOHNSON. You are right. Thank you for your questions. 

Mr. Rice, you are recognized. 

Mr. RICE. You know, this is a incredibly complicated problem, 

but it is not new. This is not new. Identity theft has existed since 

people had identities, right? 

Our—thinking back to law school and commercial paper, and in 

order to allow for the free flow of commerce, we had laws to protect 

consumers with commercial paper. So a bank had a duty to know 

your signature, right? So if somebody forged your check, that 

wasn’t your problem, it was the bank’s problem. And that kind of 

applies here, too, doesn’t it? 

I mean if somebody negligently releases your personal information, don’t they have a liability for that? 

Mr. Lester. 

Mr. LESTER. Absolutely. The burden is on the companies that 

collect this information. It is important to stress that Equifax chose 


ralbany on LAP520R082 with HEARINGS
100 

to collect the information on consumers. Consumers did not provide 

that information to Equifax. And in fact, when Equifax is breached, 

they are the ones that put the cost on the consumer by charging 

them for credit freezes and fraud monitoring. And I think it is also 

important to stress that there needs to be—— 

Mr. RICE. Did Equifax—— 

Mr. LESTER [continuing]. A private right of action—— 

Mr. RICE. Did Equifax have liability for that? 

Mr. LESTER. Absolutely, which is why I need to stress that 

there needs to be, in any privacy law, private right of action for 

consumers to get redress. 

Mr. RICE. So you are advocating for specific identifiers for everything. 

And I think I heard Mr. Grant say he didn’t have a problem with 

Social Security as a national identifier. I think you said the same 

thing, Mr. Grobman, and you did, too, Mr. Rosenzweig. And I kind 

of agree with you. 

I mean everybody has got an identifier, right? It is their name, 

at the very least. But the name is not unique. I mean there is a 

lot of Tom Rices out there. 

So you need some type of a national identifier, I would think, to 

make commerce work. And I don’t know why Social Security 

couldn’t be that. But it can’t be an authenticator, because it is not 

private any more. Right? 

Mr. Rosenzweig. 

Mr. ROSENZWEIG. Using my Social Security number as an authenticator is as stupid as using the last four letters of my last 

name as my authenticator. It—or the last four digits of my phone 

number, which is another—mobile phone numbers, now that they 

are mobile, everybody has one and it is probably one you are going 

to keep for the rest of your life, even if you move to Washington. 

Mr. RICE. And I just think that—I mean, personally, just as a 

matter of common sense, I think completely—the idea that you 

would completely identify—I mean eliminate any sort of unique 

identifier is just not practical. I mean we have got to have some 

kind of unique identifier, and I don’t know why it couldn’t be your 

Social Security number. 

So I would think that the way to attack this problem—because 

this—I don’t care what we do, I don’t care if we come up with the 

most, you know, beautiful and complex system that would do away 

with any hacking today, tomorrow the hacker is going to figure out 

something different. This is not new, it has been going on since the 

beginning of time, and it is going to keep on going on. 

So I would think that the way to attack this is kind of like they 

did with commercial paper, and that we should put liability on people who negligently release your information. 

Mr. Rosenzweig. 

Mr. ROSENZWEIG. Well, there has been at least one proposal 

by a colleague of mine who was in the last Administration to make 

people strictly liable for that. 

For myself, I would probably prefer a negligence standard over 

strict liability, but I do think that what you are onto is exactly the 

right economic answer, which is putting the obligations on the least 

cost avoider. One of the reasons that I kind of like my fanciful proVerDate Sep 11 2014 05:09 Apr 25, 2019 Jkt 033871 PO 00000 Frm 00104 Fmt 6633 Sfmt 6602 I:\WAYS\IN\33871\33871.XXX 33871

ralbany on LAP520R082 with HEARINGS
101 

posal of publication is that it makes it impossible for anyone to 

maintain the idea of security for the Social Security number as an 

authenticator. Liability would be another opportunity. 

Mr. RICE. What do you think about that, Mr. Grobman? 

Mr. GROBMAN. Oh, cyber crime is a market-driven enterprise. 

Cyber criminals are looking to steal things of value. And the reason 

that cyber criminals are looking to steal Social Security numbers 

is in today’s world they have value because they can be used as an 

authenticator. 

One of the most practical ways to stop the theft is to de-value 

what they are going after. And that is, in general, a much more 

practical mechanism at scale than trying to have the world—— 

Mr. RICE. Okay, I got to stop because I only have 10 seconds. 

If you all would respond to this by raising your hand, do any of 

you—who of you have a problem with using Social Security numbers as an identifier, but not an authenticator? One. One out of 

eight. Thank you. 

Chairman JOHNSON. The time has expired. 

Ms. Sa ́nchez, you are recognized. 

Ms. SA ́ NCHEZ. Thank you, Mr. Chairman, and thank you to all 

of our witnesses. 

Social Security numbers were originally created as a way to 

track earnings, and were never meant to be used as an identifier 

in the private sector. The Social Security number has since 

morphed into a tool used to identify and authenticate individuals 

in a number of different situations, greatly expanding the universe 

of people and companies who have access to this incredibly valuable information. 

The ubiquity and widespread use of Social Security numbers has 

left consumers vulnerable to identity theft helpless to stop it. 

As we all know, Social Security numbers are incredibly valuable 

for identity thieves, and can be used to open new accounts and 

credit cards, or even take out mortgages, often leading to financial 

ruin for unsuspecting and innocent consumers. 

And as technology continues to advance at alarming rates, our 

unique Social Security numbers are increasingly vulnerable to 

cyber theft and fraudulent use. Recent data breaches demonstrate 

the urgent need to secure this information and just how valuable 

Social Security numbers and other personal data are. 

The Equifax hack alone comprised over 145 million American— 

pardon me, compromised over 145 million Americans’ personal 

data, including their Social Security numbers. That is almost half 

of the U.S. population who are now at risk for identity theft or financial fraud. 

Social Security numbers have become the default identifier because they are truly unique, standardized, and can be verified. But 

as more and more of our personal information is available on the 

dark web for cheap, we need to start thinking about the best ways 

to identify and verify individuals. 

Mr. Lester, I would like to begin by asking you. Americans, consumers, don’t have a full picture of what information is being collected about them. What kind of data is being collected about 

Americans? And are companies required to protect it? 


ralbany on LAP520R082 with HEARINGS
102 

Mr. LESTER. Thank you. So first I would just like to clarify raising my hand to Representative Rice’s poll question, because it 

wasn’t a yes or no answer. I don’t have a problem with the Social 

Security number being used as an identifier for Social Security. 

To answer your question, companies are now collecting vast 

amounts of data on consumers, and the problem is that consumers 

do not have control over this data. 

When Equifax collects data from consumers it is getting it from 

other commercial sources, and consumers are not providing it to 

Equifax. And so, in addition to limiting the use of the Social Security number in the private sector, consumers need to have control 

over their personal information. 

There needs to be a default credit freeze so that companies like 

Equifax can only disclose your information when consumers have 

affirmatively opted in. This would solve the problem of identity 

thieves opening up new accounts in your name, if Equifax could 

only pull your credit when you, as the consumer, have affirmatively 

given them permission to do so. 

Ms. SA ́ NCHEZ. Great. And—but I want to get at a—sort of a 

larger question that folks wonder from time to time: Are companies 

required to protect that information? 

Mr. LESTER. There is no federal standard right now for data security. The Federal Trade Commission does enforce data security 

when companies—you know, they have authority over unfair and 

deceptive practices. So if a company is representing they have good 

data security, like in the case with Uber, they represented over and 

over again our data security is great, when in fact it was non-existent. 

But no, there needs to be national standards that set a baseline, 

because states need to have the freedom to regulate upward in this 

area, because it is a dynamic and evolving field. So there needs to 

be a federal standard that sets a floor for data security. 

Ms. SA ́ NCHEZ. I would agree with that, and I would just say 

that I believe most consumers believe that companies are required 

to protect their information. 

Mr. Lester, could you talk a little more about how context-specific identifiers work, and the medical identification number that 

they use in Canada? 

Mr. LESTER. Oh. Oh, yes. So the medical identification number 

in Canada, as I understand it, it is a unique context-specific identifier. I am not super familiar with it. So I can certainly get back 

to you with more information on that. 

Ms. SA ́ NCHEZ. I would appreciate it, because I would be interested in knowing how that specifically works, because it might be 

instructive in terms of setting policy for how we begin to reign in 

the ubiquitous use of the Social Security number. 

Mr. LESTER. And there are many other examples of context-specific identifiers. In my statement I mention, like, the university 

identifier that is a recent innovation by universities like Georgetown, my school, where they give you a nine-digit ID number in 

lieu of using your Social Security number. 

Ms. SA ́ NCHEZ. Thank you, and I yield back. 

Chairman JOHNSON. Thank you. 

Dr. Wenstrup, you are recognized. 


ralbany on LAP520R082 with HEARINGS
103 

Mr. WENSTRUP. Thank you, Mr. Chairman. I appreciate it. 

Thank you all for being here. 

Mr. Rosenzweig, I don’t have a question for you, I just wanted 

a shot at saying your name, and I hope I got it right. 

[Laughter.] 

Mr. ROSENZWEIG. Perfect. 

Mr. WENSTRUP. Thank you. My question is for Ms. Berryhill. 

But listening to Mr. Johnson’s story earlier, I am reminded of a 

song called ‘‘Secret Agent Man,’’ you know, and it says we are giving you a number and taking away your name. And that is a concern, obviously. 

But I want to ask you about getting a new Social Security number. You know, when you lose your credit card, or it gets stolen, 

I tell you what. That bank wants to get you a new one right away: 

one, because they want you to use it again; and two, they want to 

make sure that no more money comes out of their account, because 

it personally affects them, as well. 

And I don’t see the same for the Social Security Administration 

in that environment because, if you think about it, when somebody’s Social Security number is taken, the fraud is either at the 

bank, or through the IRS, a taxpayer. Maybe, if somebody is getting your Social Security check, it may affect you. I don’t know. I 

am kind of asking about that. 

But why do we make it so difficult to get a new number when 

that really is the problem? Because I don’t know that there is the 

same amount of concern on the Social Security Administration like 

there is at the bank when your credit card gets taken. And I know 

somebody mentioned it might be, like, $34 to get a new card. Well, 

that may be a lot on your end, but it is pretty small on the other 

end, where the fraud is taking place. 

So why is it so difficult to get a new number? 

Ms. BERRYHILL. So usually it is a last resort to issue a Social 

Security—new card, a new number, because it doesn’t always solve 

the problem. Many times banks, other companies, will cross-reference the old number to the new number. So you haven’t really 

solved the problem in many situations. 

We do look at misused—are people disadvantaged? Are they not 

getting a loan for their house? Are their IRS tax returns and so 

forth—but again, I hope that our recent change in looking at our 

instructions to our front line will help that. 

But our number, again, is really designed to collect wage information and to pay benefits. As you can see, many of the examples 

are really about credit card fraud, banking fraud, not about our 

programs. 

Mr. WENSTRUP. But let me get back—— 

Ms. BERRYHILL. Our—— 

Mr. WENSTRUP. Let me get back to my question. There is no 

harm, monetarily or otherwise, to the Social Security Administration’s budget. It is usually affecting someone else. So you don’t 

have the vested interest that the bank does in this situation. And 

the cross-referencing, that doesn’t need to happen. They get rid of 

the old number. They don’t need to keep that data. So I don’t find 

that as a very good answer as to that being a problem. 


ralbany on LAP520R082 with HEARINGS
104 

So I really think you need to take a look at what can be done 

to get somebody a new number, because that is exactly what a 

business is going to do. If your identifier is stolen, they have a motive to get you a new one to protect themselves. But I don’t find 

that you are at risk when somebody’s Social Security number is 

taken away in any way. So there is not this desire to solve this 

problem. 

But $34, if that is what it actually costs to give somebody a new 

card, new number, whatever the case may be, that is a pittance to 

the hundreds or thousands of dollars that are going out on the 

other end. I just want to—I want to clarify that, because there is 

really no detriment to the Social Security Administration, is that 

right? 

Ms. BERRYHILL. Well, I don’t know if I would agree with that. 

Certainly, if we open up the flood gates and said everybody that 

wants a number come on and get one, we probably—— 

Mr. WENSTRUP. No, no, no, you would have to have a reason, 

not just say I don’t like the number, it ends in an odd number and 

I want an even number. That—let’s be realistic here. We are talking about people that have been victimized, not just anyone who 

wants a new number. 

Ms. BERRYHILL. And again, we believe that we want to do due 

diligence, we want to know what has happened with that number, 

we want to make sure that it is appropriate to assign them a new 

number. 

Mr. WENSTRUP. I get that. But why is it so hard? Why is somebody told they have to change their name? 

Ms. BERRYHILL. That was not an appropriate answer to say 

you change your name. 

Mr. WENSTRUP. Well, thank you. I think we need to look into 

that further. 

I yield back, thank you. 

Chairman JOHNSON. Thank you. Is Mr. Schweikert here? 

Mr. SCHWEIKERT. Mr. Chairman, I apologize. We also have 

the—running at the same time, so—— 

Chairman JOHNSON. You are recognized if you care to make 

some questions. 

Mr. SCHWEIKERT. And I actually had a couple—have you ever 

actually started to write down a couple questions and—where some 

of us have brutal disagreements on the utilization of node networks 

and—but it is also a threat to certain companies. 

So I want to go—I want to take one gigantic step backwards, because I have missed a number of the questions here. If I came to 

all of you, either as policy, technology experts and said how do we 

design almost a single portal in our society that, whether—have a 

combination of multi—I am a big fan of certain token tradeoffs 

with the biometric and a password. 

So you could go on there and see your last 10 years of your IRS 

tax returns, or of your Social Security benefits, your veterans discharge, your—you know, where all these things that we, as government—all of us, as government—hold on you, and create a single 

portal so you could see them, but in a way that would be safe, robust, elegant. 


ralbany on LAP520R082 with HEARINGS
105 

And we have actually been sketching out a concept of sort of a, 

you know, pass code biometric to a token back—if I was to run 

down the line, A, is that just techno-Utopian; but B, would it actually not only solve our issue here on the misuse of Social Security 

numbers, but also some of the other policy decisions we as Congress and the bureaucracy have made of starting to blind documents for our Medicare population, and those things, and now having to get unique identifiers, and the re-issuing of such things, and 

the confusion and cascade of chaos I expect to come from that? 

And could—run down. Let’s start. If I came to you and said I 

don’t want a simple, incremental solution, I want a disruption of 

more—of a unified portal, can it be done? 

Ms. BERRYHILL. So my first concern was if that unified portal 

was breached, does that mean all of my information is then out 

there from all different—— 

Mr. SCHWEIKERT. It wouldn’t if we designed permissions. So— 

and we will probably get to that, but there is a way to—so let’s 

right now, for theoretically, just say it is—we were able to level— 

produce levels of security. 

Ms. BERRYHILL. I would certainly be willing to work with you 

on any ideas that you have. But again, my concern that if one portal—everything was breached, we would be in a worse situation 

today. 

Mr. SCHWEIKERT. Okay. 

Ms. CURDA. It sounds like a nice, aspirational idea. And the 

Federal Government, in terms of designing such complex systems, 

does not have a great track record. And it is extremely costly, 

so—— 

Mr. SCHWEIKERT. We were thinking we would go to McAfee 

and—— 

Ms. CURDA. Very difficult to do. 

Mr. LESTER. So, moving towards centralized database is exactly 

the wrong approach. I would use the example of container ships. 

They are compartmentalized, so that if there is a rocky wave, all 

the oil is not in one container to capsize the ship. It is the same 

with identity. As—— 

Mr. SCHWEIKERT. So why do countries like Estonia and others 

have incredible success because you create levels of permission that 

require—that—it is a unified portal, but different levels of permission and pass and security? 

Mr. LESTER. Is that for me? 

Mr. SCHWEIKERT. Yes. 

Mr. LESTER. I don’t know about the case of Estonia. As I understand, it is a much smaller—— 

Mr. SCHWEIKERT. Yes, what is your coding background? 

Mr. LESTER. I am sorry? 

Mr. SCHWEIKERT. Your coding—— 

Mr. LESTER. My coding background? I don’t have a coding background. 

Mr. SCHWEIKERT. Okay, sorry. And I am sorry, I was trying 

to go more technical than that. I am not being mean. 

Mr. ROSENZWEIG. I would say that Estonia is a good case 

study. My concerns would mostly be about scalability issues. 

Mr. SCHWEIKERT. Yes, that is actually fair. 


ralbany on LAP520R082 with HEARINGS
106 

Mr. ROSENZWEIG. It is much smaller. I think that such a system is at least feasible within the context of design. 

I do share some people’s concerns that U.S. Government largescale procurement programs like this never seem to actually get 

there. So even if we could idealize it, the government sector 

might—— 

Mr. SCHWEIKERT. Oh, yes. 

Mr. ROSENZWEIG [continuing]. Not quite get it—— 

Mr. SCHWEIKERT. And let’s be brutally honest. There will be 

a knife fight because—— 

Mr. ROSENZWEIG. Yes. 

Mr. SCHWEIKERT [continuing]. You are interrupting a lot of 

bureaucracies, layers of power and authority. 

Mr. GROBMAN. It can absolutely be done. I think if you look at 

the large-scale systems that exist today for authentication, whether 

it is financial services, whether it is some of the models that—there 

is numerous capabilities. The private sector has built a set of protocols that enable one entity to do authentication, and then allow 

that authentication to be honored by others. Things like SAML and 

OATH. 

Really, the discussion needs to be about getting the right balance 

between privacy and security—— 

Mr. SCHWEIKERT. Well, you hit one thing I fixate on, and that 

is—we hit quantum. I will absolutely have to have a token, because 

I think—because an algorithmic is under threat (sic). 

Mr. GROBMAN. So one of the key points I made in my written 

testimony is although we haven’t settled on exactly what quantumsafe algorithms to use, in the design of a new system we can design 

it such that we have the ability to swap algorithms out as we—— 

Mr. SCHWEIKERT. Well, you don’t think a token system would 

be more robust? 

Mr. GROBMAN. I think that it is part of the solution, but I 

think that the underlying cryptography that needs to be used in 

the solution does need to eventually be—— 

Mr. SCHWEIKERT. I need to learn more. If you have something 

I can read—— 

Chairman JOHNSON. The time of the gentleman has expired. 

Mr. SCHWEIKERT. Oh, all right. I will talk after. But thank you 

for tolerating me. I need to disclose I have had a lot of caffeine. 

[Laughter.] 

Chairman JOHNSON. Thank you. 

To keep pace with the identity thieves we need to start thinking 

beyond just protecting Social Security numbers, and start thinking 

about how to make the numbers less valuable to criminals in the 

first place. 

You know, it is time to take a hard look, I think, at the future 

of Social Security numbers, and to decide what needs to change to 

better protect Americans from identity theft. This hearing has 

given us a good starting point, and I look forward to working with 

my colleagues in the future to figure out the next steps forward. 

Americans are counting on us to get this right. They want, need, 

and deserve nothing else. 

Thank you to all our witnesses for your testimony today, and I 

thank you to our Members for being here. 


ralbany on LAP520R082 with HEARINGS
107 

With that, the—you want to? 

Mr. LARSON. Yes. 

Chairman JOHNSON. I recognize Mr. Larson—— 

Mr. LARSON. I want to thank—— 

Chairman JOHNSON [continuing]. For a comment. 

Mr. LARSON. I want to thank the chairman. This is indeed one 

of the more interesting panels that we have. And as you can tell, 

a number of our Members still have a lot of questions. 

What we would like to ask of you is that if you could submit to 

us in writing—because it was very valuable to get your input—we 

don’t—and the chairman has already indicated that we, as a Committee, will meet internally to digest what you send us in writing, 

in terms of your solution and also the urgency that you all attach 

with this, especially, as the chairman has already outlined, under 

authentification (sic), and how we might proceed. Because there is 

a—this was a very fertile and productive meeting. I thank the 

chairman. 

Chairman JOHNSON. Thank you. 

Mr. LARSON. And I appreciate the opportunity to respond. 

Chairman JOHNSON. Thank you. And thank you all for being 

here. We appreciate your presence. 

With that, the Subcommittee stands adjourned. 

[Whereupon, at 11:36 a.m., the Subcommittee was adjourned.] 

[Member Submissions for the Record follow:] 


ralbany on LAP520R082 with HEARINGS
108 

f 


ralbany on LAP520R082 with HEARINGS33871.076

Elizabeth Curda 

COMMITIEE ON WAYS AND MEANS 

U.S. HOUSE OF REPRESENTATIVES 

WASHINGTON, DC 20515 

June 7, 2018 

Director of Education, Workforce, and Income Security 

U.S. Government Accountability Office 

441 G Street NW 

Washington, DC 20548 

Dear Ms. Curda, 

Thank you for your testimony before the Commiuee on Ways and Means Subcommittee on 

Social Security 11tthe May 18, 2018 hearing on "Securing Americans' Identities: The Future of 

the Social Security Number." In order to complete our hearing record, we would appreciate your 

responses to the following question: 

I. The Government Accountability Office found that the current paper cru·ds can cost up to 

$34 per card. How would this cost change if the Social Security Administration switched 

to a biometric or smart card? 

We would appreciate your responses to these questions by Jtme 21,2018. Please send your 

response to the attention of Amy Shuart, Staff Director, Subcommittee on Social Security, 

Committee on Ways and Means, U.S. House of Representatives, 2018 Rayburn House Office 

Building, Washington, DC 205 15. In addition to a hard copy, please submit an electronic copy 

of your response in tv!icrosoft Word format to mm.russcll@maiLhouse.gov. 

Thank you for taking the time to answer these quc.5tions for the record. If you have OU)' 

questions concerning this request, you may reach Amy at (202) 225-9263. 

Sincerely, 

6~0~ Sam Johnson 

Chairman 

Subcommittee on Social Security 
109 


ralbany on LAP520R082 with HEARINGS33871.077

441 G St. N.W. 

Washington, DC 20548 

June 20, 2018 

U.S. GOVERNMENT ACCOUNTABILITY OFFICE 

The Honorable Sam Johnson 

Chairman 

Subcommittee on Social Security 

Committee on Ways and Means 

House of Representatives 

Thank you for the opportunity to testify before the Subcommittee on May 17, 2018 during the 

hearing on "Securing Americans' Identities: The Future of the Social Security Number." The 

attached enclosure is GAO's response to the question for the record you submitted. If you have 

any questions, please contact me at curdae@gao.gov or (202) 512-7215. 

Sincerely yours, 

Elizabeth H. Curda 

Director 

Education, Workforce 

and Income Security 

Enclosure 
110 

f 


ralbany on LAP520R082 with HEARINGS33871.078

Post-Hearing Questions for the Record 

Submitted to Elizabeth Curda 

Director, Education, Workforce, and Income Security Team 

U.S. Government Accountability Office 

From Rep. Sam Johnson 

"Securing Americans' Identities: The Future of the Social Security Number" 

May 17, 2018 

1. The Government Accountability Office found that the current paper cards can cost up 

to $34 per card. How would this cost change if the Social Security Administration 

switched to a biometric or smart card? 

Response: 

Our review focused on costs of the current paper card and implications of eliminating the card. 

We did not specifically look at the cost of producing biometric or smart cards. SSA officials 

reported that of the $34-per-card estimate, the largest component ($28) is the cost of an inperson field office visit. Information technology and systems support is about $5 and paper, 

printing, and postage is about 60 cents. However, some cards are less expensive for SSA to 

produce. For example, replacement cards requested online cost an estimated $6 per card. 

Based on our prior work', a biometric card would likely be more expensive than a paper card. 

We previously reviewed options to enhance the Social Security card, such as adding machinereadable features such as a magnetic stripe or bar code, and adding biometric features such as 

photographs and fingerprints, to eliminating the card entirely. We reported that including 

additional features on the card would increase the cost of the card. For example, adding 

machine-readable or biometric features to the card would also require additional equipment in 

SSA's approximately 1,230 field offices, and employers and other users would also need 

equipment if they were expected to read features on the card. Further, biometric features would 

likely require cardholders to have their biometric information updated at periodic intervalsgreatly affecting the number of cards cardholders would receive in their lifetime and long-term 

card issuance costs. 

Also, given the current state of technology, a biometric card may not be necessary. As 

described in our report, current technology used by the U.S. Customs and Border Protection 

Global Entry program confirms identity using a fingerprint scan, along with a passport or 

permanent resident card. 

1 GAO, Social Security Administration: lmprovecf Agency Coordination Needed for Social Security Card 

Enhancement Efforts, GA0-06-303 (Washington, D.C.: Marcil 29, 2006). 
111 

f 


ralbany on LAP520R082 with HEARINGS33871.079

COMMITIEE ON WAYS AND MEANS 

Jeremy A. Grant 

Managing Director 

Venable LLP 

600 Massachusetts Ave NW 

Washington, DC 20001 

Dear Mr. Grant, 

U.S. HOUSE OF REPRESENTATIVES 

WASHINGTON, DC 20515 

June 7, 2018 

lllank you for your testimony before the Committee on 'Ways and Means Subcommittee on 

Social Security ntlhe May 18,2018 be:~ring on ·'Securing Americans' Identities: The Future of 

the Social Security Number." In order to complete our hearing record, we would appreciutc your 

responses to the following questions: 

I. Understanding that the current nine-digit Social Security number (SSN) formal has a 

limited number of combinations. and that its design was limited by the technology 

available in 1936, what considerations need to be taken into account for a future version 

of the SSN? 

2. In your testimony, you discussed how some companies have shifted their business 

practices in recognition of the risk of using SSNs, however some government 

requirements hinder additional privnte sector efforts. What are these specific 

requirements and what steps can Congress take to remove these bnrricrs to private sector 

action? 

We would appreciate your responses to these questions by June 21, 2018. Please send your 

response to the attention of Amy Shuart, Staff Director, Subcommittee on Social Security, 

Committee on Ways and Means, U.S. House ofRcpresematives, 20 18 Rayburn House Oflicc 

Building, Washington, DC 20515. In addition to a hard copy, please submit an electronic copy 

of your response in Microsoft Word format to mm.russell mnil.hous~gQY. 

Thank you for Inking the time to unswcr lhcsc questions for the record. If you hove nny 

questions conccming this request. you may reach Amy at (202) 225-9263. 

Sam Johnson 

Chairnmn 

Subcommittee on Social Sccmity 
112 


ralbany on LAP520R082 with HEARINGS33871.080

Additional Questions for the Record 

Jeremy Grant 

Coordinator, Better Identity Coalition 

and 

Managing Director, Technology Business Strategy, Venable LLP 

U.S. House Committee on Ways and Means 

Subcommittee on Social Security 

"Securing Americans' Identities: The Future of the Social Security Number" 

I. Understanding that the current nine-digit Social Security number (SSN) format has a 

limited number of combinations, and that its design was limited by the technology 

available in 1936, what considerations need to be taken into account for a future version 

of the SSN? 

While it is tme that the cturent nine-digit SSN has a limited number of combinations, my 

understanding is that the SSA is not anywhere close to being in danger of mnning out of 

potentialmunbers. Accorcting to SSA, as of 2008, they had issued just over 450 million SSNs1 -

and they issue about 5 million new SSNs each year. That means we are somewhere around the 

halfway point in tenus of possible combinations, and that - even with population growth - it will 

likely be more than 70 years before some action needs to be taken. 

Assuming that the SSN is only used going forward as an identifier, there may not need to be any 

changes to the fonn at during this time. One potent-ial enhancement would be the addition of a 

"check sum" number - a I o•h digit at the end of the SSN that would be derived from the other 

nine numbers, and could help systems detect whether there might be errors in the data. Check 

sum numbers can help, for example, to detect whether someone mis-keyed aSSN when typing it 

into a system, or whether a number submitted was made up on the fly by someone looking to 

avoid providing a legitimate SSN. 

1 See llllps://www.ssa.sov/oolicy/docs/ssb/v69u2/v69n2p55.btml 
113 


ralbany on LAP520R082 with HEARINGS33871.081

2. In your testimony, you discussed how some companies have shifted their business 

practices in recognition of the risk of using SSNs, however some governmenr 

requirements hinder additional private sector efforts. What are these specific 

requirements and what teps can Congress take to remove these barriers to private sector 

action? 

As I noted in my testimony, there are a number of legal and regulatory requirements in place tbat 

require the SSN to be collected and retained by different organizations. Much of industry's 

ability to reduce their reliance on the SSN will be dependent on the government changing its 

requirements for them to collect it. 

I have attached two inventories of policies that cover use of the SSN: one focused on 

requirements penaining to the financial services industry that was compiled by the Financial 

Services Roundtable (FSR) - they have given us permission to share this here - and a second 

compiled by the Better Identity Coalition that focuses on requirements for finns outside of the 

financial sector. 

These lists are not intended to be an exhaustive inventory of the policies in place requiring use of 

tlte SSN, btu they do serve to highlight how embedded the SSN is as an identifier in so many of 

our identity processes- and helps to frame the complexity and cost associated with any effon to 

replace it. 

While some of these requirements may be able to be repealed without much impact. repeal of 

others could make it quite difficult for government or industry to achieve cenain outcomes or 

execute core parts of their mission. This is because identifiers are imponant - many govenunent 

and ndu ry ntitie~ require an identifier to deliver a ~erv ce or fu lfill key policy ohjective~. 

Thus, we would not advocate for a wholesale repeal of these requirements. 

It could be helpful, however, for the govenunent to review all of the places where the SSN is 

required to be collected today and consider if alternative approaches may allow government to 

ensure better outcomes. 

2 
114 


ralbany on LAP520R082 with HEARINGS33871.082

Federal taws and Rt'gulatlons Relatt'd to flnanctallnstltutlons' Obtal_nlng 

Social Security Numbers 

~1!!!!1~ I! Ba~!!l!!loe ~!I ~ss!!I:!II ~gml!£[ &9!!lttm~•· B~•~D!I!II!l!l•eml 

I l_rovtsl!!!!§ 

A. BSAI MIL 

Customer Idtotific.aUon P1·tor to opening an account, the banklrbriftlcredit no ion must, The bank must retai_n 

Program at a minimum, obtain the customer's name, date of bin h. address ideotifying infonn<ltion 

31 C.F.R. § 1020.2.l0 (residenti<ll or business), and an fd<'ntlflcatlon number (can be for five years arter the 

taxpayer identification number}. account is dosed. 

Purchases of bank No finanC-ial institution may issue or seU a bank ch«k or Records required to be 

chec:ks and drafts, draft, c.ashler's check, money ordu or tra,'eler's cbtck !or kept shall be retained by 

cashier's checks, money 53,000 or more in currency unless it maintains •·ecords of the tbe financial instinlfion 

orders and traveler's foUo"''in~ information, which must be obtaiucd for each issuance for a period of five years 

che<:ks or sale of one or more of these iusuumeuts to any individual and shall be wade 

31 C.F.R. § /010.415 purchaser which involves currency in amounts $3,000~S 000 available to the Sc-erctary 

inclusive: upon request at auy time. 

If lite purchaser does not have a d<'poslt account with the 

flnandallnstftutton: 

(A) The name and address of the purchaser, 

(B) The social se<urlty number of the purchaser, or iflbe 

purchaser is an alien and does not have a social security number, 

the alien ide-ntification number; 

(C) 1l1e d.1te of birth of the purchaser, 

(D) The date of purchase; 

(E) l11e type(s) of iuStlUWeut(S) purchased; 

(F) The serial uwuber(s) of the instrument(s) pw-chased; and 

(G) The amount iu dollars of each of the iustnunent(s) purchased. 

Benentlal Ownusbip Financial institutions are required to obtain, ve1ify, and record the A financial instiwtion 

31 C.F.R. § 1010.230 identitie-s of the beneficial owners of legal entity customers. must retaiu the records 

(effecri"• May I I. 2018) for five years after the 

As with CIP for individual customers, covered financial date tJ1e account is 

institutions Ulust coUcct [rom tbc legal entity customer the name, closed. 

date of birth, address, and social security number or other 

govemment identification number (passp011 number or other 

similar information in the case of foreign persons) for individu<liS 

who own 25% or more oft he equity interest ofrhe legal enlity (if 

any). and an individual with significant responsibiJity to 

control/manage the le.gal entity at rhe rime a new account is 

opened. 

B. Consumer flnandal Products and Sorvkts 

Application for a For residential mortgage transactions~ au application consists of A creditor shaU retain 

r<'sldent1al ntOJ·tgage the submission of t11c consmncr's name, the consumer's income, evidence of compliance 

loan (fruth In L<ndlng the consumer's social S<'Cul'ity number to obtaio a credit repot1, for two years after the 

Act) the property address, an estimate of the value of the property, and da(e disclosures are 

12C.F.R. §§ the mortgage loan amount sought. required to be made or 

IOZ6.3(n)(3)(ii); 1026.25 action is required to be 

taken . 

I 
115 


ralbany on LAP520R082 with HEARINGS33871.083

Federal taws and Rt'gulatlons Relatt'd to flnanctal lnstltutlons' Obtal_nlng 

Social Security Numbers 

Electronic Fund A fmancia1 itJSlinnion shall comply with the requirements of this Any person subjec1 10 1hc 

T.-ansfer Act- Error section with respect to aoy oral or writlen notice of error from the Act and this part shall 

Notice consumer that: (i) Is received by the i_nstitution no later than 60 retain evide.nce of 

12 C.F.R. §§ 1005. 11 and days after the insrinuion sends the periodic statement or provides compliance with the 

1005. 13 the passbook documentation. on which the alleged error is first req,lirements imposed by 

fl ec ed~ (ii) Enables the instihnion lO identifY the consumer's the Act and this part for a 

name and account mnnber: aud(iii) I.ndicate-s why the consumer period of not less than 

believes an error exists and includes to the extent possible the t-wo years ti·om the date 

type, date. and amount of the eJTOr, except for requests described disclosm·cs are required 

in paragraph (a)(l)(vii) of Ibis sec1iou. to be made or aetiou is 

required 10 be lakcu. 

Coutent of error notice. Tiut notice of en·or is effective even if it 

does not contain the consumer's account number, so long as the 

financial institution is able to identi fY the acco1mt in question. For 

example, the consumer could provide a Social Security number or 

other unique means of identifica tion. 

C. Prlva<vllnformadon St<urltv 

Privacy of Flnancial Nonpublic ptrsonally identifiable inforrnaliou includes any No spccilic 

Inrormalion information a consumer provides to you to obtain a fmancial re<:ordkecping 

12 C.F.R. pt. 332 product or service from you. rc<JuU·emeut. 

The regulation: 

(I) Requires a financial iostinuion to provide notice to customers 

about its privacy policies and practices: 

(2) Describes the conditions under which a financial instin1tion 

may disclose nonpublic personal iofonuation about 

consumers to nonaffiliated third parties: and 

(3) Provides a method for consumers 10 prevent a financial 

institution from disclosing thai iufonnatiou to most 

uouotlilialcd tl>ird parlics by "opting ou1" of lhal disclosure, 

sub· cct to exceptions. 

Interagency Guidelines An institution must protect against \Ulautborized access to or use An institution's 

Establishing of customer itJformatiou lhat could result in substantial hanu or infonnatiou security 

Iorornmtion Security iucouvcuicucc to any customer. Substantial hann or program must ensure tJtc 

Standarcls incouveuieucc is most likely to result &om improper access proper disposal of 

12 C. F. fl. pt. 364, App. B to sen sitive c-ustomer information , whicb includes customer iufonualion and 

(and corresponding rogs) SSN, because this type ofiufonuatiou is mosllikcly to be consmner infonuation. 

misused, as in the com.mission of identity thetl. 

Notlc~ to Regulator: 1·he institution•s response program must 

include procedures for no if}~ng its primary federal regulatory as 

soon as possible when the i_nstitution becomes aware of ao 

incident iuvolving uuautborizc..-d access to or uses of senslti\'e 

customer iofo .. mation. 
116 


ralbany on LAP520R082 with HEARINGS33871.084

Federal taws and Rt'gulatlons Relatt'd to flnanctal lnstltutlons' Obtal_nlng 

Social Security Numbers 

Red Flag$ Rul• 

11 C.F.R. pt. 334, App. J 

(and con·csponding ,·cgs) 

l)uUes of Consumer 

Reporting Agencies 

Regardln~: ldenlily Thert 

12 C.F.R. § 1()22. 123 

Notice to Consumer: \Vheu a financial institution becomes 

aware of an inc ident of unauthorized access to sensitive 

cu.stome•· Information. the instittH·ion should conduct a 

re~1so ab e investigation to promptly detennine the likelihood that 

the infom1ation has been or will be misused. Lf the institution 

detennines that misuse of its inforll)ation about a customer has 

occurred or is reasonably possible. it should notify the affected 

customer as soon as possible. Customer notice may be delayed if 

an appropriate law enforcement agency detcnuincs that 

uolifical'ioo will iutcrfcrc with a c riminal investigation and 

provides tbe iitStitutiou with a written request for the delay. 

However, the i.J1stitutiou should notify its customers as soon as 

notification will no lon~er interfere with the investigation. 

D. Id•otllyTbeR/Coosumer Reports 

Req\1ires financial instittuions a nd creditors to develop and 

provide for the continued administration of a wrinen Program to 

detect, prevent. and miti$!_atc identity tl1ctl in cotmcctiou with the 

opening of a covered account or any existing covered accowlt. 

Each fmauciaJ iJtStitutiou or creditor may consider incorporating 

into its Progrnm, whether singly or in combination, Red Flags 

from the following illustrative examples in connection with 

covered accounts: Suspicious personal identifying infonnarion 

inchades: 

• Social security number has not been issued or is li.sted on the 

Social Security Administration's Oe.ath Master file 

• Lack of correlation between the SSN range and date of birth 

• The SSN provided is lhc same as thai submitted by other 

p;:rsons op;:niug an account or other customers. 

Consumer repo1·ttng agendes shall develop and Implement 

•·easonable l'equirements Cor what information consumers 

shall p•·ovlde to constitute 11roof of Identity where the 

cousumer assens a good-f.1irh belief that have been a victim of 

idcntily fi·aud or a rclaced crime. 

Examples of Information that might constitute reasonable 

infonualiou requirements for proof of identity are provided for 

illustrative purposes 01tly: 

Consumc,·fllc match. The idcutificaciou infonuation of the 

consumer including his or her fuU name (fJTSl, middle in.icial_, last, 

suffLx). any other or previously used names, cutTtiH audlor recent 

full address (street number and name. apl. no .• city. state. rutd zip 

code), full nine digits ofSo<ial Secu.-ily numbor, audlor date of 

birth. 
117 


ralbany on LAP520R082 with HEARINGS33871.085

Federal taws and Rt'gulatlons Relatt'd to flnanctal lnstltutlons' Obtal_nlng 

Social Security Numbers 

Olsclosuro by CRA of 

Consumer File to 

Consumer; f 1·ee ,.\nnual 

Report; 

15 u.s.c. §§ 168 /g, 

168 /h, 168/j(n); 12 

C.F.R. pl. /0221 subpart 

N. 

Every consumer reporting agency shall, upon request, clearly aud 

accurarely disclose to the consumer alll_nformatlon In the 

consumer's file at the ti_me oflhe request.. except that ifrbe 

consumer to whom the file relates requests that the first five digits 

of the SSN not be included, and the reporting agency has 

adequare proof oft he identity of the requester, the repo11ing 

agency shall so rmncate rhe disclosure. 

A CRA shall require, as a coudiliou of making that disclosure. 

that the consumer fumisb IJropn ideotificallon. 

Free Annual Reports: There is a centralized source for requesting 

annual file disclosures from nationwide CRAs which collects 

only as much personally Identifiable lnfol'matlon as is 

re-.asonttbly necessary to properly identify the consumer and to 

process the transaction requested by rhe consumer. 

Auy personally identi.flable information collec-ted fi·om 

couswncrs as a rcsull of a request for anuua.L fllc disclosure, or 

olber disclosure required by the FCRA, wade through tho 

centralized source, may be used or disclosed by tbc centralized 

source or a nationwide consumer reporting agency ouly: 

(I) To provide the annual file disclosure or other disclosure 

rcquir(.-d wtder Ute FCRA requested by lbo constuucr: 

(2) To process a transaclion r<:quested by lbe cousmuer at lho 

same time as a request for annual file disclosure or other 

disclosure; 

(3) ·ro comply with applicable legal requirements. including those 

imposed by ~te FCRA and I his part; and 

(4) To updale personally identifiable infonnation already 

mainraioed by rhe natioowide consumer repo1ting agency for the 

purpose of providing consumer repo11s. provided that the 

nationwide consumer reporting agency uses and discloses the 

updated personally identifiable infonuation subject to the same 

reSlTictions that would apply, tmdcr any applicable provision of 

law or regulation, to the infonuation uix:J,ited or replaced. 
118 


ralbany on LAP520R082 with HEARINGS33871.086

Federal Laws and Regulations Related to Obtaining and Maintaining 

Social Security Numbers 

Statute & Regulation, Including Enacting Social Securi!,y Number Reguirement 

Le!!islation and Citation 

A. Ern~ loyrnent 

Income Tax Collected at Source A request that an annuity or any sick pay be subj ect to 

*Enacting legislation does not have a specific withholding under this chapter. .. shall be made by the payee 

name. Public Law 96-601 is titled "An Act" "to in writing to the person making the payments and shall 

simply certain provisions of the Internal Revenue contain the social security number of the payee. 

Code of 1954, and for other purposes." 

26 usc.§ 3402 

Verification ofldentity and Employment A person or entity that hires or recruits or refers for a fee an 

Authorization individual for employment must ensure that the individual 

8 C.F.R. § 274a.2 properly completes section 1 - "Employee Information and 

Verification" - on the Form 1-9 at the time of hire. 

Section 1 of Form 1-9 includes a field for social security 

numbers. 

B. Education 

Returns Relating to Higher Education Tuition Any person: (1) which is an eligible educational institution 

and Related Expenses which enrolls any individual for any academic period; (2) 

Taxpayer Relief Act of 1997 which is engaged in a trade or business of making payments 

26 USC.§ 6050S to any individual under an insmance arrangement as 

reimbursements or refunds (or similar amounts) of qualified 

tuition and related expenses; or (3) except as provided in 

regulations, which is engaged in a trade or business and, in 

the course of which, receives from any individual interest 

aggregating $600 or more for any calendar year on one or 

more qualified education loans, shall make the return 

described in subsection (b) with respect to the individual at 

such time as the Secretary may by regulations prescribe. 

A return is described in this subsection if such return: ( 1) is 

in such form as the Secretary may prescribe, and (2) contains: 

(A) the name, address, and TIN of any individual (i) who is 

or has been emolled at the institution and with respect to 

whom transactions described in subparagraph (B) are made 

during the calendar year.. 

Social Security Number [T]he Secretary attempts to confirm the social security 

34 C.F.R. § 668.36 number a student provides on the Free Application for 

Federal Student Aid (FAFSA) under a data match with the 

Social Security Administration. If the Social Security 

Administration confirms that number, the Secretary notifies 

the institution and the student of that confirmation. 
119 


ralbany on LAP520R082 with HEARINGS33871.087

An institution may not disburse any title IV , 1{6A program 

funds to a student until the instinuion is satisfied that dte 

smdent's reported social security number is accurate. 

C. Healtbcare I 

Repot·ting of Health Insurance Coverage Every person who provides minimum essential coverage to an 

The Patient Protection and Affordable Care Act individual during a calendar year shall. at such time as the 

26 u.s. c.§ 6055 Secretary may prescribe. make a return described in 

subsection (b). 

A return is described in this subsection if such retum: (A) is 

in such fonn as the Secretary may prescribe. and (B) contains 

(i) the name. address and TIN of the primary insured and the 

name and TIN of each other individual obtaining coverage 

under the policy ... 

Eligibility Determin ations An applicant for enrollment in a qualified health plan offered 

The J>aticnt Protection and Affordable Care Act through an Exchange in the individual market shall provide: 

42 u.s. c.§ 18081 (A) the name, addrt'SS. and date ofbinh of each individual 

who is to be covered by the plan (in this subsection referred to 

as an "enrollee"); and (B) the information required by any of 

the following paragraphs thai is applicable 10 an enrollee. 

The following information shall be provided wilh respect to 

every enrollee: (A) ln the case of an enrollee whose eligibility 

is based on an auesta~ion of citizenship of the enrollee. the 

enrollee's social security number: (B) In 1be case of an 

individual whose eligibility is based on an aneslalion of dte 

enrollee's immigration starus. the enrolk•e's social se-curity 

number (if applicable) and such identifying infonnation with 

respect to the enrollee's im.migrmion status as the Secretary. 

after consuhation with lhe Secretary of Homeland Securily. 

delennines appropriate. 

Eligibilily Process The Exchange must require an applicanl who has a Soda! 

45 C.P.R. ~ 155.310 Security number 10 provide such nmnber 10 the Excbanl(e. 

D. Driver's License I 

Minimum Issuance Standards To meet the requiremenls of this section, :1 State shall require. 

REALIDAct at a minimum, presentation and ve-rification of the following 

49 U.S. C.§ 30301 n01e infonnation before issuing a driver's licellSe or identificalion 

card 10 a person: (A) A photo identily documem, excepl that a 

non-pholo identity document is acceptable if it includes both 

lbe person's full legal name and dale of birth; (B) 

Oocumenunion showing the person's date ofbinh; (C) Proof 

of the person's social security account number or 

verification that the person is not eligible for a social 

securily account number: (D) Oocumenlalioo showing the 

I person's name and address of principal residence. 
120 


ralbany on LAP520R082 with HEARINGS33871.088

Application and Documents the Applicant ( 1) Except as provided in paragraph (e)(3) of this section, 

M ust Provide individuals presenting the identity documents listed in§ 

6 C.F.R. § 37.11 37. 11 (c)( 1) and (2) must present his or her Social Security 

Administ1·ation account number card ; or, if a Social 

Security Administration account card is not available, Lhe 

person may present any of the following docume.nts bearing 

the applicant's SSN: (i) A \V-2 form: (ii) A SSA-1099 form; 

(iii) A non-SSA-1099 form: or(iv) A pay stub with the 

applicant's name and SSN on it. 

(2) The Stille OMV must verify the SSN pursuant 10 § 

37.13(b)(2) of this subpan. 

(3) Individuals presenting the identity document listed in§ 

37. 11 (c)(l)(vi) must present an SSN or demonstrAte non-work 

authorized status. 

R~uir nt of Statutorily Prescribed Each State must have in effect laws requiring the use of the 

Procedures to Improve Effectiveness of Child fo11owing procedures .. · 

Support Enforcement 

Personal Responsibility and Work Opponnnity Procedures requiring that the social security number ofReconciliation Act of 1996 (A) any applicant for a professional license, dtive•-'s lkense, 

42 u.s. c.§ 666 occupational license, recreational license. or marriage license 

be recorded on the application. 

For purposes of subparagraph (A) (cited above), if a State 

allows the use of a number other than the social security 

number to be used on the lace of the document while the 

social security number is kept on file at the agency, the State 

shall so advise any applicants. 

E. Miscellaneous 

Blond Donor Loc.atot· Servi<e A request for address information under this section shall be 

Teclmical and Miscellaneous Revenue Act of filed in such manner and fonn as the Commissioner of Social 

1988 Security shall by regulation prescribe, shall include the blood 

42 U.S. C.§ 1320b-llc donor•s social security account number, and shnll be 

accompanied or supponed by such doctunents as the 

C01mnissioner of Social Security may detemli.ne to be 

necessary. 

Establishment of a Vessel Idcalification The vessel identification system shall include information 

System prescribed by the Secretary including: ( I) identifying a vessel: 

Coast Guard Authorization Ac.t of 1989 (2) identifying the owner of the vessel, including46 u.s. c. § 12501 (A) the owner's social security numbet· or. if that number is 

not available. other means of identification acceptable to the 

Secretary: or 

(B) lor an owner other than an individualI (i).the owner's taxpayer identification number: or 
121 

f 


ralbany on LAP520R082 with HEARINGS33871.089

(ii) if the owner does not have a taxpayer identification 

number, the social security number of an individual who is a 

corporate officer, general partner, or individual trustee of the 

owner and who signed the application for documentation or 

numbering for the vessel; 
122 

f 


ralbany on LAP520R082 with HEARINGS33871.090

Steve Grohman 

COMM ITIEE ON WAYS AND MEANS 

U.S. HOUSE OF REPRESENTATIVES 

WASHINGTON, DC 20515 

June 7, 201 8 

Senior Vice President and Chief Technology Officer 

McAfee, LLC 

5000 Headquarters Drive 

Plano, TX 75024 

Dear Mr. Grohman, 

Thank you for your testimony before the Committee on Ways and Means Subcommittee on 

Social Security at the May 18, 20 I 8 bearing on "Securing Americans' Identities: The Future of 

the Social Security Number." In order to complete our bearing record, we would appreciate your 

response-s to the following question: 

I. Understanding that the current nine-digit Social Security number (SSN) format has a 

limited number of combinatio.ns, and that its design was limited by the technology 

available in 1936, what considcmtions need to be taken into account for a future version 

of the SSN? 

We would appreciate your responses to these questions by June 21, 20 18. Please send your 

response to the allention of Amy Shuart, Staff Director, Subcommittee on Social Security, 

Committee on Ways and Means, U.S. House of Representatives, 2018 Rayburn House Office 

Building, WashiJlgton, DC 205 I 5. In addition to a hat·d copy, please submit an electronic copy 

of your response in tvlicrosoft Word format to mm.russell@mail.house.gov. 

Thank you for taking the time to answer these questions for the record. If you have any 

questions concerning this request, you may reach Amy at (202) 225-9263. 

Sincerely, 

~(:>YW\0~~ Sam Johnson 

Chairman 

Subcommiuce on Social Security 
123 


ralbany on LAP520R082 with HEARINGS33871.091

Social Security Subcommittee Hearing on "Securing American Identities: The 

Future of the Social Security Number" 

Question for Steve Grobman: 

• Understanding that the current nine-digital Social Security Number (SSN) 

format has a limited number of combinations, and that its design was 

limited by the technology available in 1936, what considerations need to be 

taken into account for the future version of the SSN? 

Answer: 

The number of permutations in a 9-digit number, the number of digits on each 

Social Security number, is 1 billion. There are now about 325 million citizens in 

the United States, which could exhaust the pool of SSNs within a few 

generations. From a security point of view, this is not acceptable given the 

constant innovation of both hardware and software that makes cracking 1 

billion combinations a relatively easy task. Over time, innovations in Quantum 

computing will enable hackers to crack virtually all known methods of 

encryption. The federal government should design a larger namespace that 

eliminates the need for re-use in the long run, while also rethinking its 

approach to securing the Social Security number, including taking into 

consideration such capabilities as two factor authentication to help protect t he 

integrity of the SSN. 

There are three work flows in an identity management system: identity, 

authentication, and authorization. In our current SSN system, the SSN plays a 

role in all three, while in the field of computer science, we recognize the 

criticality of segregating t hese processes to ensure a high level of secu rity. The 

use of the SSN should be limited as an identifier that should be public, much 

like a citizen's email address. At the same time, both the public and the 

private sectors need to develop new models of authentication and 

authorization that can be used in conjunction with the SSN to give Americans 

the modern identity management system they deserve. To enable this type of 

innovation, policy makers shou ld ban the simple knowledge of a Social Security 

number as an accepted form of authentication throughout our economy, 

enable federal agencies to act as validators of identity, given the many 
124 


ralbany on LAP520R082 with HEARINGS33871.092

credentials over w hich the federal government has authority, including 

passports, and mandate all federal e-government services provided directly to 

citizens require t he use of strong authentication to enhance trust in 

govern ment services. 

A truly robust, modern identity management system needs to have the ability 

to do t he following t hings: Assure the new means to identify an individual can 

be reissued in the event it is compromised to help guarantee the system and 

the individual better long-term security. Look at ways to provide 

authent ication and authorization without having to store all privacy related 

information of each US citizen in one single place. Require the least amount of 

information needed to accurately authenticate the individual. Leverage multifactor authentication mechanisms as a part of the solution; what you have, 

what you know, and who you are. Consider the benefits of biometrics, wit h 

user consent, and if, and only if, there is broad public support for such a 

solution. Many new phones and laptops support limited use of biometrics 

today. Broad-based acceptance of biometrics may well increase over t ime. 

Look at what has worked in financial services industry and other countries for 

feasible ideas and deployment techniques. Invest in research and 

development to overcome identity management challenges of the future such 

as Innovations in Quantum computing that have the potential to make current 

methods of encryption obsolete. Don't try to solve all the identification, 

authorization and authentication challenges for the entire US digital economy 

out of the gate. Initially, focus on improving the SSN to providing US Federal 

services and benefits to US citizens. Use a phased approach to produce broad 

based, long term success. 

Finally, Subcommittee Members should consider the cost of failing to takeaction. Identity t heft and fraud cost consumers more than $16 billion per year 

according to report from Javelin Strategy & Research, Feb 1, 2017. The other 

concern is the deteriorat ing trust t he American population has in the 

fundamental components targeted by identity theft and fraud. The 

Subcommittee should ask the U.S. Government Accountability Office (GAO) to 

conduct a study, using dynamic scoring, that compares the cost to consumers 

and our overall economy of identity theft and fraud to the costs and benefits 

of architecting a modern, identity management system. A well-done study 
125 

f 


ralbany on LAP520R082 with HEARINGS33871.093

could overcome the objections of policy makers who say that it is too hard or 

too expensive. We owe it to our citizens to take legislative and budgetary 

action now. 
126 

f 


ralbany on LAP520R082 with HEARINGS33871.094

Paul Rosenzweig 

Senior Fellow 

R Street Institute 

1212 New York Ave NW 

Suite 900 

Washington, DC 20005 

Dear Mr. Rosenzweig, 

COMMITTEE ON WAYS AND MEANS 

U.S. HOUSE OF REPRESENTATIVES 

WASHINGTON, DC 20515 

June 7, 2018 

Thank you for your testimony before the Committee on Ways and Means Subcommittee on 

Social Security at the May I 8. 20 I 8 hearing on "Securing Americans' Identities: The Future of 

the Social Security Number." ln order to complete our hearing record, we would appreciate your 

responses to the following question: 

I. In your testimony, you suggested that publication of a "phone book" with every 

Social Security number (SSN) would make it clear that the use of'SSNs as 

authenticators was no longer a reasonable option. Would this approach work if only 

the SSNs were published, or would additional nssociated datn clements such as names 

have to accompany the SSNs? 

We would appreciate your responses 10 these questions by June 2 I, 20 I 8. Please send your 

response 10 the attention of Amy Shuart, Staff Director, Subcommittee on Sociul Security, 

Committee on Ways and Means, U.S. House ofRepresentmivcs, 2018 Rayburn !louse Office 

Duilding, Washington, DC 20515. In addition to a hard copy, please submit an electronic copy 

of your response in Microsoft Word fonnat to mm.ruSM;III{ilmail.house.gov. 

TI1auk you for taking the time to answer these questions for the record. If you have any 

questions concerning this request, you may reach Amy 111 (202) 225-9263. 

Sam Johnson 

Chairman 

Subcommittee on Social Security 
127 

f 


ralbany on LAP520R082 with HEARINGS33871.095

15 June 2018 

The Honorable Sam Johnson 

Chairman 

Subcommittee on Social Security 

Committee on Ways and Means 

U.S. House of Representatives 

Washington, DC 20515 

Dear Chairman Johnson: 

e. rstreet@rstreet.org 

o. 202.525.5717 

f.1.877.793.4920 

rstreet.org 

Thank you for your question regarding the May 18, 2018 Committee on Ways and Means 

Subcommittee on Social Security hearing on "Securing Americans' Identities: The Future of 

the Social Security Number." 

Question 

"In your testimony, you suggested that publication of a 'phonebook' with every Social Security 

number (SSN) would make it clear that the use of SSNs as authenticators was no longer a 

reasonable option. Would this approach work if only the SSNs were published, or would 

additional associated data elements such as names have to aocompany the SSNs?" 

Response 

My proposal to publish SSNs is intended to eliminate their utility as an authenticator - that is, 

it is intended to prevent any security system from using a social security number to 

authenticate the name of a person for purposes of providing access to a system. As such, 

simply publishing the SSNs alone without names would not achieve the objectives of the 

proposal. The virtue of the proposal lies in providing a public link between a name and a 

social security number thereby draining the SSN of any patina of secrecy of confidentiality 

that it might still retain. 

Sincerely, 

Paul Rosenzweig 

Senior Fellow 

R Street Institute 

Free markets. Real solutions. 

1212 NewYorkAve NWSuite 900 

Washington DC 20005 
128 

[Public Submission for the Record follow:] 


ralbany on LAP520R082 with HEARINGS33871.096

I napbs. I Natlonet Association of Professional Background Screeners 

The Voice of ScrMnlng Profeulonala 

Honorable Sam Johnson 

Chainnan, House Ways and Means 

Subcommittee on Social Security 

2304 Rayburn House Office Building 

Washington, DC 20515 

May 17, 2018 

Honorable John Larson 

Ranking Member, House Ways and Means 

Subcommittee on Social Security 

150 I Longworth House Office Building 

Washington, DC 20515 

RE: Preserving Access to Social Security Numbers in Key Federal Databases to 

Protect Americans' Health and Safety 

Dear Chairman Johnson and Ranking Member Larson: 

The National Association of Professional Background Screeners (NAPBS) applauds the 

Subcommittee for convening today's hearing on the future of the Social Security Number. Our 

800 members work to promote the safety and security of our conummities and workplaces, and 

in order to meet that objective access to and usage of identifiers such as the Social Security 

Number (SSN) is vitally important. Indeed, the use of SSNs is a critical tool for our members to 

meet the federal statutory obligation imposed on our members by the Fair Credit Reporting Act 

for "maximum possible accuracy." While the SSN was not designed to serve as a broadly-used 

identifier when it was created in the 1930s. it nevertheless serves that function in many f.~ce s of 

the American economy and modem society. Curtailing its use in that regard would be highly 

dismptive and costly, and would just lead to a search for similarly broad identifiers to use in its 

place. 

NAPBS understands and shares the concerns expressed by Members of the Subcommittee and 

other stakeholders about the potential misuse of SSNs to perpetuate identity theft or other fraud. 

We recognize that in light of the breaches of consumer data extending back many years have 

likely exposed most consumers' SSN and other personal identifiable infonnation to risk of 

misuse. Accordingly, the Subcommittee is appropriately concerned about the future use of SSNs 

and we welcome the opportunity to share some high-level recommendations: 

(I) The use of SSNs as an identifier should be preserved. 

(2) The use of SSNs as an authenticator should be constrained. 

(3) Market-based technological solutions for authentication will provide appropriate 

solutions for consumer authentication 

( 4) The federal govenunent can establish a leadership role, by eliminating the use of 

SSNs for authentication purposes when used with data held by the federal government. 
129 


ralbany on LAP520R082 with HEARINGS33871.097

~ napbs. 

I National AssocJatJon of Profaaa1onal Background Screenera 

The \lok:le ot SctMnlng Pro,.ltlonllt 

The difference between using SSN as an identifier and using it as an authenticator is a key 

difference - but is frequently overlooked. An identifier is a piece of information used to tag other 

infonnation as belonging to an individual. An authenticator is a piece of infom1ation that tends to 

confirm t.hat the person you arc interacting with is the person that they claim to be. 

SSN is an ideal identifier. Almost all adult Americans have one, and the number is unique to that 

individual. That means that a simple 10-digit number can be used as a conunon index to find 

data. Employers. schools. banks. health care providers. government agencies, and millions of 

others can quickly identifY their records about an individual using SSN. This has enonnous value 

to both organizations and the individual. 

But SSN is a terrible authenticator. An ideal authenticator is a piece of information that only the 

person being authenticated and the person authenticating know, and that is difficult to guess. The 

very fact that SSN is so useful as an identifier - its conunon format, its widespread use - make it 

a terrible authenticator because it is not a secret at all. It is likely that, for most Americans, 

hundreds of organizations have records of their SSN, and at least thousands of individuals have 

access to those records. 

As technology has evolved, credit card companies, phone companies, and others began using 

SSNs as awhenticators, to verify that people are who they claim to be. In effectively treating 

SSNs as secret infonnation, these institutions have increased the danger of identity theft by both 

augmenling the power of SSNs, and by sharing the dala with their employees. The Federal Trade 

Commission has acknowledged this issue, noting in a 2008 report 1ha1 " the SSN may not be 

well-suiled as an authenticator ilself, but can be and is used effeclively to de1ec1 polential fraud 

by penniuing access 10 other authemication-related infonnalion." 

With the foregoing in mind, it is important to underscore the critical aspect of SSNs as an 

identifier. Redacting importanl identifying information such as SSNs from public records 

greatly impacts the ability of background scrceners- which are hired by employers to obtain the 

critical information needed to make accurate and timely hiring decisions. Having an individual's 

full DOB and at least the last four digits of his/her social security number are critical identifiers 

for public records as they help ensure the correct data is matched to an individual. This is 

particularly important when dealing with common names. as search results can potenlially yield 

hundreds of resuhs. Preserving access to SSNs. therefore, will help ensure the greatest possible 

accuracy when nmning background checks for individuals serving in sensilive positions. 

The ultinlate solulion 10 au1hen1ication will be market-based and 1cchnology-focused. But some 

of the best authentication technology in existence today relies on informalion I hat is idemified 

using SSN withoul authenricating wilh the SSN. For example, each of the major credil bureaus 

uses infom1a1ion from their files abou1 individuals - typically indexed using SSN as a major 

element - 10 genera1e "out of wallel'' quizzes to confirm the identity of individuals who reques1 

their credil reports. These quizzes ask individuals muhiple choice queslions regarding mailers 

thai the credi1 fi les show (such as prior addresses, or the amotmts of car or house payments) and 
130 

Æ 


ralbany on LAP520R082 with HEARINGS33871.098

~ napbs. I National Auoclatlon of Profeulonel Beckground Screenera 

The Voice of Scteenlng Profeulonat. 

that would be unlikely for another person to know. These questions awhenticate the person, but 

the infom1ation that leads to the question is identified by the SSN. 

While the ultimate solution to SSN utilization will be market based and teclmology focused, the 

federal government can and should take the lead by restricting agencies' use ofSSN as 

authenticator. Accordingly, NAPBS would like to encourage Congress and Federal agencies to 

preserve the collection of, use and access to SSNs where appropriate for public safety. Thank 

you for your time and consideration of these comments. 

Sincerely, 

Melissa L. Sorenson 

Executive Director 

National Association of Professional Backgrow1d Screeners