I share concern along with others here that the design of the original Web delivery system for personal benefits statements was an inappropriate application of technology, and I am glad that this first experiment was discontinued in April. I will explain why I think it was a mistake, and why better user authentication is needed, in the form of digital signatures and strong password authentication. However, some people in this forum have also remarked about the high cost of this mistake, in terms of congressional attention, public forums, and so forth. To me this event represents a fortunate opportunity to publicly analyze what was wrong with it, and to increase the awareness of critical issues where personal privacy and security meets the Internet. I think this is time and money well spent.
Progress is rare without an occasional step backwards.
There are different ways to look at the problem of secure delivery of sensitive personal data. As a technologist with over 20 years in this industry, and the founder of Integrity Sciences, a company which for the past five years has researched, designed and developed PC network security and cryptographic methods, I can appreciate the technical viewpoint which led to the design of the initial Web delivery system. US postal retrieval of Benefits statements was already well established, with access enabled by sending just a couple pieces of simple identifying information. It must have seemed like a simple job to map this system to the new more efficient and secure Internet. Internet delivery is anonymous and instantaneous.