Little has changed since the Equifax breach of 2017 when attackers compromised the Social Security numbers of nearly 145.5 million Americans. A 2015 NPR study found that around 60-80 percent of all SSNs have been lost to hackers, and identity theft has been on the rise during the COVID-19 pandemic due to increased unemployment fraud and IRS-related scams.
Social Security numbers were introduced in the 1930s by the Social Security Administration and were originally intended to track worker contributions to a national retirement fund. Until 1972, Social Security cards were explicitly printed “not for identification.” Now, 9-digit SSNs are used by countless industries, including banks, credit card companies, auto lenders, and government agencies, to identify and authenticate people’s data. This system relies on keeping your SSN a secret—no easy task when potentially 80 percent of SSNs have already been compromised by hackers. And once data is stolen and distributed, it’s nearly impossible to recover. “A Social Security number was never intended to act as a security mechanism,” said James Scott, a senior fellow with the Institute for Critical Infrastructure Technology. “SSNs were introduced as identifiers, and organizations eventually employed them as a convenient, if not insecure control for identifying, cataloging, and authenticating consumers.
“Simply put, Social Security numbers are not secure and were never meant to authenticate data subjects.”
Transitioning 300 million Americans away from this system will be vastly difficult. Developing a new digital authentication and identification to be used throughout government, financial, and healthcare industries and private institutions is inevitably resource-intensive. The process of implementing a new solution and the liminal space can create an opportunity for unforeseen vulnerabilities in the new system—not to mention that many Americans don’t have easy access to broadband internet connection or computers. There are over 300 million SSN holders in the United States, and everyone would need to invest time in the transition for it to be effective. The SSN has failed as an authenticator and needs a secure replacement, but a new system can’t be rolled out overnight.
“A fundamental right of a human being is to engage in unlinkable activities,” says Emin Gun Sirer, a distributed systems and cryptography researcher at Cornell University. “So if you build an identity registry system that is too powerful, you suddenly find yourself in situations where your activities are always linked. So an identity system should expose linkages where they must legally be exposed—like if I try to get a lot of credit at once. But I should also be able to break that linkage when it need not be there. If I need to prove how old I am to a service, I should be able to just issue them a proof without them knowing anything else about me.”
Sirer is an advocate for an SSN replacement built on the cryptographic process known as a “zero-knowledge proof” for proving that a statement is true without any actual information about the assertion itself. A system utilizing a zero-knowledge proof would authenticate someone without knowing their identity.
