| Comment Number: | 531096-00112 |
| Received: | 8/13/2007 10:28:10 AM |
| Organization: | City of Fitchburg, Wisconsin, Common Council |
| Commenter: | Stephen Lloyd Arnold |
| State: | WI |
| Agency: | Federal Trade Commission |
| Rule: | Private Sector Use of SSNs |
| No Attachments |
Comments:
You have asked for comments on many aspects of the private use of SSNs. I choose to comment on only one: the use of SSNs as authenticators. The possibility of using SSNs as authenticators postulate the human population is divided into two types of people: 1. those that are authorized, via their job roles, to access SSNs for either identification or authentication, who are honest, careful, and completely reliable in preventing SSN data to be shared with the other type of person, and 2. those who have no authorized need to access SSNs, and who are assumed to be dishonest and capable of using any SSN data they can obtain for identity theft. Clearly, this is a preposterous dichotomy. Too many people move from one group to the other because of changing job roles for it to be feasible to maintain this "firewall", methods of screening staff for honesty are not reliable, and some people are tempted to become dishonest because of changed personal circumstances. Therefore I believe that SSNs should be used for identification only, as originally intended, and that criminal penalties be imposed on organizations that mandate their use as authenticators. To reinforce this prohibition, after a transition period, SSNs should be freely published by the federal government to facilitate their use as identifiers. For example, hospitals should ask me, at each point of treatment, for my name and SSN, rather than my name and birthdate, to confirm I am the correct Stephen Arnold to receive the treatment. Commercial credit reporting agencies and others who have been using SSNs as authenticators must adopt alternative authenticators. In particular, they should establish methods to authenticate the identities of all new and continuing subjects by positive means unrelated to knowing secret information. This could include photoidentification or other biometric documents, or affidavits by family members or others who have know the person over an extended period. Those forced to adopt new procedures will protest that commercial activity, especially the granting of "instant credit" (e.g., by retail stores and wireless service providers) will grind to a halt, and take down the rest of the economy with it. On the contrary, our economy would be stronger with tighter credit, and this would be a collateral benefit of my proposal. So to summarize, do not allow SSNs to be used as authenticators. It is impossible to separate those who are authorized to handle SSN data from those who would use it fraudulently. Thank you for considering this proposal. Regards, Stephen Lloyd Arnold