About this blog

Bob Sullivan

Corporate sneakiness. Government waste. Technology run amok. Outright scams. The Red Tape Chronicles is MSNBC.com's effort to unmask these 21st Century headaches and offer real solutions that save you time and money.

Bob Sullivan covers Internet scams and consumer fraud for MSNBC.com. He is the winner of multiple journalism awards for his coverage of online crime and author of Gotcha Capitalism: How Hidden Fees Rip You Off Every Day and What You Can Do About It. and Your Evil Twin: Behind the Identity Theft Epidemic.

Got some red tape you want Bob to untangle? Write BobSullivan@
feedback.msnbc.com.

Researchers say they can guess your SSN

Posted: Monday, July 6 2009 at 04:59 pm CT by Bob Sullivan

There’s a new reason to worry about the security of your Social Security number.  Turns out, they can be guessed with relative ease.

A group of researchers at Carnegie-Mellon University say they’ve discovered patterns in the issuance of numbers that make it relatively easy to deduce the personal information using publicly available information and some basic statistical analysis.

The research could have far-ranging implications for financial institutions and other firms that rely on Social Security numbers to ward off identity theft. It could also unleash a wave of criminal imitators who will try to duplicate the research.  

Details of the research were published Monday in the Proceedings of the National Academy of Sciences journal and will be explained at the annual Black Hat computer hacker convention in Las Vegas later this month.

The report means companies and other agencies should once and for all stop using Social Security numbers as passwords or unique identifiers, said Professor Alessandro Acquisti, who authored the report.

"We keep living as if they are secure, a secret," he said. "They're not a secret."

The Social Security Administration says SSNs are issued using a complex process that is effectively random, making them impossible to guess in practical terms.  But Acquisti and fellow researcher Ralph Gross used public lists of Social Security numbers to look for patterns.  They found several. The two say they can guess the first 5 digits of the Social Security number of anyone born after 1988 within two guesses, knowing only birth date and location. The last four digits, while harder to guess, can be had within a few hundred guesses in many situations -- a trivial hurdle for criminals using automated tools.

"Someone filling out credit card applications using a Web site and a botnet could easily succeed (in getting someone's number)," he said.

‘Public should not be alarmed’

Acquisti shared the report with the Social Security Administration’s office before publication.  He said he could not disclose what steps the agency is taking in response to the research. 

The Social Security administration played down the discovery.  In a statement to msnbc.com, Social Security spokesman Mark Lassiter called any suggestion that Acquisti had cracked the code for predicting Social Security numbers “a dramatic exaggeration.”

“The public should not be alarmed by this report because there is no foolproof method for predicting a person's Social Security Number,” the statement read.

But privacy expert Daniel Solove, a law professor at George Washington University who reviewed the report, called the discovery a “really big deal.” 

“If you have a password and you can readily figure it out, that’s absurd,” he said. “This paper points out just how ridiculous it is that we think there's a way to really keep Social Security numbers confidential.  There effectively is no way you can keep them totally confidential. It’s just not possible.”

How it works

Acquisti said he’s discovered simple patterns in the Social Security numbering system. It involves the elusive concept of randomness. To most people, a number is either random or it's not. But to mathematicians, randomness is a sliding scale. Developing perfectly random numbers -- the science of cryptography -- is nearly impossible. Often, software programs designed to create random numbers erroneously spit them out with a faintly distinguishable pattern. With a large enough sample, the numbers begin to form clusters.  Even a small discovery of such a cluster can make an enormous difference to someone trying to crack a crypto code, making predictions of supposedly random numbers an order of magnitude easier.

That's what the Carnegie Mellon researchers found.

A completely random guess at a 9-digit SSN should be a one in one billion chance.  But instead, their newly educated guesses have narrowed the odds down to roughly 1 in 1,000. Making matters worse, because of changes in the way the numbers have been issued since 1988, the numbers are getting easier and easier to guess as time passes. In one example, the researchers said, they can uncover a Delaware resident's 9-digit SSN within 10 guesses about 5 percent of the time.

The SSN is actually broken up into three parts - the first three digits are the “area number,” the second two are "group number" and the last four are the “serial number.” The Social Security Administration already offers considerable information about the first part of the number.  The area number is based on the zip code used in the application for an SSN.  High population states have many area numbers -- New York has 85, for instance – but many others, like Delaware, have only one. 

The other two parts the number, however, are assigned in a way that the Social Security Administration believes it nearly impossible for someone to guess. But the Carnegie Mellon work shows they are not.

He took the largest publicly available list of SSNs -- the agency's master death file, which publishes numbers of the deceased to make them hard to use by imposters -- and sorted the list by state and date of birth.  Immediately, it became clear that the second portion -- the group number  -- was sequentially issued and also trivial to guess. For example, every SSN issued in Pennsylvania during 1996 contains the middle two numbers 76.

That made guessing the first 5 digits of someone's SSN easy in some cases. During a test, the group was able to predict the first five digits of Vermont residents born in 1995 with 90 percent accuracy.

That's important, because there are many ways to determine the last four digits of someone's Social Security number. Some data brokers sell truncated SSNs, with either the first five or the last four numbers visible to the purchaser. And many financial firms use those numbers as a PIN code for verification.

Also, endless customer service operators ask for the last four digits when consumers call for help.  Any agent who knows where and when a caller was born could quickly amass a large set of complete Social Security numbers.

The report contains even more bad news.

The serial numbers -- the last four digits -- can often be guessed using formulas and patterns, he said. It turns out that the Social Security Administration doesn't utilize true randomization to create serial numbers. For example, a graph plotting the numbers issued to Oregon residents in 1996, shown below, shows bands that cluster around certain numbers. In fact, there are five discernable lines.  A truly random issue would show dots scattered throughout the chart.

The pattern inside SSNs

Random

With additional analysis, Acquisti said, the researchers were able to discern that the serial numbers are issued sequentially, in a way that ties them to the holder's birth date.

"The SSA believes that scheme is so complex that it's sufficiently random," he said. "We show it is way less random than apparently they believe.”  As a result, instead of a the four digits yielding a 1 in 10,000 chance in guessing SSNs, he said he can improve the odds to at least 1 in 1,000, and in some cases, far less than that.

The Social Security Administration seems to agree with Acquisti on this issue. In its statement to msnbc.com, the agency said that “for reasons unrelated to this report, the agency has been developing a system to randomly assign SSNs. This system will be in place next year.”

Birth dates easy to obtain

For now, an attacker who wanted to guess someone's SSN would still need a birthday and hometown, but these data points are readily available from a number of sources. Many people volunteer such information on social networking sites like Facebook. Voter registration lists and other public databases also include such information, and it is often available for a small charge (or free) from data brokers that operate on the Internet.

There are additional challenges in guessing SSNs for residents born before 1988, because many older Americans did not receive a Social Security number at birth -- so their hometown and their Social Security number application zip code might differ.  But beginning that year -- in a move ironically intended to combat fraud -- the Social Security Administration began forcing many families to order SSNs at birth,  thereby eliminating one more element of chance for a would be SSN-guesser. It’s far easier to guess SSNs for anyone born in 1988 or later, Acquisti said.

The formula for issuing the numbers is, in fact, not designed to withstand attacks from cryptography experts or mathematicians.   It was invented in 1936 as a simple numbering system for paper file cabinets.

"This was before there were computers," Acquisti  said. "SSNs were never designed for the purpose we use them."

The group is not disclosing the precise formula, because doing so would be akin to publishing the list of all Social Security numbers.  But Acquisti said one “provocative” strategy that government officials might take: Setting a date in the future -- perhaps in three to five years -- where all SSNs are made public, so companies and government agencies stop using SSNs for security purposes.

He called current efforts to protect Social Security numbers from public view "well intentioned, but misguided.”

The researchers recommend that the Social Security Administration immediately implement a much more random formula for generation SSNs. But that won’t  help the millions of Americans whose SSNs are now easily guessable.  For that, there is only one answer, the report says:

Industry and policy-makers may need, instead, to finally reassess our perilous reliance on SSNs for authentication and on consumers’ impossible duty to protect them,” it said.

MAIN PAGE NEXT POST Family turns to Facebook when son disappears

Email this EMAIL THIS

242 COMMENTS

I disagree about putting a chip in your hand or forehead for identification. That is prophecied in the Bible as the Mark of the Beast and all who take it will have a free ticket to hell. Read the Bible

Oh, and I forgot about the fact that my cousins have both had problems with their credit reports because their SSN's are so close and they share the same initials. Both have had the others accounts on their report at one time or another.

It's not just twins SSN's that are sequential. My cousin didn't get a SSN until he was 3, when his sister was born. My aunt and uncle submitted the paperwork at the same time. They're number's are sequential as well.

I know people will ask how I know the information I mentioned on the last post. 1.) My late Uncle was a twenty year vet of the U.S. Department of treasury, Bureau of ATF, Chicago office. 2.) The neighborhood I use to reside in in Chicago had quite a few creative criminal types whom taught me the rope. I personally never employed these criminal practices as a kid, but one has to realize that when you live in a neighborhood and goes through grade school and high school one gets to know, play on the same little league teams and become life long friends with these individuals, so from time to time one is given instructions on how to cut corners on the proverbial system. Now I am aware that I included the word bill twice, and that was my mistake. But yes to the average jane or joe as my hood friends would call the average person, the Social Security Card is rather harmless and virtually worthless. But to the professional criminal that card is virtual money in the bank.

I agree with everyone who says that SSNs should NOT be used for credit etc. I know that's not the only thing ID thieves use to "get" us, but why on Earth aren't we making it a bit tougher - no one would WANT my identity, but I still worry because so many things are tied to my SSN, like my credit report and rent record.

This is hardly a secret - in fact, my high school statistics teacher demonstrated this every semester with the first 5 digits of her (dead) sister's social security number and offered to guess any student's first five digits. She was right most of the time. Also, people who have multiple births figure that out pretty quickly, too.

Again, the problem with the SSN is that 1) private agencies are using it as identification, and 2) really thinking that it's a "secret" number. 1 is illegal in certain circumstances (my university had to move to non-SSN IDs three years ago), but 2 is what makes 1 a problem.

Perhaps organizations that want a "secret" number should issue it themselves. High school students could receive a number that would be theirs all in all educational situations. Banks could create some more-random number (specifically meant to be kept very secret) for transaction purposes.

Honestly, my Kroger card is probably the most secret number I have. Let's hope the grocery stores don't need a bailout... :)

Quoting Shelley:

"How is this research? I went to a State university from 1987-91. At that time, grades were posted in public by SSN. For almost everyone, the first 5 numbers were very similar. Of course, we were all born in that state within a few yrs of each other! It was so obvious who the "out-of-staters" were because their numbers were so different. I've since lived in several different states and worked in education. If I see certain SSN digits, I could tell you at least what state someone was born. It AIN'T rocket science!"
--------------------

That's the whole point... it should be rocket science. I hope our's are a little more random....

Washington Mutual Savings (now Chase) required me to enter a 4 digit PIN to do banking by phone (check by balance, transfer money, etc). They would not allow me to choose my 4 digit pin because "people do not choose secure numbers". Instead, they set everyone's PIN to the last 4 of their SSN, because that was "a secure number that nobody would know" but me. I asked them to change it because my ex-wife knew my SSN and was accessing my account. They told me that it was my fault for letting her know this "confidential" information. They didn't seem to understand that the courts require that we provide each other our SSN. It's this kind of thinking that the researchers are trying to stop. BTW, I closed my accounts there--it was the only way to stop her from accessing my bank accounts.

SSN shouldn't be used for identification other than your entitlement for social security services, like e.g. Europe. It's hair-raising to me how much unsecured SSN's are in all kinds of businesses/authorities.

My DH's ss# is one digit different than his younger brother. The younger brother has the same initials (CC LAST NAME) as me. When we first bought our house 11 years ago, his brother's info showed up on our credit report. Because he was married, his wife's info showed up as well. The whole system needs to be more randomized.

The Social Security number is basically worthless, that is true. But if a person whom wants to change his identity, or use another persons identity, can basically apply for a social security card using a name off a tombstone in a cemetery from a dead person and that persons personal information from that individuals death certificate, also easy to obtain from any City, Town or village hall. Once an individual obtains that information and a social security card, to obtain the other forms of identification are basically a cake walk from that point onward. So to inform a great many out on this forum; yes to obtain another persons social security card is crucial to identity theft or to changing your identity all together. So I can see the credence in this article, yet without the basic knowledge on how the system operates it can be rather difficult for the average person. I resided in some States were in order to obtain a drivers license, one only needed a social security card and a utility and or phone bill bill as identification.
I am utterly surprised at the ease of obtaining a social security card and the intial data from the Government, and yes if done correctly one can virtually steal another persons identity and run amuck with that information.
I believe that the government should re-think the process of social security card issue by making these cards more durable and water proof, and with security devices included on the card itself. The one method I personally would use would be through thumb print scanning of the holders right and left thumbs inorder to lower the prospects of fraud and ID theft. Yet will the government go that route? The Social Security agency can istall these types of security devices at City, Town and Village halls, Police Departments, Currency Exchanges, Banks and other public and private institutions with ease. But will they figure that issue out is another question we must ask ourselves.

My ssn was my military # (on my dogtags), my university number and even the fishing license in my state is based on my SSN!

Sequential SS numbers are a DEAD(LY) giveaway in the Federal Witness Protection Program. I would want SS numbers that matched my legend (fake biography).

All it takes to break this ID system is ONE Billion Dollar Law Suite for gross negligence in documentation of identity. Then the fat will be in the fire and things will change- FAST!

Credit Bureaus need to be sued for slander and liable in semi-public documents whenever they put the activities of two different people of similar names in the same file, slandering one to the benefit of the other, for the profit of the credit bureau.

Everybody is aware of fraud, so, why on earth do you give anyone other than Social Security, your employer or the IRS your social security number in the first place? A doctor, dentist or what or who ever else does not get or need my numbers. I thought they are supposed to be private numbers, so, just refuse to give them. What are they going to do without them, not treat you for a tooth ache etc??? The telephone works just as good, whether your phone company has your SSN or not..., funny, huh? And I could go on and on about it.

I had 4 kids, 3 born pre-88, one after. Didn't get them ssn until hubby was injured and we had to go on AFDC; applied for all four on same day, and all four differ by exactly one digit - the last one. Yeah, random riiiight...

Did you also know that your Medicare ID that must be shown before any medical care is given is your social security number plus one letter? This is a government issued card that is your only proof of Medicare coverage.

Amazing. I remember when I was in the Marine Corps we all had serial numbers. Those were determined by what side of the Mississippi river you enlisted from and when you enlisted or in the case of the Army drafted. At any rate that number was never secret. It was easily found on a person's equipment or elsewhere. No problem. Then, after I was discharged they went to using social security numbers instead of issuing a new serial number. I pity those guys because that number is all over the place.

Great move! As soon as you find out a way to make Criminals life easier, and put good guys at a disadvantage, publish it everywhere and present it at a hackers convention. The worst thing about the technology and information explosion is the amoral attitude of "if you can, you should".

yes very disturbing, me and my children have been here for 10 years from england, one of my kids has dual nationality, my other 3 have 1 didgit away from my SSN, hthe "american" ones ssn is COMPLETLEY different, im talking about the 4 of us have ONE number that is different in our SSN, dumb??

Hey Kyle,

What makes you think this article is ignorant? As others have observed, the fact that your SSN is tied to the date and your location at the time it was issued has been obvious to many of us for a long time.

Lately, I have found it funny that credit card companies have been "protecting" us by only using the last four digits of our numbers -- how is it more secure to only required 4 digits for ID? The whole system is crazy. In the original SS law, it stated that you could not be forced to use your SSN for anything not related to govt/taxes, so that they would not become de facto IDs. How about we get new numbers and go back to that???

What I'd like to know is WHY did they publish the research and now they are going to tell everyone how to track SSN's? That seems to me rather stupid giving the information to identity thieves on how to retrieve SSN's.

When my Mom sent in mine and my siblings' applications for a SS#s we got back sequential numbers.

Social Security is broke so a number don't mean much anyhow.

Makes me kind of glad to be an old sucker. When I was born, we didn't have numbers... just animal pictures and a distinctive tattoo in the middle of our foreheads.

Ok, I have been temporaily disabled. When my disabillity benefits ran out I had to apply for DSS.
They gave me a temporary card. Someone stole my card from my mailbox, called the number on the back and identified themselves as me with my SSN, changed my password,and stole my benefits. All before I knew I had been approved. Cops have video tape of people using my card. I do not know them and they were not relatives. I can do nothing to get my benefits back. How did they get my SSN ?

About ten (10) years ago I guessed what the majority of my families SSN without their birthdates. Suprised?

"This article is ignorant, and was likely created to insight (sic) fear in order to inspire radical change that profiteering politicians can take advantage (sic)." -- Kyle Blake.

Why not just admit it's over your head and you don't understand it instead of giving in to paranoia? I'm in my sixties and can remember that, when I got my SSN at the age of 13, the card specifically stated that it was not intended to be used for identification. I don't know when that changed, but when it did, THAT, my friend, was a flag that nobody stood up and complained about. Now, here we are. Some states use the SSN as the ID number on their drivers' licenses and universities have used them in lieu of student ID numbers. Absolutely asking for trouble.

OK, let me restate what a few of cooler heads here are saying.

The problem isn't the fact that the SSN is being used by everyone as an identifying number, the problem is that companies are being too cheap and/or lazy to make people prove that the number is theirs, and are instead saying "Gee, if you know a number that long, it MUST be yours."

SSN's weren't designed to be secret identifiers, and it's unfair for the cedit industry to try to force them into being that.If the credit industry needs a way to positively identify people, they need to come up with their own system, instead of claiming that a public numbering system is in any way a secure method of ID, or that they haven't known that from the start.

Government conspiricy? NO! Credit Industry conspiricy? Maybe so.

Yeah well I can figure out your SSN just by your Name, Location and the time/date you posted on this thread! Thanks for all the SSN!

Random,my a$$. My sister and I got ours at the same time and there is only one digit different between the two.

If someone immigrated to USA and land initially at NYC and apply SS # there after 3 months he moved to Arizona. What a heck people will know what is my first 3 numbers and group of I belong and where I was born at Planet or Mar ? Before 1995 it was wide spread initial with name and full SS # in every corporate office. It may still be in company vaulet and who knows someday somebody might have easily access.

My concern deals primarily with how the banks and credit bureaus are using this information. Knowing a person's sex and race based on their SSN may make it harder for some individuals to get credit. I think its just another way to racially profile individuals.

Ha! Just another scam. If identity theft occurred as often as the industry claims, we would all have lost our identity several time over by now! I haven't used virus protection on my computers for over 30 years now and I'm still not a victim. I've been passing out my social security number for much longer than that too. This fear mongering is just more of the same. Big deal I claim!

Saddest part of it all is all those who worry about this stuff. If they want to screw you the holes were put there on purpose just so they can screw you. The Corporations that own you will use you again and again however they please and all you can do is sequel like a pig and writhe around comically.

My brother and I are twins and our SSN are sequential. Also, when I got to my first duty station in the Air Force, our squadron clerk could tell our age and state using the first 3 digits of your SSN. He was right most of the time, I would more than 90%, but I don't have the numbers to back it up. I even remember a time when he told a girl she was from North Carolina and she told him he was wrong. A couple days later, she admited that he was correct because she was born at Fort Brag but her family moved to California soon after she was born.

To the MSFT geek in Bellevue who suggested that SSN's be replaced with public key/private key cryptography: The idea of using public-key/private-key cryptography for everyone sounds good in principle, but it would not at all be practical. To be effective, both keys would have to be very large, which means people would not be able to memorize their keys, and even if they did, it could take a very long time to enter a 2KB key. The alternative would be to issue smart cards to everyone that have the keys imbedded, but then when someone is on the phone with their bank's customer service, how would they go about using their smart card to prove who they are. And what about all of the people who would lose their cards? Stick to programming, dude.

there is a really easy way to keep people from stealing your identity:
make it worthless
i dont make much money,and its gone as soon as i get it,i have no credit because i dont use credit,never will,and i dont own anything with any equity value....if someone stole my ssn and,say,tried to get a credit card or a loan,they would be laughed at,and if they get into my bank account,they can enjoy the $15

What are the odds of this happening??? I'm two months older than my wife. We were born in different counties and raised in different villages. My wife and I have the exact same Social Security numbers except for the last digit. The last digit of mine is 6 and hers is 7

Hey Richard C., you should post your SSN on this article just to prove how worthless it is. Or maybe it will show you just how easy it would be to steal an identity?

Yep---they know what kind of toothpaste, likes, dislikes, buying habits etc.---its probably all in the Master Computor in Europe.

in pittsburgh, I went to UPMC hospital for test and they put a wrist band on me and when I left and was taking it off I noticed it had my birth date and s,s number and full name. I cut it up in pieces,When I asked about it, they said that is their policy.

Wow. This is scary. For as much effort companies and the government put in to try to keep this secure, this is really bad. Its time to come up with a new system.

Having been born before a lot of posters, I can say that the SSN has taken on much more importance since the computer era.
When I enlisted in the Air Force, we were given an 8 digit "Service Number". A few years later, the government decided that each GI had a unique SSN and changed to that number for identification. Hence that number was on every ID record for the military. Millions of GIs had their SSN out there for all to see. They had to put it on their personel checks, all correspondence and every piece of paper they filled out.
Today it is still required for so much paperwork. Except that with it's importance in identification it is easier to steal and use for illegal gains.
One of the problems this article points out is the ease with which numbers can be figured out.
Look at the odds. A 9 digit number has only 1 billion combinations. The population of the US is what, 350 million? That leaves 750 million numbers left to issue.
But wait! How many of those 750 mil are numbers issued to people who have died?? Looks like that number has dwindled quite a bit.
At what point does the SS Administration begin to use these numbers from deceased Americans?
Imagine getting one of these numbers at birth and then many years later applying for benefits and being turned down because you died 100 years ago!
Perhaps it's time to go to a 12 digit number. Just as well do it now. The numbers will surely run out soon.
This situation also might give reason to go to a national identy card. With a very unique ID code of 12 or so digits with a 7 or 8 digit PIN number.
As computers get faster and more sophisticated, cracking codes will only getn easier. The government needs to seriously take a look at where computers and hackers are going in the future.
Myself, I probably won't be around long enough to worry about thia CRAP!

maybe some one said this already but they are wrong SSN aren't tied to your birth date but rather to the date they were issued, its just that most people are issued one when they are born, if however you are born at home and not in the hospital your parents don't have to apply for a ssn until you are 5 yrs old, then a total dif number. In my case I believe my mother applied for all of our numbers at the same time, hence me and my two older brothers only differ by the last two digets each, very confusing actually my mother routinely mixed them up on forms, and very not random.

How about giving your SSN to your doctor, dentist, and health insurance co. - I don't want my health info out there in the name of "keeping me safe".

Several years ago I applied for a job and I was told I got the job and I was asked to fill out a W-2 form so tax’s could be taken out. Then I was told I did not get the job after all. Ten years later I went to college and after finishing a class I went to the registrars office and asked for a copy of my transcripts. The registrar asked me for my name and social security number and punched it into their computer and then they asked me if I had attended a class several years ago and I told then no this was the first class I had taken at the school. The registrar then removed the old transcript record and entered my class info into the transcript record and gave me a copy of my transcripts. I registered for another class and one day I was harassed by the teacher and sent to see the dean and then questioned about my identity. Then I was then sent to see another dean and I was asked to attend a school hearing and then I was suspended for the duration of the class.

It is rather obvious to anybody in the know that 'they' are trying to instill fear into people. They have been talking for years about the application of a 'universal' identification system. Biometrics or other means maybe within 10 years if not sooner. Big Brother wants you, and wants to know where you are at all times.

One HAS to give ones SSN to get satalite TV in my state, what a joke...how do the illegals get satalite TV?

The government originally stated that the SSN would not be a means of identification, but currently a multitude of U.S. entities use the Social Security number as a personal identifier. These include government agencies such as the Internal Revenue Service, as well as private agencies such as banks, colleges and universities, health insurance companies, and employers.

The Social Security Administration admits that the Social Security Act does not require a person to have a Social Security Number to live and work in the United States, nor does it require an SSN simply for the purpose of having one.[71]

The Privacy Act of 1974 was in part intended to limit usage of the Social Security number as a means of identification. Paragraph (1) of subsection (a) of section 7 of the Privacy Act, an uncodified provision, states in part:

what? oh no!!! were all doomed the goverment really messed this one up. Oh wait they screw up everything.

They are just figuring this out now? I noticed that pattern when I was 10.

well im sure there is a law on the books that says the ssn is only to be used for social security department and the IRS. The problem is companies are taking advantage of the loss of jobs and now require use of the ssn online in the application. Now thats wrong and there should be a law on the books that just needs to be enforced so you do not have to use it (ssn). period except ssa and irs.but now the cats out the bag how do you put it back.

I agree with most of the complaints here and am under no illusion that SSN's are secret. I just think my own story has always been kind of funny.. My 1st husband and my current husband are the same age and born in the same town. I had my 1st Hubby's # memorized and when I got married again I laughed out loud that my current hubby's # is almost identical. I have to really think about it when doing taxes or using it as a bank or other stupid company's identifier. I have given the wrong one before and had to apologize.."Oh sorry, that's my other husband's number".

We should start a petition, get a bunch of people to sign it, then sent it to Congress

I'm still trying to find out why I can't laminate my Social Security card!

How about the idea that your dentist, doctor and health insurance company require you SSN - how safe is your health information? Want to share those details with everyone?

To Connie L. Tucson, Az.
You would receive a social security number from the state you lived in when your parents applied for the number. Same for your husband.

People; if you were born in a hospital in the US after 1988 your social security number was probably given to you by enumeration, an electronic process that generates your number. This is done by where your application was filed not necessarily where you were born. This is done by the hospital records keeper usually unless you say you want to do it on your own. Since most hospitals send it to thier closest office as required everybody gets the same first digits. As in a case where it does not corrispond to the place of birth it is usually because you were born overseas or your application was sent to a field office out of the hospitals area.

Looks like some wrist slapping at the SSA for not making this system better. Seems to me their intention was never to provide free crack-resistant passwords to every citizen. That was our choice. So the shame, if any, falls on our shoulders, not theirs.

yeah this is nothing new...actually people in the military knew this stuff a long time ago.. way to go Carnegie-Mellon University...

These people have way too much time on their hands. Lets put it to good use please?

I'm a twin, and while I don't remember my other half's SSN, I can tell you that they're not sequential. Then again, we were also born before 1988.

As far as issuing the numbers goes, I know that it's hard as hell to generate truly random sets of numbers. On top of that, the lists can't be anything more than quasi-random, anyway, since pure randomness leaves open the possibility of repeat numbers. It's not government incompetence but simply the nature of how these things are generated, and you'll eventually get the same problem no matter what means you use.

As far as the people claiming that they shouldn't have published this research, those would probably be the same people crying that they should've known about the risk after some criminal entity discovered and used that knowledge later on. The article clearly says that they didn't publish the formula, so the burden is still, as it always was, on the thieves to find the algorithm.

Interesting, my 4 children born same place, different years first 3 digits are nothing alike, no numerical connection, and next 6 very different.

SS Cards should be plastic, hologramed and photographed just like a drivers license, with everyones photo on file anyway. It shouldn't be the citizens problem to protect our information any more than our driving record. I agree with the author, if everyone's # was common knowledge rather than our inconvenience to constantly safeguard it, we could use it for positive ID like engraving it on personal items etc. Credit Cards put our pics in the cards as well as the hologram. Keep separate from SS#.

Oh, yes, VA used SS#'s for driver's licenses for years.

I figured this out a while ago, when four of our five children needed
ss#'s following the requirement for everyone to have an ss#. I also
noticed over the years the areas from which my friends were born and
their numbers. This isn't rocket science.

I go to a small school, and honestly, 30% (yes, seriously) of my class was born in the same month. We all have the same first five digits. For the kids who didn't realize this, it was pretty easy to trick the crap out of them when you started reciting their SSN.

I was doing the same thing in my military years without any high tech stuff. I was just backwards of what was told here. I could look at a SSN and tell you where it was issued and your approximate birth date.

To me it does not appear to be random at all, it appears to be sequential, with large blocks of numbers being issued to cover an area (like a state) then first come, first served after that.

Pretty much The same way banks issue credit cards.

I just went to the SS government site, and you can see up to date this month July of the first 5 digits issued......for each area....this has been done like this for years.

When you travel overseas they generally ask for your name, place and date of birth. Think about it. How many people with your name were born in your birth town on your date of birth. Possibly not 100% unique, but this information works well all over the planet.

I am however VERY concerned that someone can easily steal your SSN and apply for work or credit using it. Worse, this information cannot legally be disclosed to you so someone could be using your identity right now and you would never know until you applied for credit. Even then they would not tell you why you were declined as it would violate the right of the thief to privacy. Social Security Numbers should never be used for identification!

How is this research? I went to a State university from 1987-91. At that time, grades were posted in public by SSN. For almost everyone, the first 5 numbers were very similar. Of course, we were all born in that state within a few yrs of each other! It was so obvious who the "out-of-staters" were because their numbers were so different. I've since lived in several different states and worked in education. If I see certain SSN digits, I could tell you at least what state someone was born. It AIN'T rocket science!

So how does this work for me? I was born in one state,heavily populated, but was adopted and did not get a SSN until 1 year later in another state. My husband was born in another country and did not get a SSN until he was in middle school in this country.

klh twins,richmond,va is correct. My twins' are sequential also.

Ticked Off and Dum Dum, Hey I'm with you. I also live in a world where "if I don't know about it then it didn't happen" ... please pull your heads out of your you know what. It's not that scary out here, really.

anybody with twins would know social security number are sequential,or maybe just mine are!what are the chances of my twins having numbers that are the same except for the last digit,one being 4,the other 5.

Your social alone is worthless. There is no such thing as identity theft at that level from computer hacks, pick pockets, trash looters, etc. The ID theft at that level is from relatives and friends. I'll drive around like other credit monitoring advertisers do with my social on a flatbed or whatever. That advertising plus the media has so many people scared...it's scary! The credit monitoring business and other credit watch sites etc. are all fueled by the media....and on top of that it's mostly the least informed technologically - the elderly - that fall for the scam. Except of course any reader of this that doesn't consider themselves elderly that has signed up for "credit monitoring".... DOLT!

This article is ignorant, and was likely created to insight fear in order to inspire radical change that profiteering politicians can take advantage.

The nature of Info Tech REQUIRES that each of us be uniquely identifiable. Technology rules man. It's the master not the servant. It has it's own needs that must be satisfied. You can no more change this than you can un-invent the computer.

Forget about a person going by state alone to figure out a SS#..you can get it to the town/county even!
My dad was born in 1919 and died 1967..his first three of SS#'s are the same as mine..his next two are only one off..last four more harder since I got my SS# 34 years after my dad was born.Yes it is easy to tell a persons SS # to me..with a few guess's!

i knew the numbers were not random when my sister and i compared ssn's when we were teenagers (my mom applied for them at the same time when we were children), and they were only one digit off--sequentially. after i worked in banking for a number of years, i noticed the pattern in the first five numbers...it's not difficult.

Most people commenting on this article are missing the point. The problem isn't that SS numbers are being used as unique identifiers (that's actually ok).

The problem is that people expect them to be secret -- known only by their owners. The result being that knowing one is taken as "proof" that you are the person with that number. Remove this false assumption, and you remove the problem. SS numbers should be public and expected to be public. Knowing one shouldn't get you access to anything.

However, even though it would be okay for SS numbers to serve as unique identifiers, they are a bad choice. For one thing, they have no check digits, so it is easy to transpose digits or misread one and still have a valid number. This leads to lots of accidental misplaced identities. A much larger number space should be used.

A better solution would be government-issued public/private key pairs. These would be cryptographically secure. Your public key would serve as your unique identifier, and you would keep your private key secret -- you could then use it (without disclosing it) to "sign" things that would prove you're the one who "owned" that public key. And since signing something wouldn't disclose the private key, the people you proved your identity to couldn't use any of the information you gave them to steal your identity.

Well in my state they never used a SS# for a drivers license..just started doing it three years ago..now thats bad idea!

It use to be a law, way back when? I don't know exactly,but it was illegal to use the social security number for anything othere than IRS, and social security! They need to return that law! Credit companies, and banks should issue seperate numbers for your credit! Stop using Social Security Numbers. Period!

I see a lot of whining about how by publishing this, we've made it too easy for criminals to figure this stuff out. I remember sitting in my high school physics class one day and the teacher was late or something, and we all started comparing, and very quickly, we all figured out that all of us had the exact same first five digits (at least, all who were born in the state) and that we saw an order or progression for the last four by age. I've always assumed everyone figured this stuff out. If a bunch of bored teens can quickly notice, I don't think this is a huge surprise to most criminals who look at this stuff "professionally"

The first three digits are the state..no brainer there..next two its from 01 to 99..never double zero's...last four all know no more then double zeros again!..Whats the odds to figure it out..not much!

Thanks for telling the criminals...

I applied for a job with SSA back in the '80s. It would of been at their check processing facility. They TOLD me how those numbers get picked and the supervisor told me where I was born and what year I got my card after telling her the first 5 numbers.

Verrrry interesting...now, let's hack BHO's SS# and see where he was born...on second thought, Somalia does not issue SS#'s, does it?

The news here is about the 4 last numbers. The first 5 numbers have been easy to figure out for years. The reports of sequencial numbering of the last 4 digits by registrants in proximity was not surprising, but what was interesting was that the last 4 could be determined easier over a larger population. Those of you who are upset by this article because you think it revealed some great hidden truths about SSNs are naive. Indenity theives have known about the first 5 for years. The last 4 could be brute-forced or pulled from your trash can off bank and credit card statements. The idiot is the one looking at you in the mirror.

For those who are saying "great job" - just so you know, this is not only "nothing new" but it is also an already understood concept. Any hacker worth their salt already knows that there is no such thing as random, and they would already be looking for clues. The article says that much, the only question is how well they disguise the pattern.

Also, they put it out to inform people. The Black Hat conference would be much like a conference of doctors getting together to help prevent disease. They talk about vulnerabilities and discuss how to prevent hackers from getting secure data.

Finally, the SSA maintains that it is sufficiently random, but it is obviously not. It was only a matter of time before someone found out, and it is much better for us to all know about it than to get sideswiped because hackers already knew this before the SSA knew. For all we know, this is and was already in the hands of people long before this.

Everyone who has read this article and is now found a new reason to hate the federal government or believe that this article is now going to somehow spark a wave of new crime, sit down, take a breath and relax.

SS's are not now, nor were they ever random and that is hardly new information. This article really doesn't point out any new "rocket science".

As far as the federal government is concerned, your SS number is used for taxation and benefits disbursement purposes. The fact that so many other institutions have latched on to this numbering system is not the government's fault, it's the fault of the institutions that thought they had found a secure way to individually identify individuals.

It's not a gian government consipiricy. It's just general stupidity.

This is old news.

This pattern has been known for a long time and was the basis of many SSN generator programs. I personally have lectured on this when discussing how to obtian information for identity theft.

By identifying the state of birth and the birth date program have been randomly generating valid SSNs for some time.

In simple terms;
The first 3 numbers are related to the state you were born in or where the SSN was issued (Now that all kids are given SSN's at birth it is 10x easier to gain this information)

The second two numbers are batch numbers based on you date of birth

The last four numbers are supposed random generations but for years people have shown they are uniquely sequential.

With all this said I agree that SSN's need to not be used as identifiers.

The other option is to make them truly unique by having the number no longer tied to any specific pattern.

Why do SSN's need to be linked to your state of birth and your date of birth?

Thanks MSNBC for giving away my SSN

I think the best unique identifier would be either a mark on the forehead or the hand....or perhaps just a retinal scan(close to the forehead} or a fingerprint encoded onto an I.D. Just a thought....

I don't give my SSN to anyone other than the IRS whom is was intended for. companies don't like it but when I ask them for theirs they understand a little more. next time you are requested to give out you SSN Ask the caller of person behind the counter for theirs as well. giving out your SS identity to everyone who asks for it is CRAZZZZZZY. Stop doing it.

The idea that the federal government has a real interest in discouraging the use of SSNs for identification is naieve. This, despite the federal law.

The truth is, the federal government itself has a strong interest in using SSNs for identification purposes far beyond Social Security and taxation. It keys the number to your passport, and is going to begin keying it to your PNR when you travel via air!

The federal government wants credit reports and associated data mining done in the private sector to be unique and tied to a single individual, by SSN, because it plans to correlate this data to your identity in its own national security efforts.
And it wants to tie your state driver's license into a national database, by SSN, as well (see REAL ID Act.)

Plus, powerful lobbies in banking, lending, credit, and insurance rely on the SSN to store, share, and mine data about you. They need a national identity number in order to be able to do so uniquely.

SO-- while it is laudable to suggest that SSNs become public, so as to force the public the private sectors from abusing them and using them as an identity number, that would never happen. Both government and major business interests want such an identity scheme to continue and expand.


I think this is highly credible.

A friend and I went together to get our SSNs. Though we lived in Ohio, it was easier to cross over to West Virginia and get them there. Cards issued in West Virginia, in those days, started with 236- As did my Mother's issued years before, also in West Virginia.

And at the same time we were applying, there was a girl doing the same, so her number is in between ours, with mine ending in 80 and my friend's in 78. She got 79. What's the government's explanation of how that is complex and scientific, I wonder?

When I was in training for a county job in 1969, a Social Security employee gave a talk on the numbers so we could spot a phony: Fist 3 digits is region of SSA office, middle 2 digits (at that time) were odd numbers from 01-09, even numbers from 10-98, and the last four were sequential. Until they ran out of numbers the very first digit was 0 to 5 for most people, and 7 for railroad employees. When they ran out of numbers they started issuing numbers starting with 6. First number of 8 was phony, and 9 was a temporary number (usually immigrants).

If nobody else had figured this out, obviously somebody else will now that the discovering geniuses have gone public. They traded everyone's social security number security for their publicity. Thanks guys.

I hope their SSNs are the first to be stolen.

Your SSN is on file with a blood bank if you have donated. I refused to give my number about three years ago and offered my driver's license instead. The blood bank worker said it did not matter anyway as they were on file from a previous donation and the government required them to ID the blood that way. I wonder how secure their records are?

SEND A COMMENT

PLEASE READ: All comments must be approved before appearing in the thread; time and space constraints prevent all comments from appearing. We will only approve comments that are directly related to the blog, use appropriate language and are not attacking the comments of others. Firms mentioned in our comment area are welcome to add their own comments.

Message (please, no HTML tags. Web addresses will be hyperlinked):

TRACKBACKS

Trackbacks are links to weblogs that reference this post. Like comments, trackbacks do no appear until approved by us. The trackback URL for this post is: http://www.typepad.com/services/trackback/6a00d83451b0aa69e2011570d7425a970c

BUY BOB SULLIVAN'S BOOK

Cover_crunched_by_media Bob Sullivan's new book unmasks hundreds of hidden fees and offers step-by-step instructions on how to fight back. Order it here.

Or Pre-order Bob's new book, Stop Getting Ripped Off: , coming Dec. 29.

Bob Sullivan