Social Security IDing: A Bloody Mess

Last week a notebook -- containing information on 268,000 blood donors -- was stolen from a Minnesota blood drive. The data included names, addresses, blood types and, of course, Social Security numbers. The police suspect it was a random act, and not one committed with the express intent of getting the personal data. Still, it's one just more case of data privacy woes that could be avoided if companies stopped using Social Security numbers to identify customers.

Stolen SS numbers have contributed to untold numbers of identity and credit thefts, in some cases leaving the victim responsible to clean up the mess (often unsuccessfully). With mobile computing, customer information has become more vulnerable than ever. Encryption and diligence hasn't helped thus far -- the crack hackers can bang through the passwords and clearly our eyes can't be on these devices 24/7. Other than having notebooks handcuffed to users or banning their use, what can we do?

For one thing, eliminating Social Security numbers as a means of customer identification would be a step in the right direction. Over at the Privacy Journal, Robert Ellis Smith offers several alternatives for companies looking for other ways of identifying customers. Why not give them a special, unique password -- for example, a series of letters and numbers that either they choose or is randomly generated for them? Now, before anyone complains about 'yet another password to remember,' keep in mind that while it requires extra work on both the company (to set it up) and the customer (to remember it), we're talking about improved identity protection. I don't know about you, but I'm all for a little inconvenience if it means there's not a fake me out there somewhere taking vacations at my expense. And as Smith points out, people have been known to inaccurately provide their Social Security number to businesses anyway. Better to have them rely on a password they've written down and tucked safely in their desk at home than rely on the ever-faulty little gray cells.

If, however, your company insists on using Social Security numbers to some degree, another option could be to use the last four digits of the customer's SS number. The digits aren't enough info for a crook to use, but coupled with additional secure information a customer could provide, it's a sufficient way to identify them.

More and more, people are questioning companies that ask for their Social Security numbers. Why not pleasantly surprise your customers with a new alternative to identifying them and protecting their records?

UPDATE (12/30/07):

stumbled upon this new white paper, "Privacy, Public Access & Policymaking in State Redaction Practices," which offers advice on how to develop policies for removing Social Security numbers and other sensitive information from public documents.