Posted: Tuesday, October 7, 2008 12:00 am
The latest report on the latest mistaken release of Social Security numbers came out a few days ago, and while audits go only so far in suggesting solutions, it is yet surprising and disturbing that with the state's history of problems, no one has mentioned the obvious, simple solutions.
The legislative audit concerned a printing error which allowed the numbers of some 5,000 people to appear in full view on a state mailing. The error went unnoticed by contract workers, and the audit recommended that future contracts include provisions for damages because the current contract does not.
Damages don't prevent the risk of identity theft, however, and it is this which should be the focus of state efforts. Specifically there should be two actions: First, there should be no requirement from any agency of any government that Social Security numbers be printed in full on any document mailed out. Second, anyone revealing such numbers should pay for the best possible remedy.
Take the first point first. Credit card receipts show only the last four digits of your card number, and even your credit card company doesn't print your number in full on bills just in case someone intercepts your mail. Those four digits are enough to tell you it's your credit card receipt, and the same applies to a document with your name, address, and the last four digits of your Social Security number. It would be a simple fix for the state to reprogram its computers to do the same; anytime a number is printed, only the last four digits appear.
The state's own Office of Privacy Protection, in reporting on the accidental release of numbers, noted that the Social Security Administration requires numbers to be printed on certain statements. This would be the same Social Security Administration which has an Internet page lauding states for enacting new protections against the release of Social Security numbers. What we obviously need is a change of rules so that the full number is not required to appear anywhere on a mailing. Curiously illustrating the lack of legal synchronization is Wisconsin's voter registration law which specifies that registration forms will collect only the last four digits of a person's Social Security number.
Then there is the question of damages. The state will have to pay because of this problem. It has to notify people, which equals postage and printing costs, and it will provide free credit monitoring for a year. Commercial services which do this cost $9 to $15 per month, which even at the lower number equals about a half-million bucks for this single incident. Contractor EDS settled with the state for $250,000 for the mistaken printing.
There is more that the state could do. It could pay for and encourage a credit security freeze. State law allows consumers to do this, and what it does is forbid credit reporting firms from releasing any data without prior approval from the consumer. There's a fee, of course, but by stopping the release of information short-circuits the ability of an identity thief to open other accounts using a victim's name.
Identity theft is not a simple problem, but in this case there is a fairly simple solution. And even though one can accept the idea that human mistakes will always cause problems, there is no excuse if state officials fail to act. day revolves around baseball.