"He had been kicked in the head when young and believed everything he read in the Sunday Papers. "
George Ade, Fables in Slang: The Slim Girl

VII The Social Security Number as a Standard Universal Identifier

Our charter commissioned us to analyze policy and practice relative to the issuance and use of the Social Security number, including prohibitions, restrictions, conditions, or other qualifications on the issuance and use of the number which now exist, or might be imposed to help implement whatever safeguards for automated personal data systems we might recommend.

This particular aspect of our charge stems from growing public concern that the Social Security number will become a standard universal identifier used by all manner of organizations and data systems to establish the identity of individuals, to link records about them, and generally to keep track of them from cradle to grave. This concern also led to the establishment of the Social Security Number Task Force in February 1970, and was reflected in former HEW Secretary Elliot L. Richardson's testimony, in March 1971, before the U.S. Senate Subcommittee on Constitutional Rights, chaired by Senator Sam J. Ervin, Jr.¹

Why do these concerns exist? Are they reasonable? What can be done about them? To answer these questions we must first understand something about identifiers in general and the nature and implications of a standard universal identifier in particular.

There are many kinds of personal identifiers. A person's name is an identifier, the most ancient of all, but is not a reliable one, since often it is neither unique nor permanent. Even unusual names may be widely shared, and because of family patterns identical ones are often concentrated in particular localities. Some names change when people marry or divorce, and when children are adopted. Some people are known by different names in different social settings; e.g., itinerants, persons with aliases, and married women who use a maiden name professionally.

To compensate for the unreliability of names as personal identifiers, additional schemes of identification have been devised. These commonly take the form of numeric or alpha-numeric labels that provide the uniqueness and permanence names customarily lack. The reliability thereby achieved is important to record-keeping systems in order to assure accuracy in merging and updating data to be stored about individuals. Usually such labels are established for a single system, but in some instances, a single one may be used in more than one system; for example, in all the record-keeping systems of an organization that maintains different sets of records on a given group of people. If one label is used by separate organizations, such as the Social Security number is for the taxpayer's identification number, a driver's license number, and a school student number, that label may be on its way to becoming a de facto universal identifier.

Criteria for a Standard Universal Identifier

A standard universal identifier (SUI) is a systematically assigned label that, theoretically at least, distinguishes a person from all others. If the labels assigned by a universal identification scheme are to fulfill this function, each SUI must meet all the following criteria:

UNIQUENESS. It must be unique for each person. No more than one person can be assigned the same SUI, and each person must have no more than one SUI.

PERMANENCE. It must not change during the life of an individual and should not be re-used after his death until all records concerning him have been retired.

UBIQUITY. Labels must be issued to the entire population for which unique identification is required.

AVAILABILITY. It must be readily obtainable or verifiable by anyone who needs it, and quickly and conveniently regainable in case it is lost or forgotten.

INDISPENSABILITY. It must be supported by incentives or penalties so that each person will remember his SUI and report it correctly; otherwise systems will become clogged with errors.

ARBITRARINESS. It must not contain any information. If it does, e.g., State of issuance, it will be longer than necessary, thus violating the "brevity" criterion (see below). It may also violate the "permanence" criterion if changeable items, such as name or address, are incorporated. Most important, if items of personal information are part of an SUI, they will be automatically disseminated whenever the SUI is used; in our view, this would be undesirable.

BREVITY. It must be as short as possible for efficiency in recognition, retrieval, and processing by man or machine.

RELIABILITY. It must be constructed with a feature that detects errors of transcription or communication.² If the communication of SUIs were done entirely by machine, errors could be minimized through technology, but short of this, there must be protection against the risk of human error in writing or reciting an SUI. For the foreseeable future, the need will continue for people to fill out forms and to report information themselves.

Implications of a Standard Universal Identifier

The advantages of a standard universal identifier, as seen by its proponents, are easier and more accurate updating, merging, and linking of records about individuals for administrative, statistical, and research purposes. According to them, duplication and error in record keeping would be reduced. Individuals, moreover, would be relieved of the need to use many different identifying numbers; an SUI might supplant credit card numbers, personal checking account numbers, driver license numbers, and many other identifiers.

In spite of these practical advantages, the idea of an SUI is objectionable to many Americans. Even in some European countries where SUIs were introduced without opposition a generation or more ago, their use has recently raised fears and anxieties in the population. Many people both feel a sense of alienation from their social institutions and resent the dehumanizing effects of a highly mechanized civilization. Every characteristic of an SUI heightens such emotions.

• The bureaucratic apparatus needed to assign and administer an SUI would represent another imposition of government control on an already heavily burdened citizenry.
• To realize all the supposed benefits of an SUI, mandatory personal identity cards would have to be presented whenever called for. Loss or theft of an SUI card would cause serious inconvenience, and the mere threat of official confiscation would be a powerful weapon of intimidation.
• The national population register that an SUI implies could serve as the skeleton for a national dossier system to maintain information on every citizen from cradle to grave.
• An unchangeable SUI used everywhere would make it much easier for an individual to be traced, and his behavior monitored and controlled, through the records maintained about him by a wide range of different institutions.
• A permanent SUI issued at birth could create an incentive for institutions to pool or link their records, thereby making it possible to bring a lifetime of information to bear on any decision about a given individual. American culture is rich in the belief that an individual can pull up stakes and make a fresh start, but a universally identified man might become a prisoner of his recorded past.

This Committee believes that fear of a standard universal identifier is justified. Although we are not opposed to the concept of an SUI in the abstract, we believe that, in practice, the dangers inherent in establishing an SUIwithout legal and social safeguards against the abuse of automated personal data systems-far outweigh any of its practical benefits. Therefore, we take the position that a standard universal identifier should not be established in the United States now or in the foreseeable future.³ The question can surely be re-examined after there has been sufficient experience with the safeguards proposed in this report to evaluate their effectiveness.

The Social Security Number (SSN) as an SUI

But is it not too late to oppose a standard universal identifier? Is not the SSN already a de facto SUI? To answer these questions, we must first measure the SSN against the criteria for an SUI given above.

UNIQUENESS. The SSN is not a unique label. More than 4.2 million people, by the Social Security Administration's own estimates, have two or more SSNs. More serious, although much less prevalent, are the instances in which more than one person has been issued or uses the same SSN.⁴

PERMANENCE. The SSN is, in almost all cases, permanent for an individual throughout his life.

UBIQUITY. The SSN is nearly universal for adult Americans, much less so for those of high-school age and below.

AVAILABILITY. The SSN of an individual is readily verifiable by the Social Security Administration for some users, and not at all for others. It is regainable from the Social Security Administration by persons who have lost their cards and forgotten their numbers, but not immediately. An individual's SSN, however, is increasingly ascertainable from many sources other than the Social Security Administration.

INDISPENSABILITY. The incentives and requirements to report one's SSN correctly are growing, though in some contexts there are incentives to omit or falsify the number.

ARBITRARINESS. The SSN is not entirely arbitrary; the State of issuance is coded into the number.

BREVITY. The SSN with its nine digits is three places longer than an alpha-numeric label capable of numbering 500 million people without duplication, and two places longer than one that can accommodate 17 billion people. The SSN could therefore be shorter if it were alpha-numeric.

RELIABILITY. The SSN has no check-feature, and most randomly chosen nine-digit numbers cannot be distinguished from valid SSNs. It is thus particularly prone to undetectable errors of transcription and oral reporting.

By our definition, the SSN cannot fully qualify as an SUI; it only approximates one.

The SSN had its genesis, in accounting practice and was first known as the Social Security Account Number (SSAN). It was established to number accounts for the 26 million people with earnings from jobs covered by the Social Security Act of 1935. Income-maintenance benefits under the Act, though not payable until the retirement or death of a worker, were to be determined on the basis of his record of earnings. Each worker needed a uniquely identifiable account to which records of his earnings would be posted periodically. Since obviously many would have the same or similar names, it was decided to assign each a unique number to identify his account and assure an accurate record of earnings, which his employer would report both by name and account number.

Name and number were used because standard accounting practice had accustomed people to numbered accounts, and because the technology of the day, notably the punched card machine with its 80-column card, required a short numeric identifier for efficiently adding the records of new transactions to existing master-file records.

Nine digits were chosen to provide for future expansion. A check-feature was not provided because the technology of the day could not cope with it, and manual checking, though possible, was judged too timeconsuming to be feasible. The Social Security Administration has developed ingenious error-detection methods, and has improved them over the years to the point where it now neither needs nor desires a check- feature.⁵

Despite the deficiencies of the SSN for purposes other than those for which it was designed, its use is widespread and growing, even where its limitations are recognized. How did this come about? Why is the SSN now so widely used for purposes and in areas unrelated to the Social Security program?

History of the Social Security Number and Its Uses

The original Social Security Act (P.L.. 74-271, August 14, 1935) imposed two taxes to finance the program of retirement and survivor benefits to be administered by the Social Security Board. One was a tax as a percentage of wages imposed on employees; the second was a matching tax on employers. To finance the Federal contribution to State programs of unemployment compensation required by the same Act, a tax as a percentage of wages was imposed on employers.

Section 807 of that Act charged the Bureau of Internal Revenue in the Treasury Department with collecting all three taxes. Section 807(b) provided Such taxes shall be collected and paid in such manner . . . (either by making and filing returns, or by stamps, coupons, tickets, books, or other reasonable devices or methods necessary or helpful in securing a complete and proper collection and payment of the tax or in securing proper identification of the taxpayer), as may be prescribed by the Commissioner of Internal Revenue ....

The first mention of the SSN in a law or regulation is in a Bureau of Internal Revenue regulation of November 5, 1936 under which an identifying number, called an "account number," was to be applied for by each employee, and assigned by the Postmaster General or the Social Security Board. Each employee was directed to report his number to his employer. Employers were directed to keep records showing the name and number of each employee and to enter employee account numbers on all required tax returns. The regulation provided that "Any employee may have his account number changed at any time by applying to the Social Security Board and showing good reasons for a change. With that exception, only one account number will be assigned to an employee. "⁶

It is ironic to discover-though logical and understandable in retrospect-that the first step in the process of extending the use of the Social Security number beyond the purposes of the Social Security program was taken by the Social Security Board itself on January 15, 1937. After the Social Security Act was passed, a question arose about an account numbering system to be used by State agencies established to administer the State unemployment insurance programs. The Board decided that the Social Security number should be used for all workers insured under these programs, rather than have each State agency develop its own identification system. As a result of this decision, many workers not covered by the Social Security program received SSNs for use in State unemployment insurance programs

For some years after its inception in 1936, there was no substantial use of the SSN other than that required for the Social Security and unemployment compensation programs. Most Americans had not been issued a number, and few organizations felt the need of a numeric identifier for purposes of data processing.

Although many people are under the impression that use of the SSN for other than Social Security program purposes is forbidden by law, this is not the case and never has been. The impression may in part have arisen from the fact that, for many years, the card bearing one's Social Security Account Number. has carried the legend, "NOT FOR IDENTIFICATION." The purpose of this legend is to notify anyone to whom a card might be presented that it cannot be relied upon, by itself, as evidence of the identity of the person presenting it.

In 1943, the Civil Service Commission decided that there should be a numerical identification system for all Federal employees and proposed to the Bureau of the Budget that use of the SSN be authorized for this purpose. This led to the issuance of Executive Order 9397. That order, which is still in effect, provides in part as follows:

WHEREAS certain Federal agencies from time to time require in the administration of their activities a system of numerical identification of accounts of individual persons; and...

WHEREAS it is desirable in the interest of economy and orderly administration that the Federal Government move towards the use of a single, unduplicated numerical identification system of accounts and avoid the unnecessary establishment of additional systems;

NOW, THEREFORE, . . . it is hereby ordered as follows:

1. Hereafter any Federal department, establishment, or agency shall, whenever the head thereof finds it advisable to establish a new system of permanent account numbers pertaining to individual persons, utilize exclusively the Social Security account numbers . . . .

The order directs the Social Security Board, the predecessor agency of the Social Security Administration, to provide for the assignment of an account number to any person required by any Federal agency to have one, and to furnish the number, or the name and identifying data, pertaining to any person or account number upon request of any Federal agency using the SSAN for a numerical identification system of accounts under the order. The order also directs that

The Social Security Board and each Federal agency shall' maintain the confidential character of information relating to individuals obtained pursuant to the provisions of this Order.

Finally, the order provides for the costs of services rendered thereunder by the Social Security Board to be reimbursed by the agency receiving such services.

Most civil servants had never applied for SSNs because their employment was not covered by the Social Security Act. Since they were not being assigned numbers for Social Security program purposes, the costs had to be paid from funds appropriated for the Civil Service Commission. The Commission, however, was unable to obtain the necessary funds, and so it was not until November, 1961 that the assignment of numbers to Civil Service employees was initiated as an adjunct of the Internal Revenue Service's taxpayer identification program (see below).

The issuance of Executive Order 9397 in 1943 theoretically may have provided the basis for a change in conception of the role of the SSN. However, there is no evidence that it had any practical significance until after the 1961 decision to use the SSN as an individual identifier for Federal tax purposes. It has been suggested that Executive Order 9397 was intended to apply only to instances when Federal agencies seek to number records of financial transactions, and not to numbering other kinds of records, such as employment, attendance, performance, or medical records. The fiscal interpretation follows from the wording of the order which speaks of the efficiency to be gained from "a single . . . system of accounts . . . ." To interpret the order as applying to all kinds of Federal agency record systems is arguably beyond the meaning of its language. In any case, it appears that Federal agencies are free to use the SSN in any way they wish, and no instance has come to our attention in which the order has been invoked to compel or limit an agency's use of the SSN.

What many regard as the single most substantial impetus to use the SSN for purposes other than the Social Security program occurred in 1961, when the Internal Revenue Service, after discussions with the Social Security Administration, decided to use the SSN for taxpayer identification. This decision was implemented by an amendment to the Internal Revenue Code that authorized the Secretary of the Treasury to require each person making "a return, statement, or other document" under the Internal Revenue Code to "include such identifying number as may be prescribed for securing proper identification of such person." The Secretary was also authorized "to require such information as may be necessary to assign an identifying number to any person."⁷ The Secretary delegated his authority to the Commissioner of Internal Revenue, who has issued a number of regulations, the combined effect of which may be summarized as follows.

• The taxpayer's identification number for use by individuals (except as employers in a trade or business) is the SSN.
• The SSN for each individual taxpayer and each beneficiary of an estate or trust must be furnished on all tax returns and related statements and documents filed in connection with every tax imposed by the Internal Revenue Code. (A failure to include the number as required on a return gives rise to a civil penalty of $5, unless the failure to provide the number is due to "reasonable cause." Int. Rev. Code of 1954, Sec. 6676.)
• An individual is obliged to obtain an SSN from the Social Security Administration and furnish it when requested, for purposes of complying with Internal Revenue Service regulations, by any of the following: employers; estates and trusts; corporations and other entities paying dividends; banks, mutual savings and savings and loan institutions; insurance companies; stockbrokers and securities dealers; other entities paying interest; and nominees receiving dividends or interest.

Many other actions of the Federal government have expanded the areas of use of the SSN beyond its original purposes.

• The Treasury Department further expanded use of the SSN in 1963 by requiting its use in registration of all United States transferable and non-transferable securities other than U.S. savings bonds. The following year the requirement for such use of the SSN was applied to Series H savings bonds. The Treasury Department has announced that as of October 1, 1973, the inscriptions on Series E bonds must also include the SSN. (Meanwhile the Treasury has modified its earlier rule that the names of women on savings bond inscriptions be preceded by "Miss," "Mrs.,"or other title, by permitting omission of the title if the woman's SSN is included.)
• In a decision dated Aprll 16, 1964, the Commissioner of Social Security approved the issuance of SSNs to pupils in the ninth grade and above, if a school requests such issuance and indicates willingness to cooperate in the effort. The Social Security Administration Claims Manual explains that this decision was made (1) to accommodate requests from school systems "desiring to use the SSN for both automatic data processing and control purposes, so that the progress of pupils could be traced throughout their school lives across district, county, and State lines", and (2) because issuance of SSNs to school children in groups is more orderly, efficient, less costly to the Social Security Administration, and gives better assurance of identification of the chlldren than if students eventually apply for numbers one at a time.
• In June 1965 the Commissioner of Social Security authorized the issuance of an SSN to every recipient of State old-age assistance benefits who did not already have one, in order to establish a more efficient process for exchange of information between these agencies and the Social Security Administration. When the Social Security Act was amended in 1965, to provide hospital and medical insurance (Medicare) administered by the Social Security Administration, it became necessary for most individuals aged 65 and over who did not already have an SSN to obtain one.
• In June 1965 the Civil Service Commission began to add SSNs to the retirement records of their annuitants. This represented an extension of the SSN issuance system started in 1961 for civil service employees.
• Effective January 1, 1966, after consultation with the Social Security Administration, the Veterans Administration began using the SSN as a hospital admission number, and for other record-keeping purposes.
• On April 7, 1966, the Commissioner of Social Security approved the test usage of the SSN by the Division of Indian Health of the Public Health Service to facilitate development and maintenance of comprehensive health histories of Indians from birth to death.
• By memorandum dated January 30, 1967, the Secretary of Defense advised the Social Security Administration of his decision to use the SSN as the service number of all military personnel.
• . Pursuant to the Currency and Foreign Transactions Reporting Act (the so-called Bank Secrecy Act), P.L. 91508, October 26, 1970; 31 U.S.C. 1051-1122, the Treasury Department issued regulations in 1972 requiring banks, savings and loan associations, credit unions, and brokers and dealers in securities to obtain the SSNs of all their customers. The Act requires these financial organizations to maintain records of certain large transactions to facilitate criminal, tax, and regulatory investigations with respect to currency and foreign transactions. The SSNs of individuals required for account records under the regulations will already have been obtained in almost all cases by these financial organizations under regulations of the Internal Revenue Service governing tax reporting. A notable impact has been the requirement to furnish one's SSN to open a checking account.
• . Use of the SSN is being promoted by the National Driver Register of the U.S. Department of Transportation. Although the Department of Transportation lacks authority to require it, use of the SSN is encouraged by the Register to facilitate matching the records of reports and inquiries it receives. This has led most State motor vehicle departments to collect SSNs from all drivers, and some to shift to the SSN for their driver license identification number.
• . The Social and Rehabilitation Service of the Department of Health, Education, and Welfare has for some time been promoting the use of the SSN by States for the identification of individual applicants and beneficiaries under all welfare and social services programs.
• The Congress, in Section 137 of the Social Security Amendments of 1972,⁸ has required the Secretary of HEW to take affirmative measures to issue SSNs to the maximum extent practicable to aliens entitled to work in the United States and "to any individual who is an applicant for or recipient of benefits under any program financed in whole or in part from Federal funds including any child on whose behalf such benefits are claimed by another person." The quoted language of this requirement appears to call for the issuance of an SSN to virtually everyone in America who does not already have one, but the legislative history clearly indicates that such universal enumeration was not intended. The Senate Finance Committee had proposed a requirement of affirmative measures for the assignment of SSNs to all children at the time they first enter school, as well as to aliens and all applicants for and recipients of benefits under Federally supported programs. However, the bill was amended in conference. Instead of requiring the Secretary to take affirmative measures to enumerate children at their entrance into school, the Act makes such measures optional, but the Act retains the requirement that numbers be assigned to aliens, and to applicants and recipients of benefits. Although the legislation does not specify any uses to be made of SSNs issued pursuant to its mandate, the legislative history indicates that Congress intended them to be available for use in preventing aliens from working illegally and public assistance beneficiaries from receiving duplicate or excessive payments.

Review of the Federal actions described above (which do not by any means constitute an exhaustive list makes it clear that the Federal government itself has been in the forefront of expanding the use of the SSN. All these actions have actively promoted the tendency to depend more and more on the SSN as an identifier-of workers, taxpayers, automobile drivers, students, welfare beneficiaries, civil servants, servicemen, veterans, pensioners, and so on.

If use of the SSN as an identifier continues to expand, the incentives to link records and to broaden access to them are likely to increase. Until safeguards such as we have recommended in Chapters IV, V and VI have been implemented, and demonstrated to be effective, there can be no assurance that the consequences for individuals of such linking and accessibility will be benign. At best, individuals may be frustrated and annoyed by unwarranted exchanges of information about them. At worst, they may be threatened with denial of status and benefits without due process, since at the present time record linking and access are, in the main, accomplished without any provision for the data subject to protest, interfere, correct, comment, and, in most instances, even to know what linking of which records is taking place for what purposes.

Although few people have flatly proposed that an SUI be mandated for all Americans, there is a strong tendency for authorities in government and industry to make decisions that, taken collectively, are likely to lead to the establishment of an SUI. There is an increasing tendency for the Social Security number to be used as if it were an SUI. Even organizations selecting a single-system personal identifier are likely to choose the SSN "because it is available," or for efficiency and convenience. There are pressures on the Social Security Administration to do things that make the SSN more nearly an SUI, such as issue more SSNs than the Social Security program requires, for purposes wholly unrelated.

We believe that any action that would tend to make the SSN more nearly an SUI should be taken only if, after careful deliberation, it appears justifiable and any attendant risks can be avoided. We recommend against the adoption of any nationwide, standard, personal identification format, with or without the SSN, that would enhance the likelihood of arbitrary or uncontrolled linkage of records about people, particularly between government or government-supported automated personal data systems.⁹ What is needed is a halt to the drift toward an SUI and prompt action to establish safeguards providing legal sanctions against abuses of automated personal data systems. The recommendations in the following chapter are directed toward that end.

¹Federal Data Banks, Computers and the Bill of Rights, Hearings before the Subcommittee on Constitutional Rights of the Committee on the Judiciary, United States Senate, 92nd Congress, 1st Session, February and March 1971, Part 1, pp. 775-881. 108

² A possible error detecting feature is a number (called a check-digit) that can be derived in some way from the identification number and appended to it. For example, a check-digit may be derived by multiplying the fast digit of the identification number by 1, the second by 2, the third by 3 (and so on), summing the products of the multiplications, and extracting the digital root of their sum. The identification number 1463, handled this way, produces a check-digit of 3 (1 X 1 = 1, 2 X 4 = E, 3 X 6 = 18 4 X 3 = 12; 1 + E + 1 E + 12 = 39; 3 + 9 = 12; 1 + 2 = 3) which is written at the end of the number to produce 14633. A computer and a human being can each readily verify the accuracy of the number. Transpositions are detectable. "14363," for instance, would be caught as illegitimate, because the correct check-digit for the number 1436 is not 3, but 6 (1 X 1=1, 2X 4=E, 3X 3=9, 4X 6=24; 1+E+9+24=42;4+2=6). Most singledigit errors are also detectable, though ermrs of more than one digit may coincidentally generate valid check-digits and hence not be detectable.

³ The National Academy of Sciences Computer Databanks Project reached a similar conclusion on the basis of its independent, empirical assessment of the issues involved. See Alan F. Westin and Michael A. Baker, Databanks in a Free Society (New York: Quadrangle Books), 1972. pp. 396-400.

⁴"Account number 078-05-1120 was the first of many numbers now referred to as `pocketbook' numbers. It first appeared on a sample account number card contained in wallets sold . . . nationwide in 1938. Many people who purchased the wallets assumed the number to be their own personal account number. It was reported thousands of times on employers' quarterly reports; 1943 was the high year, with 5,755 wage earners listed as owning the famous number. More recently, the IRS requirement that the Social Security AN [Account Number] be shown on all tax returns resulted in 39 taxpayers showing 078-05-1120 as their number. The number continues to be reported at least 10 times each quarter. There are now over 20 different 'pocketbook' numbers . . . ." Account Number and Employer Contact Manual (Baltimore, Md.: Social Security Administration), Sec. 121.

⁵ Ibid., Sec. 554 ff.

⁶ T.D. 4704, 1 Fed. Reg. 1741 (Nov. 7, 1936); 26 C.F.R. Part 401 (1st ed., 1939).

⁷P.L. 87-397 (Oct. 5, 1961); Internal Revenue Code of 1954, Sec. 6109.

⁸ P.L. 92-603, October 30, 1972; 42 U.S.C. 405.

⁹One notable attempt to establish a standard for the identification of individual Americans for purposes of information exchange was that offered by a committee of the American National Standards Institute (ANSI) in 1969. The standard, as proposed, consisted in part of an individual's SSN; opposition to that feature in particular led in 1972 to official withdrawal of the standard from further consideration pending resolution of the issues that are covered by this report.

Table of Contents