How to Guess a Social Security Number and Get Famous on the Internet

[This Thursday re-run is from July 9, 2009.]

The latest hot topic on the identity theft front is a paper published on Monday in The Proceedings of the National Academy of Science by two professors at Carnegie Mellon on how easy it is to guess a person’s social security number.

That day Ars Technica reported on it. Also, the authors of the paper started a blog on it. The AP picked it up Tuesday. CrunchGear blogged on it then too. And Wednesday brought posts from Wise Bread and Wallet Pop.

This is a great story. It combines several of my favorite themes. There’s the ever amusing hysteria over identity theft, which apparently renders a person incapable of rational thought and perspective. There are the unintended consequences of seemed-like-a-good-idea-at-the-time government policies. And there is the recurring phenomenon of folks who report and comment on academic papers without reading and/or understanding them.

The researchers, Alessandro Acquisti and Ralph Gross, developed a methodology for guessing SSNs based on publicly available databases and some often publicly available data about people, specifically their date and place of birth. The method is orders of magnitude less accurate than suggested in the blogosphere, but it may be a lot more accurate than you might imagine. To understand why requires a bit of a lesson on the history and mechanics of Social Security Numbers.

When SSNs were invented in the 1930s nobody intended them to be secure or particularly hard to decipher. The main concern was that they be easy to issue in a pre-computer age. Each number was (and still is) made up of three groups of digits. The first three, known as the Area Number (AN) defined codes that were doled by state, so that local Social Security offices in each state could issue numbers without consulting a central registry. The most populous state, New York, got 85 ANs to use (050 to 134) and the least populous, Alaska, got only one, 574.

The next two digits, the Group Number (GN) has no particular significance except that it defines a “group” of 10,000 possible numbers. Each Social Security office uses up an entire group block before going on to the next one. (Which was usually the next even number. Only once 98 was used up would they resort to odd GNs.) And then there are the last four digits, known simply as a Serial Number (SN). These are assigned in order until the group block runs out.

None of this was (or is) even vaguely a secret. The Social Security Administration went so far as to regularly publish a table listing which group numbers had been used in each state by year, to aid in the detection of fake SSNs.

That said, it was still nearly impossible to guess a person’s SSN even if you knew basic information about them, such as where and when they were born. Enter two well meaning government innovations with delightfully Orwellian names, the Death Master File (DMF) and the Enumerated at Birth (EAB)program.

The DMF is a very long list of dead people. It contains, among other things, the deceased’s date and place of birth and SSN. This is useful to three groups 1) amateur genealogists 2) those who want to detect people fraudulently using the SSNs of dead folks and 3) Carnegie Mellon professors who want to use the records of recently deceased young people to build a really good database of what SSNs were being given out where and when.

They could do that because of the EAB. It may surprise you young ‘uns, but until about 20 years ago, babies did not have SSNs. (Remember the movie Big? There’s a scene in which Tom Hanks almost gets caught because he has no SSN.) A person applied for a SSN when they started working or opened their first interest-bearing bank account, which is to say at a relatively random point in time, ten to twenty years after birth.

Then somebody in Washington figured out they could stop a whole lot of tax cheating if they made taxpayers list the SSNs of their claimed dependents. As a part of this scheme, they started the EAB, which makes filing for a SSN a routine part of maternity ward paperwork, along with getting a birth certificate. And presto, for people born after the late 1980s, knowing their date and place of birth and SSN gives you a significant insight into the SSNs of other people born there and then.

Acquisti and Gross may or may not be the first to work this out, but they are apparently the first to realize what a great big splash could be made by pointing it out publicly. Today, knowledge of a person’s SSN plays the role that knowledge of a person’s true name played in certain primitive societies. A person whose SSN becomes known to the dark forces will have no end of evil spells cast upon them. Suggest that there is a sinister way in which an SSN can be divined and you’ve got the makings of some great viral internet buzz.

Just to make sure, Acquisti and Gross added in the speculation that an evil-doer could find dates and places of birth from sites such as Facebook. Identity theft and damage done by social networking in one story? This one has legs.

Only 48 hours after the original paper was posted Wallet Pop breathlessly told us

… new research indicates that it is possible to determine one out of every ten social security numbers knowing only a place of birth and birthdate!

Which, if true, would no doubt occasion immediate Congressional hearings. Alas, the numbers are bit off. Actual readers of the paper (as opposed to readers of blog posts based on other blog posts based on wire stories based on press releases about the paper) know the accuracy to be just a bit less than one in ten.

The odds of guessing right depends on the year of birth and the state. To maximize the chances of guessing right, you want a recent year for which the data is nice and clean and EAB is well ensconced, but not so recent that there are too few entries in the DMF for people born that year. And smaller states are much easier because fewer babies are born there each day.

For somebody born in Alaska in 1998, essentially the best case scenario for guessing right, Acquisti and Gross estimate they could get a full SSN 58% of the time within one thousand attempts. My calculations translate that into a 1 in 1153 chance for each guess. You can see how that might be confused with 1 in 10. For somebody born in New York in 1998, the paper estimates the probability of getting it right in 1000 tries at 3%, which I work out to be a 1 in 32,831.

We might get Congressional hearings anyway. A 1 in 1153 chance of guessing right, even if it only applies to tiny number of Americans, isn’t okay. This isn’t a hard problem to fix, the Social Administration just has to abandon a geographic allocation system that stopped making sense during the Johnson Administration. And I think we can allow 11 year-old Alaskans to get new SSNs.

That said, there is no need to get particularly excited about this. I can forgive Acquisti and Gross for hyping their paper. Even associate professors gotta make a living. But everybody else really ought to check their sources before they use exclamation points.

Uncategorized | Frank Curmudgeon | July 29, 2010 11:59 am

41 Comments

By Brian, July 29, 2010 @ 12:51 pm

I think I would rather see congressional hearings about people (and government agencies) treating it as a “secret” instead of just as a unique identifier.

Why on earth does having someones tax ID allow you to impersonate them for credit cards, loans, etc… I have my employers Tax ID, its printed right on my W2, but the banks won’t let me use that to get credit cards in the companies name…
By Dan, July 30, 2010 @ 10:49 am

Frank,

I’m pretty sure you were speaking tongue in cheek, but just in case you’re not, ID theft is a royal pain in the ass. I wouldn’t go ape-sh*t over it, but getting it resolved with the bureaus is a royal PITA. That’s a problem where an ounce of prevention is worth far more than a pound of cure. If I could erase bad data with a notarized letter or something relatively simple but meaningful, then fine, but it’s really not that easy, from the stories I’ve heard.
By Jim, March 1, 2011 @ 6:20 pm

I’ve ben through identity theft before. It is a major pain and requires literally hundreds of hours of work to fix the problem.
By Suranne Dunlap, November 21, 2019 @ 3:55 am

I have kept your website. It is illuminating and fulfilling for me. I regard the central information you offer in your site. A devotion of thankfulness is all together for posting it.
By isotretinoin for acne, June 25, 2023 @ 12:03 pm

Looking for the best deals on Accutane? Check out our website and get the
best prices on Accutane at where to get accutane cheap.
By spravki-kupit.ru, June 27, 2023 @ 2:26 am

где купить справку
By где купить диплом, June 28, 2023 @ 6:29 am

This design is steller! You certainly know how to keep a reader entertained. Between your wit and your videos, I was almost moved to start my own blog (well, almost…HaHa!) Fantastic job. I really enjoyed what you had to say, and more than that, how you presented it. Too cool!
By накрутить просмотры яппи, July 30, 2023 @ 7:45 am

Hey! Quick question that’s entirely off topic. Do you know how to make your site mobile friendly? My site looks weird when viewing from my iphone 4. I’m trying to find a theme or plugin that might be able to fix this problem. If you have any suggestions, please share. Thanks!
By smartremstroy.ru, August 1, 2023 @ 12:14 am

What’s up Dear, are you truly visiting this site daily, if so after that you will absolutely get good experience.
By daachnik.ru, August 2, 2023 @ 7:38 am

You should take part in a contest for one of the best sites on the web. I am going to recommend this website!
By химчистка мягкой мебели смолевичи, September 2, 2023 @ 6:40 am

You’re so awesome! I don’t suppose I’ve read anything like this before. So nice to find someone with some unique thoughts on this issue. Really.. thanks for starting this up. This website is something that is needed on the web, someone with some originality!
By химчистка мягкой мебели жодино, September 2, 2023 @ 8:39 am

Pretty great post. I simply stumbled upon your blog and wanted to mention that I have really enjoyed browsing your blog posts. In any case I’ll be subscribing for your feed and I am hoping you write again soon!
By sadovoe-tut.ru, September 6, 2023 @ 9:04 pm

Hi there everyone, it’s my first visit at this site, and post is truly fruitful in favor of me, keep up posting such articles.
By agrosadovnik.ru, September 6, 2023 @ 9:25 pm

My brother suggested I might like this blog. He was totally right. This post actually made my day. You cann’t imagine just how much time I had spent for this information! Thanks!
By payday loans, October 7, 2023 @ 7:53 am

I used to be recommended this blog by way of my cousin. I am not sure whether this publish is written through him as no one else understand such designated approximately my difficulty. You are amazing! Thank you!
By online television, October 9, 2023 @ 4:53 am

I am curious to find out what blog system you happen to be working with? I’m experiencing some minor security problems with my latest website and I would like to find something more risk-free. Do you have any suggestions?
By online television, October 10, 2023 @ 10:23 pm

I’m really enjoying the design and layout of your site. It’s a very easy on the eyes which makes it much more enjoyable for me to come here and visit more often. Did you hire out a designer to create your theme? Outstanding work!
By order plaquenil uk, October 11, 2023 @ 5:33 pm

hcq without a doctor prescription order plaquenil uk purchase plaquenil australia
By сделать чек на гостиницу, October 15, 2023 @ 10:06 am

Hey this is somewhat of off topic but I was wondering if blogs use WYSIWYG editors or if you have to manually code with HTML. I’m starting a blog soon but have no coding know-how so I wanted to get advice from someone with experience. Any help would be greatly appreciated!
By гостиничные чеки купить в москве, October 16, 2023 @ 7:56 am

Hi, I do believe this is an excellent website. I stumbledupon it I will return once again since I book marked it. Money and freedom is the best way to change, may you be rich and continue to help other people.
By online television, October 17, 2023 @ 11:23 pm

Howdy! Do you know if they make any plugins to help with SEO? I’m trying to get my blog to rank for some targeted keywords but I’m not seeing very good gains. If you know of any please share. Thanks!
By Онлайн казино, October 20, 2023 @ 1:01 am

I have been surfing online more than three hours lately, yet I never found any fascinating article like yours. It’s pretty worth enough for me. In my opinion, if all website owners and bloggers made just right content as you did, the net can be much more useful than ever before.
By Онлайн казино, October 20, 2023 @ 11:28 am

Howdy just wanted to give you a quick heads up and let you know a few of the images aren’t loading correctly. I’m not sure why but I think its a linking issue. I’ve tried it in two different browsers and both show the same results.
By Онлайн казино, October 20, 2023 @ 5:44 pm

Thanks for ones marvelous posting! I really enjoyed reading it, you’re a great author. I will make sure to bookmark your blog and will eventually come back in the foreseeable future. I want to encourage yourself to continue your great writing, have a nice morning!
By залить стяжку пола, October 23, 2023 @ 6:08 pm

Хотите получить идеально ровный пол в своей квартире или офисе? Обратитесь к профессионалам на сайте styazhka-pola24.ru! Мы предоставляем услуги по устройству стяжки пола в Москве и области, а также гарантиру
By поставка строительных материалов, October 24, 2023 @ 1:46 pm

организация снабжения строительных объектов
By гостиничные чеки купить в москве, October 25, 2023 @ 7:30 pm

I like the valuable information you provide in your articles. I will bookmark your weblog and check again here frequently. I am quite certain I will learn many new stuff right here! Good luck for the next!
By штукатурка стен машинным способом, October 26, 2023 @ 5:08 pm

Получите безупречные стены благодаря услуге штукатурка стен на mehanizirovannaya-shtukaturka-moscow.ru. Качество и скорость исполнения вас удивят.
By чеки на гостиницу в москве, October 28, 2023 @ 10:52 pm

I like the valuable information you provide in your articles. I will bookmark your weblog and check again here frequently. I am quite certain I will learn plenty of new stuff right here! Good luck for the next!
By где сделать в москве гостиничные чеки, October 28, 2023 @ 11:29 pm

My coder is trying to persuade me to move to .net from PHP. I have always disliked the idea because of the expenses. But he’s tryiong none the less. I’ve been using Movable-type on a number of websites for about a year and am anxious about switching to another platform. I have heard excellent things about blogengine.net. Is there a way I can transfer all my wordpress content into it? Any kind of help would be really appreciated!
By гостиничные чеки мск, October 29, 2023 @ 12:06 am

Hey there! I know this is kinda off topic but I was wondering if you knew where I could get a captcha plugin for my comment form? I’m using the same blog platform as yours and I’m having trouble finding one? Thanks a lot!
By чеки на гостиницу в москве с подтверждением, October 29, 2023 @ 12:43 am

Wonderful goods from you, man. I’ve bear in mind your stuff prior to and you’re simply too great. I really like what you’ve got here, really like what you’re stating and the best way in which you assert it. You are making it entertaining and you still take care of to stay it smart. I cant wait to read far more from you. This is actually a wonderful website.
By чеки на гостиницу в москве, October 29, 2023 @ 1:21 am

This is the right web site for anyone who really wants to find out about this topic. You understand so much its almost hard to argue with you (not that I actually would want to?HaHa). You definitely put a brand new spin on a topic that has been written about for years. Excellent stuff, just excellent!
By где можно заказать гостиничные чеки в москве, October 29, 2023 @ 2:00 am

Your means of explaining everything in this article is really pleasant, all be able to easily know it, Thanks a lot.
By чеки гостиницы с подтверждением, October 29, 2023 @ 2:43 am

Hi my family member! I want to say that this article is awesome, great written and come with almost all important infos. I’d like to peer more posts like this .
By where can i get zithromax, June 1, 2024 @ 8:43 am

zithromax buy online india
By cheap, July 6, 2024 @ 8:38 pm

how much is accutane in mexico
By sale, July 11, 2024 @ 4:35 am

azithromycin 500mg canada
By generic, July 19, 2024 @ 6:56 am

cost of lasix medication
By sale, July 23, 2024 @ 5:16 pm

buy doxycycline united states
By order, August 1, 2024 @ 4:35 am

modafinil for sale us