A REPORT REVIEWReport to Congress on Options for Enhancingthe Social Security CardSSA Publication No. 12-002September 1997 It goes without saying that the Social Security Administration (SSA) did not relish the task given it by both the Welfare Reform and Immigration Reform laws of 1996 to develop a prototype of a counterfeit-resistant, tamper-proof social security card that provides individuals with "reliable proof of citizenship or legal resident alien" status.From an Honor System to a New and Unwelcome Rigor The agency prefers that its job description remain what it was at the beginning of the social security system in 1935, to record contributions, compute benefits and pay them out - nothing else. It has never cared for assisting law enforcement, tracking dead people, or helping collect unpaid taxes and child support. Because of the clout conferred by more than a quarter billion constituents, it has been able to avoid or delay many such impositions on its resources.____ To enroll in Social Security in 1936, workers had only to self-certify their identity, place and date of birth. There were no checks on personal data, no investigation of legal residence in the United States, no security against multiple enrollments. There wasn't time. Twenty-six million cards had to be issued and two million employers enrolled in about one year. The Social Security Board devised the now familiar nine-digit number at that time. Americans were given a simple paper card confirming their enrollment and their assigned number. The card had no security features, no authentication and was not intended as an identifier. Those were simpler, more trusting times. But beginning in the early 1960s use of the SSN, a unique number conveniently already issued, spread rapidly among government and private institutions which were moving en masse to computers. There were no laws barring such uses and, in the private sector, there still are none. Not until 1978 did SSA require all applicants to prove identify, age, citizenship, or alien status. And only in 1983 did Congress require rudimentary counterfeit-resistant features, such as banknote paper and raised printing, for all new and replacement cards. The SSN Meets a Widely Felt Need By 1997 387 million social security numbers had been assigned and an estimate 277 million are currently active. Some forty versions of the basic card are still in circulation. SSA issues about six million new cards a year, about half of them to newborns and half to immigrants and temporary visitors. The agency also issues 10 million replace-ment cards each year because of loss, damage or name changes. Now there are 27 authorized government uses of the number as the identifier for record keeping and computer-matching purposes, and no telling how many private uses. A 1988 survey by Health and Human Services inspectors of the extent of use of the number found 81 percent of public and private institutions used it routinely. Even as the social security number was becoming the numerical identifier of choice, SSA warned repeatedly that the number is not by itself a personal identifier because "it lacks systematic assignment to every person and means to authenticate a person's identity." Civil liberties and privacy advocates regularly deplore the increasing use of the number in national data bases and the mass monitoring of some personal behavior that it permits. But this same explosive increase in use signals the presence of a deeply felt administrative need for such an identifier in a bureaucratized mass society that steadily increases the number of benefits, rules, restrictions, status distinctions, and record keeping tasks it imposes on the individual, the household, and the organization. Growing complexity and interdependence rapidly increase the societal costs of imposture, fraud, bureaucratic error, sabotage, and the attendant ills of vestigial identity. Congress, in ordering this study, is clearly responding to a deep public yearning, despite all the warnings against the intrusions of "big brother," for a comprehensive, credible and secure national identifier. Congress recognizes a need for the numbering system, just as it recognizes that vastly increased use of the number as an identifier in four decades has not degraded the privacy or liberties of individual citizens as activists have warned.Seven Prototype Cards to Illustrate the Choices Congress in 1996 asked SSA for a prototype of a counterfeit-resistant card. The SSA report prudently responds with seven prototypes, ranging widely in the extent of their counterfeit resistance, cost, data content and capacity, machine-readability and biometrics. This cafeteria approach is a good way of making us think about how much we are willing to pay for a secure system in money, inconvenience and political stress. All seven options have certain common characteristics making them hard to counterfeit four-color printing, ultraviolet ink, a transparent hologram similar to that now used on other government ID's, and miniprinting and microprinting, as on U.S. currency. The back of each would have a tamper-proof signature panel. All would have a PVC plastic or PVC polycarbonate base, meeting the highest international standards. All versions would show the name and social security number. All cards would bear one of the following legends regarding the holder's citizenship and immigration status 1) U.S. Citizen 2) Lawful Permanent Resident 3) Not Valid for Employment 4) Valid for Employment Only with INS Authorization.Choices From Simple Single-Purposeto High-Tech Multi-Purpose A comparison of the simplest and the most elaborate options illustrates the range of choice. Option one is an inexpensive flexible plastic card with no photo and no biometrics. One variation provides for the initial placement of a label to activate the card by phone within 30 days, a common practice now among credit card issuers. Cost of production and issuance would be about $19.00 per card. SSA estimates the cost of issuing a card in 1996 at $12.50. The top of the line, option seven, has both a magnetic stripe and a two-kilobyte microprocessor for storing data. There are a digitized photo and personal data. Other biometric data such as digitized finger prints could be stored on the magnetic stripe of this card. Special electronic "readers" would be needed to interact with this model. The high security and data storage capacity would make this card adaptable for other uses. Estimated cost of issuance per person $26.00. Card options three through six offer alternate means of data storage such as secure barcode stripe, optical memory stripe, and magnetic stripe, which would be adaptable to other uses. SSA estimates the total cost of producing and issuing the cards over a period of three to ten years for all current card holders would range from $3.9 billion for the basic plastic card to $9.2 billion for Option 4, a four megabyte optical storage card - about $38 per person. If user fees are charged (which SSA opposes), the collection costs would add about $1 billion to the total cost. (See the table of options with costs of production and issuance over three to ten years.)Mass Reissuance with High Quality Control A Herculean Administrative Task SSA warns of significant additional costs after the new card is issued, but does not venture an estimate. More frequent reissuances would be necessary to update photos, provide new or additional memory, update technology, and deal with the increased wear and tear caused by more frequent use of the card for non-SSA purposes. Equipment for reading cards, taking biometrics and photos, would require ongoing maintenance and replacement. In truth, the mass reissuance of 277 million cards would be a herculean administrative task, particularly if fraud, imposture and simple identity confusion are to be kept negligible. While there will be millions who will want to game this process, there are many more residents of this country who are unclear about their own identity and origins, or whether or not they are citizens or legal residents. A great advantage of a universal biometric identifier is not that it would establish everyone's "true identity, " - probably an impossible task in a nomadic world, but that it would restrict every individual to a single identity. SSA's study assumes that its own staff and 1300 field offices would administer the reissuance, involving a total workload of 67,000 to 73,000 person-years over three to ten years. Every number holder would be required to reapply and provide identification. Some 177 million holders of numbers issued before 1979 would have to prove their citizenship or alien status, as would another 13 million non-citizens given numbers since 1979.Finding a Route through a Political and Administrative Mine Field SSA proposes to allow most of these transactions to be done by mail, unless the prospective law requires the applicant to provide a photo or biometric reading. Doing the process by mail and allowing private contractors to provide photos and biometrics (as seen in the mass naturalizations of 1995-1996) would encourage fraud. Yet requiring 277 million residents to visit a social security office could seriously sap political support. But how does a bureaucracy go about gathering and corroborating personal data and biometric readings on 277 million individuals, carding them with precision, and updating them reliably? The difference between a credible, working real-time system, and an incomplete and error-prone verification, such as the fraud-ridden amnesty of 1987-1988 or the hurried naturalizations of 1996, is in the details. Is there enough discipline among the leaders and clerks of the issuing bureaucracy, the cooperating national and state depositories of personal data, and the hundreds of millions of prospective clients? Some of the best systems are defeated by careless or corrupt officials and employees. Earlier this year SSA's Inspector General broke up a conspiracy between a West African crime gang and employees of West African origin within SSA to steal authenticating personal data for nearly 20,000 stolen social security numbers, which were later used for credit card and change-of-address fraud. There are options for easing the inconvenience and administrative burden that the report does not examine. Residents under age 14 and over age 75 could be exempted from issuance of the enhanced card. Grandfathering in residents who already hold reasonably secure evidence of identity and citizenship could cut the workload. Holders of passports and naturalization certificates issued in the past ten years are prospects, as would be senior civil servants and commissioned officers of the armed services.Judicial and Political Challenges Is Vague Identification a Right? Will workers in the reissuance process even be permitted to demand high standards of proof of identity and citizenship status, particularly when complaints of "rigidity," "intimidation," "discrimination" or "selective application" begin to flow in? The past willingness of the courts and congress to settle identification requirements for huge classes of people by fiat, such as in the 1987-1988 amnesty has probably not changed. The ground work for future litigation and congressional pressures in the warnings of Hispanics and other civil libertarians that the poor and racial minorities would have the toughest time complying with a uniform national identification process. Could we expect ad hoc solutions such as that of some state public assistance agencies which issued nine-digit "special numbers" to illegal aliens rather than deny them assistance benefits, or by extending the judicially created amnesty - the concept of "permanently residing in the United States under color of law - PRUCOL"to social security enrollment?Without Secure and Reliable Vital Records - Garbage In and Out Is there enough reliability in the vital records from which corroboration of identity will most often be sought? Right now, probably not. Faulty vital records are now the major stumbling block to otherwise well managed ID systems, from state drivers licences to passports. There are signs of progress. SSA now maintains a nearly up-to-date death file to close accounts promptly. Congress in 1996 took steps toward higher standards of federal acceptability for vital records and the ID documents derived from them, such as drivers' licenses.SSA Suggestions Do it Gradually, Let the States Do It, or Don't Do It at All The entire process is so daunting, one can share SSA's discomfort with the idea and not be surprised they offer alternatives to a mass reissuance. One is to develop a secure, enhanced card but issue it prospectively over a longer time to new applicants and to existing card holders seeking replacements or services. The extensive fraud and error in the existing system would be tolerated a while longer. Another alternative, long an SSA favorite, is to adapt state drivers' licenses and non-driver identification cards also to provide verification of social security numbers. SSA's arguments are persuasive. Drivers' licenses are accepted - and paid for - as a part of life. State drivers licenses have acquired many of the counterfeit-resistant, tamper-proof features envisaged for the SSN. They always carry a photo and much of the personal information desired for the SSN. Licenses are required under the 1996 law to contain the SSN, now a requirement in 29 states, and the inclusion of this data in machine-readable form will allow for automated matching with the SSN data base. A question would be the states' willingness to participate with SSA in verification and in coding licenses for citizenship status and work eligibility. A card-less ID system is SSA's final alternative. It notes that now the key identifier in the number, not the card. So, matching the number to other authentication means, such as biometrics, PIN numbers, and encryption keys "could virtually eliminate counterfeit SSN issues." The report acknowledges that this is still an emerging science.Conclusion Cost and Technical Feasibility Good, Politics Precarious This report sums up convincingly the dilemmas of achieving a reliable system for verifying individual eligibility to work or receive benefits, and to meet the increasing need for ready verification of citizenship for such needs as voting, jury duty, passports and security clearances. The money costs of reliably carding nearly 300 million persons, as estimated in this study, is reasonable and easily within the nation's means when spread over several years, with or without user fees. A mass reissuance correctly done will help clear up example, the more than ten million SSNs now used by more than one person, while helping the Internal Revenue Service to deal with the more than 21 million W-2 forms it receives each year with incorrect combinations of name and social security number. But SSA's report confirms once again that the technological options are sound but the politics of identification and the state of the current basics of a system are precarious. A great deal of preparation is needed in securing basic vital "breeder" documents and educating the public to the savings and personal convenience of a system that can provide secure identification even to the poor and the marginalized.