The Social Security Administration (SSA) would still be responsible for the overall process of distributing SSNs, and would still be the authority in that regard. However, they would have to maintain their own change log should someone require that their SSN be changed -- but they would only maintain a change history -- it would be up to the credit reporting companies to maintain the data integrity and key references needed to maintain consistent reporting of credit history through SSN changes. They would be responsible for the costs associated with updating their systems and software to accommodate the process.

Consider the following: TransUnion, who holds information on over 500,000,000 people worldwide and who sells that information, is an independent privately-held company. Experion bills out $3.1 billion a year, and has almost $8,000,000 in assets on the books. Equifax, publicly traded on the NYSE, had $1.3 billion in revenue in 2005, yet subcontracts all their customer service to a company in Canada. These companies need to share some of the burden of the solution since they help perpetuate the problem.

Though the SSA would "hold the keys" to the SSNs, the actual SSN change logs could be maintained by two independent entities. The two sets of logs could be checked against each other for data integrity and auditing purposes. The main function of these third-party entities would be to provide authentication and validation of any given SSN and to maintain, administer, and support the “voiding” of an SSN. Though the actual processing would be done by these third-party companies, they would work under the guidance and direct control of the SSA.

Trust, but validate

Once this framework is in place, different bodies could use it to verify the validity of a SSN when required -- this could a history check to obtain some form of credit, a claim of authenticity (as in a requirement to obtain a state ID), or when needed to provide a unique identifier (as in the case of filing income tax forms).

If a non-government entity requires the use of one’s SSN to be used or validated as part of its process model, the first step is for the validation bodies (both of them) to authenticate the status of the supplied SSN. This would be done for a small fee- this is the current model exercised by companies who use the validation and qualification services offered by companies like Equifax. The main process would not change: A customer fills out an application for credit, which is sent to one of the "Big three" (or any other qualifying entity) for reporting. The only difference is that the qualifying entity, Equifax for example, must validate the SSN with both validation authorities before beginning their review process.

In exchange for validating the SSN, the qualifying entity pays each validating body a small transaction fee to cover the added cost of having a separate body validate the data. If both authorities validate the SSN, then it’s business as usual for the qualifying agent. If not, an exception is flagged, stopping the process and terminating the initial transaction pending further investigation. Government agencies could use the system for free.

If someone’s information is compromised in a qualified, validated breach, or if the possibility exists that one’s personal information was accessed without authorization, then the process of changing the person’s SSN is initiated. The SSA issues a void order to the two validation bodies to invalidate the old SSN, and issues a new SSN on behalf of the victim, followed by an "update" order sent both entities. When both validation bodies provide confirmation of the new number’s entry into their respective systems, the victim receives their new social security number, and the original SSN is immediately invalidated.

Since all requests for validating a SSN go through the authentication bodies, any attempted use of a compromised SSN will be "denied."

Business competition will ensure that the new process of "verifying" the SSN is adopted, providing such a service would be invaluable to customers and would be a huge competitive advantage. As such, any agency that did not adopt the process would lose business -- this would ensure that the process would be widely adopted commercially.

In the presence of a system that can immediately revoke an SSN (thus stripping it of its value to criminals), the "worthless" remediation measures I questioned earlier can now serve a valuable purpose by providing legal measures that would hold companies accountable for having their data compromised by making them directly cover the cost of reissuing SSNs to the victims. The funds would go directly to the SSA, as opposed having ubiquitous fines collected by the Federal Trade Commission. A legislative body could dictate the criteria by which a company would be required to report security breaches, as well as constituting appropriate reparation based on a given scenario.

A great benefit of such a system is its natural support for legacy systems that may depend upon a SSN to track records -- it would be up to individual companies to make the decision to develop systems that would support a history of SSNs. For instance, the company that provides my health insurance coverage requires my SSN to track transactions against my account. They do so because they access other systems that also use my SSN -- as my physician or any given hospital or emergency facility does. The reason they require my SSN has less to do with my credit record than it has to do with accessing data using a consistent method.

If I were a victim of identity theft and changed my SSN, my insurance company would not necessarily have to change their systems to accommodate the change. Since they use the SSN simply as a unique number to access my records, they could go on using the old number. In fact, I would prefer that be the case as any breach of their systems would result in an attacker getting a voided SSN, not the current, valid one.

This would obviously be huge undertaking and would require incredible amounts of work and planning at the national level. It would be a long, hard road.

Yet, the problem of identity fraud is already out of control, and our current efforts are not doing anything to solve it. But if we can come up with a way of seeing a framework like this implemented that could actually end identity theft as we know it while also securing Social Security benefits for the future, I think it's something we should consider.