Social Security’s Perilous Plan for Its Future [View all]

[eridani]

http://www.pogo.org/blog/2014/09/20140924-social-securitys-perilous-plan-for-its-future.html

The Social Security Administration (SSA) is developing a plan of action for the next ten years. The conventional wisdom is that the next decade for SSA will feature a smaller workforce, fewer field offices, and more Internet-based customer service.

Achieving the latter will require the agency to rely more on contractors. One company that will figure prominently in SSA’s future is Experian, an information services company best known as one of the “Big Three” credit reporting agencies.

The Social Security Administration contracted with Experian in 2012 to provide identity proofing and fraud prevention for My Social Security (My SSA), an online portal through which the public has 24/7 access to their earnings and benefits statements and various customer services. SSA provides Experian with identifying information for social security number holders—last name, first name, date of birth, address, and phone number. When you go to My SSA to open an account, you are redirected to an Experian site to verify your identity. Once you successfully answer a few questions based on information Experian maintains in your credit report, you are directed back to the My SSA site to continue the registration process. According to SSA, more than 14 million people have established a personalized My SSA account.

SSA’s choice of Experian to perform this function is troubling. The company has a history of cybersecurity breaches and consumer law violations. Right now, Experian is dealing with major fallout from an incident in which a subsidiary, Court Ventures, sold the personal information of hundreds of thousands of Americans to an international identity theft ring. Experian purchased Court Ventures after the fraud scheme began, but the illegality continued for several months after the acquisition. The FBI and Secret Service are investigating the incident.

Experian senior Vice President Tom Hadley admitted at a Senate hearing last year that Experian failed to detect the scam while conducting pre-acquisition due diligence. “During the due diligence process, we didn’t have total access to all the information we needed in order to completely vet that, and by the time we learned of the malfeasance nine months had expired, and the Secret Service came to us and told us of the incident,” Hadley testified at the hearing.