There was a very bizarre APstory today about how bureaucratic ignorance and unexamined programming assumptions can lead to unnecessary trouble.
According to the AP reporter, Holly Ramer, her social security number was "given" to a person in the Federated States of Micronesia. How did she know?
A collection agency wanted her to pay $7,306 they said she owed on a disaster loan she supposedly received from the US Small Business Administration in 2002 when Tropical Storm Chata'an hit Micronesia and hadn't paid back.
Turns out, the loan was actually given out to a Micronesian man who hadn't paid it off.
How did the Holly Ramer's number get associated with this person?
That is a bit complicated, and you should read the story for all the gory details. The short version is that three Pacific island nations, the Federated States of Micronesia, the Republic of the Marshall Islands and the Republic of Palau, each have their own each independent Social Security Administrations which is based generally on the US model. By granting the US defense rights, the US provides economics aid, including grants and loans after disasters to the three nations.
The trouble is that the US federal agencies, like the US Department of Agriculture, who grant aid also collect social security information from those individuals receiving aid in the three Pacific island nations, and report that information to US credit bureaus for some unknown, but I am sure, bureaucratically sound if not entirely logical reason.
As a result, you end up with overlapping Social Security numbers between countries.
However, two out of the three nations don't have a nine digit social security number, but an eight digit one instead. So, what to do when filling out the US aid paperwork that asks for your social security number?
Well, since only an 8-digit number is filled in by those receiving aid, helpful computers automatically add in a beginning zero to make things all bureaucratically nice and neat.
Holly Ramer says there are some 135,000 potential Social Security number overlaps between the US systems and the three others.
What makes this story more frustrating to those like Holly Ramer who are caught up in its Bizarro world is that the U.S. Department of Agriculture has in fact known about the problem for years, but says no fixes to its computer software or its policy are in sight.
Furthermore, none of the four countries' Social Security Administrations were even aware of the problem until she brought it to their attention. When informed of it, the US Social Security Administration said it isn't their problem to fix.
In addition, US credit bureaus don't distinguish between US and the three Pacific nation's social security numbers, and say it is up to the four Social Security Administrations to fix the problem, not them.
The US Federal Trade Commission says it isn't their problem, either, since the issue isn't technically identity theft.
Holly Ramer says the bottom line is:
"If your U.S. number starts with 002-6, 003-9, 005-7 or 007-8, it could match a number in Micronesia. Numbers that start 006-4 could match numbers in Palau. Those that start with 004 could match numbers in the Marshall Islands."
Good luck if you have an overlapping social security number - it looks like you are on your own if a problem arises.
I wonder how soon hackers are going to try and exploit this information.
Robert N. Charette is a Contributing Editor to IEEE Spectrum and an acknowledged international authority on information technology and systems risk management. A self-described “risk ecologist,” he is interested in the intersections of business, political, technological, and societal risks. Charette is an award-winning author of multiple books and numerous articles on the subjects of risk management, project and program management, innovation, and entrepreneurship. A Life Senior Member of the IEEE, Charette was a recipient of the IEEE Computer Society’s Golden Core Award in 2008.