Nearly five months after an unprecedented security
breach at the credit rating firm Equifax exposed Social Security numbers
and other data, making some 147 million Americans vulnerable to
potential identity theft and fraud attacks, the Social Security
Administration continues to use an identity security system devised by
Equifax for the MySocialSecurity online portal.
Equifax
was awarded a no-bid $10 million contract back in early 2016, as the
company boasted at the time, “to help the SSA manage risk and mitigate
fraud for the mySocialSecurity system, a personalized portal for customers to access some of SSA’s services such as the online statement.” ...
[Social Security] Press officer Mark Hinkle would only tell Salon that “Equifax is not, and has never been, responsible for the authentication of mySocialSecurity users, or building, maintaining or supporting any of Social Security’s platforms.”
That response suggests
that, in fact, all the financially strapped SSA actually got from
Equifax for its $10 million was a bunch of security questions to ask
those trying to prove their identity before accessing the online
customer portal.... Based
on the questions actually found on the site, it would appear that
Equifax offered a duplicate version of the questions it uses for its own
flawed and hacked customer access security system for use by the SSA’s
MySocialSecurity Portal, and no doubt the IRS’ online portal too. ...
The Social Security Administration has been under enormous pressure to move its operations online. There are Congressional hearings where members of Congress seem incredulous that the agency even has field offices. The Government Accountability Office (GAO) keeps pressing to move everything online. If Uber can do it, why can't Social Security? This is based upon a naive belief that Social Security's operations are relatively simple which they might be if the agency only had to take retirement claims. However, many of Social Security's operations -- like disability, survivor and SSI claims -- are way too complicated to be handled online. It's sort of like insisting that a funeral parlor move all its operations online. Sorry, but there's that pesky body you have to deal with somehow as well as bereaved relatives who demandTLC.
The EquiFax situation isn't as dire as this article suggests. EquiFax isn't getting any data from Social Security. It all goes in one direction from EquiFax to Social Security. =
I can't say whether the authentication process Social Security is using is adequate but I don't know what the alternative would be other than to give up on online services. That would be fine with me as long as Congress gives Social Security adequate resources but that's not going to happen.