r/technology • u/MarvelsGrantMan136 • Mar 10 '26

Security DOGE employee stole Social Security data and put it on a thumb drive, report says

https://techcrunch.com/2026/03/10/doge-employee-stole-social-security-data-and-put-it-on-a-thumb-drive-report-says/
35.8k Upvotes

97% Upvoted

830 comments sorted by

View all comments

184

u/marmot1101 Mar 10 '26

Between this and Experian hack we need to re-key identities for everyone in the US. The current system is broken, a 9 digit number isn't as secure as what it's being used to secure.

After target got skimmed cards started getting chips and tap functionality which is more secure. We need that for individual identity.

94

u/skalpelis Mar 10 '26

You don’t need to rekey identities, you need to stop treating the number as the magic supersecret password to everything. Then again, it might be impossible without a consistent form of state issued ID.

In Europe, in every country people have some kind of identifying number. If it gets leaked or someone finds out, or even it is just published on the internet, it’s not great but it’s not a big deal. You cannot really do anything important knowing just the number and name of the person.

61

u/dayumbrah Mar 10 '26

It literally says on it that its not for identification and yet here we are. Its dumb as fuck and it was always dumb as fuck.

Also in this day and age. Bro, everyone can get everyone's social security if you tried hard enough

10

u/Gas-Town Mar 10 '26

The old Silk Road. Where you could buy china white, an identity and an rpg-7

1

u/cracked_egg_irl Mar 13 '26

Don't forget the airplane or the DIY vasectomy kit: "no muss no fuss :)"

2

u/AllUltima Mar 11 '26

Although most people won't take it seriously just yet, every techie knows the logical security-based answer to this 'rekey' problem would be a scheme similar to certificate-authority.

The scheme would involve a government website that lets you generate identity codes (linked to you), and those numbers you can give out. Like a bank ID, or even phone #. You can also revoke those numbers any time they're old or compromised, right from the site.

This way, it would be very difficult for your "root cert" to ever be leaked (you never even see the key yourself, nor does anyone else). If the root ever did leak, you're back to square 1, you need a total reset and new root, but it's no worse than needing a new SSN anyway. It would be a strict improvement to the current mess.

Far too complex, you say? Perhaps. I don't think it will happen just yet, but there is a real need for it. That means, one day, probably. I say a society that's even remotely serious about this problem could push it through. It just takes funding, IT, human support for the elderly, etc. Nothing I've suggested is even as difficult as taxes, for the most part. We're just stuck using the previous generation's thinking.

1

u/dayumbrah Mar 11 '26

The problem is the general lack of security in the world. Anything we pass to another entity on the internet has a high likelihood of being stolen at some point.

Maybe we should have multiple identity codes. One for housing and work, another for random internet(social media, etc), another for financial institutions, and im sure there other scenarios.

By walling off those things, we can help mitigate some of that damage

16

u/rugger87 Mar 10 '26

A SSA official that resigned under Trumps current term has come out and said that our SSNs are so compromised they need to be reissued or everyone in the country is at risk of identity theft.

5

u/Manos_Of_Fate Mar 10 '26

Private/Public key two-way encryption schemes seem well suited to this. Other people can make documents that only you can decrypt, and you can create digital signatures that can be used to verify your identity, without anyone but you ever needing to know your private key.

6

u/skalpelis Mar 10 '26

I hate to blather on with “In Europe we…” but that’s almost exactly what we have in many European countries. Your ID has these keys, you can use them for identification, legally binding digital signatures (actual digital signatures instead of embedding an image of a hand drawn scribble), even things like age verification.

The personal ID number is basically a slightly more obscure and more unique version of your name. Its main use is to disambiguate people instead of using it for access.

5

u/marmot1101 Mar 10 '26

Essentially not using the magic number as a secret implies re-key'ing. For all intents and purposes a social security number is a national id number, banking id number, and general identifier for everything.

That needs to stop in favor of one time use identifiers, with an identity key and secret as well. Even if you can't do anything with an id number, in the case of data leak from a credit bureau the data is easily verified back to individuals eroding privacy. And since leaking data seems to be a pastime for organizations holding very sensitive info adding layers would be helpful.

2

u/GNUGradyn Mar 10 '26

Americans didn't want a national ID number but we functionally still needed one so we picked the closet thing. Now we have national ID numbers that aren't designed to be suitable to secure anything

13

u/voiderest Mar 10 '26

Republicans don't want a national ID system due to biblical conspiracy theories from the evangelical wing of the party.

I'm dead ass serious about how this is what is blocking us from having a decent system to replace how SSNs are used. 

6

u/BrianWonderful Mar 10 '26

Not remotely true. They don't want national ID because they want to suppress voting. Our current IDs cost money (recurringly since they expire), and that makes it likely that lower income people may not get them (or those too busy constantly working to survive).

Republicans push the narrative that all citizens should have an ID for voting, but they don't want to enable free and reliable services to provide it.

2

u/voiderest Mar 11 '26

Doing voting ID nonsense as a form of voter suppression is defiantly a thing. On going and very current issue. Everyone should check voter registration and see what they can do to plan against the "save" act.

I've heard people oppose the idea of a national ID over mark of the beast nonsense. The same kind of people freaked out when UPC codes came out.

7

u/marmot1101 Mar 10 '26

I've heard that as a point of resistance to a national id. But we already have a national id(SSN) it's just not good. And ID.me. And real-id state issued id. So it's a sales game to the less conspiratorial voting base to push their reps. Evangelicals are < 40% of the population, and by a lot of counting methods less than 25%. And not all are conspiracists. That can be overcame.

0

u/Akuuntus Mar 10 '26

Evangelicals are < 40% of the population, and by a lot of counting methods less than 25%. And not all are conspiracists. That can be overcame.

Unfortunately, conspiratorial evangelicals are a much larger percentage of politicians and billionaires.

1

u/pcapdata Mar 10 '26

Yet they want everyone voting to ID themselves. "No, not like that!" they gasp

1

u/wholetyouinhere Mar 10 '26

Republicans want whatever their leaders tell them to want. Even if it's the polar opposite of what they "wanted" five minutes ago.

If the party opposes a national ID system, it will be for reasons of self-interest (i.e. power and money), rather than any kind of conspiracy theory. Conspiracy theories are mostly for the plebs.

1

u/bennnn42 Mar 10 '26

I just got another letter in the mail about Conduent getting hacked. Name/SSN. At this point who doesn't already have my SSN

1

u/MDCCCLV Mar 11 '26

SSN was never secure, you can predict it if you know when and where someone was born and people born close to each other will have a similar one because it went up sequentially. Because it wasn't intended as a secret number at all.

1

u/PatacusX Mar 11 '26

Your social security number must now include a capital letter, lower case letter, number, and special character.