Re: Bare Social Social Security Numbers

[Keith Schoenefeld <schoenk () UTULSA EDU>]

Obviously, I'm ignorant as to how easy it is to do a reverse lookup
based on SSNs, but the point remains, this is only slightly different
than someone generating SSNs out of thin air utilizing the guidance that
the SSA provides.  With respect to picking random SSNs being a no no, I
recognize that, I was just curious is other universities had policies to
that effect.  Does anyone here have such a policy?

-- KS

H. Morrow Long wrote:
> On Mar 28, 2006, at 10:39 AM, Keith Schoenefeld wrote:
> > I think it would be awfully tough for someone to actually put names
> > to the SSNs.
>
> The following are advertised on Google:
>
> Social Security Numbers
> Lookup SSN Number online.
> Get instant access now.
> www.SSN-Finder.com
>
> Reverse SSN Lookup
> Enter a name or SSN & get info.
> Start with your preliminary search.
> www.civilrecords.org
>
> Find Annyone by SSN #
> Money Back Guarantee
> Locate Someone Today only $19.95
> socialsecuritysearchusa.com
>
> SSN #s Lookup.
> Lookup SSN #. Verify People Info,
> Contacts, Background Check, More.
> www.check-ssn.com
>
> SSN Verification
> SSN Verification Solutions. Aliases
> Addresses And Phone Numbers.
> www.ewoss.com
>
> There is also an interesting project involving SSNs at CMU:
>     http://privacy.cs.cmu.edu/dataprivacy/projects/ssnwatch/identitytheft.html
>
>
> > On a side note, we had a recent scare on campus where a faculty
> > member had created an example database using real student names
> > combined with a set of SSNs, addresses, phone numbers, etc. that were
> > made up.  ...
>
> According to the SSA there are a few sample SSA's which can be openly
> used and
> displayed -- such as 123-45-6789 and 999-99-9999.
>
> Webpage http://www.socialsecurity.gov/employer/stateweb.htm states
> "Any number beginning with 000 will NEVER be a valid SSN."
>
> No SSNs have apparently ever been issued beginning with a 9 either.
>
> I found a bunch of test SSNs at;
> http://www.hawaii.edu/metadir/attributes.html#uhSSN
>
> In google searching I did find a # of other cases where SSNs had just
> been
> generated out of thin air and posted on the Web (where some still are and
> some are cached in Google) as part of college programming assignments.
>
> Using other's potential or real SSNs should be a no-no. There is now a
> rule
> telephone #s in movies, television and music must start with exchange 555
> -- remember 867-5309, customers in many exchanges had to change their
> phone numbers after that song as pranksters all over the US started
> calling
> it looking for Jenny.
>
> - H. Morrow Long, CISSP, CISM, CEH
>   University Information Security Officer
>   Director -- Information Security Office
>   Yale University, ITS