1

Four vignettes

• Everyone can snoop• What they have on you• Getting sensitive information from public data• Do-it-yourself identity theft

5

6

Four vignettes

• Everyone can snoop• What they have on you• Getting sensitive information from public data• Do-it-yourself identity theft

7

Global Disk Storage per Person

Latanya Sweeney

8

Field nameChild's first nameChild's middle name (sometimes or initial)Child's last nameDay, month and year of birthCity and/or County of birth (sometimes hospital)Father's nameMother's name (including maiden name)Place of birth (address and town/city)Mother's age and addressMother's birthplace (town/city, state, county)Mother's occupationMother, number of previous childrenFather's age and addressFather's birthplace (town/city, state, county)Father's occupation

Typical Birth Certificate Fields, post 1925

9

Field# Size Field name1 1 File Status2 50 Baby’s First Name3 50 Baby’s Middle Name4 50 Baby’s Last Name5 1 Baby’s Suffix Code6 3 Baby’s Suffix Text7 8 Baby’s Date of Birth8 5 Baby’s Time of Birth9 1 AM/PM Indicator

10 1 Baby’s Sex11 3 Blood Type12 1 Born Here?13 40 Place of Birth14 1 Facility Type

Typical Electronic Birth Certificate Fields in 1999 -starting fields 1-15

10

Field# Size Field name16 20 County of Birth17 6 Certifier’s Code18 30 Certifier’s Name19 1 Certifier’s Title20 30 Attendant’s Name21 1 Attendant’s Title22 23 Attendant’s Address23 19 Attendant’s City24 2 Attendant’s State25 10 Attendant’s Zip Code26 50 Mother’s First Name27 50 Mother’s Middle Name28 50 Mother’s Last Name29 9 Mother’s Social Security Number30 8 Mother’s Date of Birth

Typical Electronic Birth Certificate Fields in 1999 -starting fields 16-30

11

field# Size Field name31 3 Mother’s State of Birth32 7 Mother’s Residence Address33 2 Mother’s Residence Direction34 20 Residence Street Address35 10 Residence Type36 2 Residence Extension37 10 Residence Apartment #38 20 Mother’s Town of Residence39 1 Mother’s Residence in City Limits40 14 Mother’s County of Residence41 3 Mother’s State of Residence42 10 Mother’s Residence Zip Code43 38 Mother’s Mailing Address44 19 Mother’s Mailing City45 2 Mother’s Mailing State

Typical Electronic Birth Certificate Fields in 1999 -starting fields 31-45

12

Field# Size Field name46 10 Mother’s Mailing Zip Code47 1 Mother Married?48 50 Father’s First Name49 50 Father’s Middle Name50 50 Father’s Last Name51 1 Father’s Suffix Code52 9 Father’s Suffix Text53 9 Father’s Social Security Number54 8 Father’s Date of Birth55 3 Father’s State of Birth56 14 Mother’s Origin57 14 Mother’s Race58 2 Mother’s Elementary Education59 2 Mother’s College Education60 11 Mother’s Occupation

Typical Electronic Birth Certificate Fields in 1999 -starting fields 46-60

13

Field# Size Field name61 11 Mother’s Industry62 14 Father’s Origin63 14 Father’s Race64 2 Father’s Elementary Education65 2 Father’s College Education66 11 Father’s Occupation67 11 Father’s Industry68 1 Plurality69 1 Birth Order70 2 Live Births Still Living71 2 Live Births Now Dead72 4 Month/Year Last Live Birth73 2 Number of Terminations74 4 Month/Year Last Termination75 1 Baby’s Weight Unit

Typical Electronic Birth Certificate Fields in 1999 -starting fields 61-75

14

Field# Size Field name76 5 Baby’s Weight77 6 Date of Last Normal Menses78 1 Month Prenatal Care Began79 2 Total Number of Visits80 2 Apgar Score – 1 Minute81 2 Apgar Score – 5 Minute82 2 Estimate of Gestation83 6 Date of Blood Test84 22 Laboratory85 1 Mother Transferred In86 30 Facility Mother Transferred From87 1 Baby Transferred Out88 30 Facility Baby Transferred To89 1 Tobacco Use During Pregnancy90 3 Number of Cigarettes/Day

Typical Electronic Birth Certificate Fields in 1999 -starting fields 76-90

15

Field# Size Field name91 1 Alcohol Use During Pregnancy92 3 Number of Drinks/Week93 3 Mother’s Weight Gain94 1 Release Info For SSN95 6 Operator Code96 12 Hospital ID97 1 Sent to Romans98 1 Sent to APORS99 16 Other Certifier Specify

100 12 Temporary Audit Number101 16 Other Facility Specify102 16 Other Attendant Specify103 1 Mother’s Race104 1 Father’s Race105 2 Mother’s Origin

Typical Electronic Birth Certificate Fields in 1999 -starting fields 91-105

16

Field# Size Field name106 2 Father’s Origin107 1 Attendant Same YN108 1 Mailing Address Same YN109 1 Capture Father’s Info YN110 2 Mother’s Age111 2 Father’s Age112 12 Baby’s Hospital Med. Rec.113 1 High Risk Pregnancy YN114 1 Care Giver (For Chicago)115 1 Record Selected For Download116 1 Downloaded117 1 Printed118 12 Form Number

MEDICAL RISK FACTORS119 1 Anemia120 1 Cardiac Disease

Typical Electronic Birth Certificate Fields in 1999 -starting fields 106-120

17

Field# Size Field name121 1 Acute/Chronic Lung Disease122 1 Diabetes123 1 Genital Herpes124 1 Hydramnios/Oligohydramnios125 1 Hemoglobinopathy126 1 Hypertension, Chronic127 1 Hypertension, Preg. Assoc.128 1 Eclampsia129 1 Incompetent Cervix130 1 Previous Infant 4000+ Grams131 1 Previous Preterm or SGA Infant132 1 Renal Disease133 1 Rh Sensitization134 1 Uterine Bleeding135 1 No Medical Risk Factors

Typical Electronic Birth Certificate Fields in 1999 -starting fields 121-135

18

Field# Size Field name136 40 Other Medical Risk Factors

OBSTETRIC PROCEDURES137 1 Amniocentesis138 1 Electronic Fetal Monitoring139 1 Induction of Labor140 1 Stimulation of Labor141 1 Tocolysis142 1 Ultrasound143 1 No Obstetric Procedures144 40 Other Obstetric Procedures

COMPLICATIONS OF LABOR & DELIVERY145 1 Febrile (>100 or 38C)146 1 Meconium Moderate, Heavy147 1 Premature Rupture (>12 Hrs)148 1 Abruptio Placenta149 1 Placenta Previa150 1 Other Excessive Bleeding

Typical Electronic Birth Certificate Fields in 1999 -starting fields 136-150

19

Field# Size Field name151 1 Seizures During Labor152 1 Precipitous Labor (<3 Hrs)153 1 Prolonged Labor (>20 Hrs)154 1 Dysfunctional Labor155 1 Breech/Malpresentation156 1 Cephalopelvic Disproportion157 1 Cord Prolapse158 1 Anesthetic Complications159 1 Fetal Distress160 1 No Complications of L&D161 40 Other Complications of L&D

METHOD OF DELIVERY162 1 Vaginal163 1 Vaginal After Previous C-Section164 1 Primary C-Section165 1 Repeat C-Section

Typical Electronic Birth Certificate Fields in 1999 -starting fields 151-165

20

Field# Size Field name166 1 Forceps167 1 Vacuum

ABNORMAL CONDITIONS OF NEWBORN168 1 Anemia169 1 Birth Injury170 1 Fetal Alcohol Syndrome171 1 Hyaline Membrane Disease/RDS172 1 Meconium Aspiration Syndrome173 1 Assisted Ventilation <30174 1 Assisted Ventilation >30175 1 Seizures176 1 No Abnormal Conditions of Newborn177 40 Other Abnormal Condition of Newborn

CONGENITAL ANOMALIES OF CHILD178 1 Anencephalus179 1 Spina Bifida/Meningocele180 1 Hydrocephalus

Typical Electronic Birth Certificate Fields in 1999 -starting fields 166-180

21

Field# Size Field name181 1 Microcephalus182 40 Other CNS Anomalies183 1 Heart Malformations184 40 Other Circ./Resp. Anomalies185 1 Rectal Atresia/Stenosis186 1 Tracheo-Esophageal Fistula/Esophageal Atresia187 1 Omphalocele/Gastroschisis188 40 Other Gastrointestinal Ano.189 1 Malformed Genitalia190 1 Renal Agenesis191 40 Other Urogenital Anomalies192 1 Cleft Lip/Palate193 1 Polydactyly/Syndactyly/Adactyly194 1 Club Foot195 1 Diaphragmatic Hernia

Typical Electronic Birth Certificate Fields in 1999 -starting fields 181-195

22

Field# Size Field name196 40 Other Musculoskeletal/Integumental Anomalies197 1 Down’s Syndrome198 40 Other Chromosomal Anomalies199 1 No Congenital Anomalies200 40 Other Congenital Anomalies

CODE STRIP201 1 Record Complete YN202 1 Record Type203 4 Facility ID204 4 City of Birth205 3 County of Birth206 2 Mother’s State of Birth207 2 Mother’s State of Residence208 4 Mother’s Town of Residence209 3 Mother’s County of Residence210 2 Father’s State of Birth

Typical Electronic Birth Certificate Fields in 1999 -starting fields 196-210

23

Field# Size Field name211 14 Certifier’s License Number212 6 Laboratory ID Number213 4 Mother Xfer Code214 3 Mother Xfer County Code215 4 Baby Xfer Code216 3 Baby Xfer County Code217 4 Year of Birth218 7 Certificate #219 1 Unique Code220 8 File Date221 2 Community Area222 4 Census Tract223 2 Century of Last Live Birth224 2 Century of Last Termination225 2 Century of Last Menses226 2 Century of Blood Test

Typical Electronic Birth Certificate Fields in 1999 -starting fields 211-226.

24

25

26

Four vignettes

• Everyone can snoop• What they have on you• Getting sensitive information from public data• Do-it-yourself identity theft

27

28

De-identified records

29

Two separate data bases

De-identified medical research database

Voter registration list

30

Re-identification

Find records with the same values in the overlapping fields

31

{date of birth, gender, 5-digit ZIP} uniquely identifies 87.1% of USA pop.

32

Arkansas Juvenile Offender Records

White, Female,

DOB 1979, April 9

33

Four vignettes

• Everyone can snoop• What they have on you• Getting sensitive information from public data• Do-it-yourself identity theft

34

Student application

Basic information and School Information

35

Basic Information Necessary For a Credit Card Application

• Name• Social Security number• Address• Date of birth• Mother’s maiden name

If one can identify these fields for a person, they have the basic information needed to acquire a credit card in that person’s name.

Do these first.

Historical Highlights of the SSN

• 1935 Social Security Act SSNs only to be used for the social security program.

• 1943 Executive Order 9397 Required federal agencies to use SSNs in new record systems

• 1961 IRS began using SSN As taxpayer identification number

• 1974 Privacy Act Government agencies use of SSN required authorization and disclosures (exempt agencies already using SSN)

• 1976 Tax Reform Act Granted authority to State and local governments to use SSNs: state and local taxes, motor vehicle agencies

•Over 400 million different numbers have been issued. Source: Social Security Administration, http://www.ssa.gov/history/hfaq.html

37

Quality of the SSN Assignment

Ability to acquire the number and use it falsely grows as more copies of the number are stored for different purposes while possible benefits of misuse have rewards (even if illegal).

A Social Security number is almost always specific to one person and one person typically has a unique SSN. There are exceptions.

38

Unusual case of SSN 078-05-1120 Used by thousands of People

In 1938, a wallet manufacturer provided a sample SSN card, inserted in each new wallet.

The company’s Vice President used the actual SSN of his secretary, Mrs. Hilda Schrader Whitcher.

The wallet was sold by Woolworth and other stores. Even though it had the word "specimen" written across the face, many purchasers of the wallet adopted the SSN as their own. In the peak year of 1943, 5,755 people were using it. SSA voided the number. (Mrs. Whitcher was given a new number.) In total, over 40,000 people reported this as their SSN. As late as 1977, 12 people were still using it.

Source: Social Security Administration, http://www.ssa.gov/history/ssn/misused.html

39

SSNs are Encoded Numbers

Format: AAA-GG-NNNN

The encoding is based on how the numbers are issued. They typically situate the recipient in a geographical area within a time range. They may also reveal whether the person is an immigrant, an alien, or a worker on the railroad.

AAA is area code

GG is group code

NNNN is serially assigned number

40

First 3 digits Provide the State of Issuance, 1

001-003 New Hampshire004-007 Maine008-009 Vermont010-034 Massachusetts035-039 Rhode Island040-049 Connecticut050-134 New York135-158 New Jersey159-211 Pennsylvania212-220 Maryland221-222 Delaware223-231 Virginia691-699*

232-236 West Virginia232 North Carolina237-246681-690247-251 South Carolina654-658252-260 Georgia667-675261-267 Florida589-595766-772268-302 Ohio303-317 Indiana

Source: Social Security Administration, http://www.ssa.gov/foia/stateweb.html

41

First 3 digits Provide the State of Issuance, 2

318-361 Illinois362-386 Michigan387-399 Wisconsin400-407 Kentucky408-415 Tennessee756-763*416-424 Alabama425-428 Mississippi587-588752-755*429-432 Arkansas676-679

433-439 Louisiana659-665440-448 Oklahoma449-467 Texas627-645468-477 Minnesota478-485 Iowa486-500 Missouri501-502 North Dakota503-504 South Dakota505-508 Nebraska509-515 Kansas

Source: Social Security Administration, http://www.ssa.gov/foia/stateweb.html

42

First 3 digits Provide the State of Issuance, 3

516-517 Montana518-519 Idaho520 Wyoming521-524 Colorado650-653525,585 New Mexico648-649526-527 Arizona600-601764-765528-529 Utah646-647

530 Nevada680531-539 Washington540-544 Oregon545-573 California602-626574 Alaska575-576 Hawaii750-751*577-579 District of Columbia580 Virgin Islands

Source: Social Security Administration, http://www.ssa.gov/foia/stateweb.html

43

First 3 digits Provide the State of Issuance, 4

580-584 Puerto Rico596-599586 Guam586 American Samoa586 Philippine Islands700-728 Railroad Board**

* Some states may share the same area by transfer or split.

** Railroad employees, discontinued July 1, 1963.

000 will NEVER start a valid SSN.

Source: Social Security Administration, http://www.ssa.gov/foia/stateweb.html

44

SSNs are Encoded Numbers

Format: AAA-GG-NNNN

The encoding is based on how the numbers are issued. They typically situate the recipient in a geographical area within a time range. They may also reveal whether the person is an immigrant, an alien, or a worker on the railroad.

AAA is area code

GG is group code

NNNN is serially assigned number

45

Digits 4 and 5, Order of Issuance

Called the Group numbers. Not assigned sequentially, but in the following order:

ODD - 01, 03, 05, 07, 09  EVEN - 10 to 98

After all in 98 are assigned, then EVEN - 02, 04, 06, 08 ODD - 11 to 99

Source: Social Security Administration, http://www.ssa.gov/foia/ssnweb.html

46

Result

Knowing where the SSN was assigned tells you the digits 1-3

Knowing when the SSN was assigned tells you digits 4-5

Source: Social Security Administration, http://www.ssa.gov/foia/ssnweb.html

47

Quiz

• Name a problem with the SSN as an identifier

48

One Approach is to Buy an SSN

http://socialsecuritypeoplesearch.com/index.asp

49

One Approach is to Buy an SSN

http://socialsecuritypeoplesearch.com/index.asp

50

Reportedly Permissible Purposes for Purchasing an SSN On-line, 1

http://socialsecuritypeoplesearch.com/index.asp

Locating Missing PersonsChild Support EnforcementSkip TracingCollectionsPeople Locator ServiceLocating AlumniOther Legal, Normal Business UseJudgement on SubjectApprehending CriminalsLaw Firm -Fiduciary Interest

51

Reportedly Permissible Purposes for Purchasing an SSN On-line, 2

http://socialsecuritypeoplesearch.com/index.asp

Legal Process ServiceLegal ResearchFinding Owners of Unclaimed GoodsFraud and Loss PreventionGovernment AgencyInsurance Claims InvestigationsInvestigation of Civil LitigationJournalistic EndeavorsLaw EnforcementLicensed PI

52

Reportedly Permissible Purposes for Purchasing an SSN On-line, 3

http://socialsecuritypeoplesearch.com/index.asp

Locate Former Patients (Medical Industry Only)Locating Beneficiaries and HeirsLocating Existing CustomersLocating Former CustomersLocating Former EmployeesLocating Fraud VictimsLocating Pension Fund BeneficiariesNecessary to Complete TransactionPermission from SubjectProduct Recalls

53

Reportedly Permissible Purposes for Purchasing an SSN On-line, 4

http://socialsecuritypeoplesearch.com/index.asp

Resolve Customer DisputesSearch on MyselfTo give to a Court of LawWitness and Victim LocatingAsset IdentificationCourt Related

54

Another approach is to use Google

• People posting their own SSNs

• Professors posting their students SSNs

http://socialsecuritypeoplesearch.com/index.asp

55

56

57

58

59

Student application

Basic information and School Information

60

Publicly Available Birth Records

Not all states, but many consider birth records, the kind of information included on a person’s birth certificate in the United States, as publicly available information.

A few states have gone further to provide this information on-line.

In the United States, birth certificate information tends to include the mother’s maiden name!

61

California on-line Birth Records

Results of search on ‘Jones’

Source: http://www.vitalsearch-ca.com/gen/_nonmembers/ca/_vitals/cabirths-nopsm.htm

62

Student application

Basic information and School Information