Schneier on Security

tamara • March 27, 2007 4:06 PM

I’m finding it interesting that the fundamental rules of protecting oneself from identity theft–like not giving out one’s SSN or birth date unneccessarily–are apparently completely disregarded by government hiring agencies.

I recently moved to Arlington, VA and am job hunting. I’d like to work for the NSF, and of course the other job opportunities here are often government or government related.
Apparently, these types of jobs, (and I know for sure NSF and the TSA), REQUIRE that I give up my SSN and birthdate on an ONLINE submission form just to apply for a job.

From the NSF FAQ page:

“Q. I’m uncomfortable using my Social Security Number. Is there any way I can fill out an application without it?

A. No. Your Social Security Number (SSN) is one of the few reliable means government agencies have of distinguishing one applicant from another. We request your SSN under the authority of Executive Order 9397 in order to keep your records straight, other people may have the same name. As allowed by law or Presidential directive, we use your SSN to seek information about you from employers, schools, banks, and others who know you. Your SSN may also be used in studies and computer matching with other Government files, for example, files on unpaid student loans. If you do not give us your SSN or any other information we requested, we cannot process your application, which is the first step in getting a job. Also incomplete addresses and ZIP codes will slow processing. In addition, eRecruit is a secure, encrypted website and your Social Security Number cannot be accessed by anyone who is not directly involved in the hiring process.

Q. Why am I required to provide my date of birth?

A. We ask for your date of birth (DOB) in order to verify your password if you lose or forget it. The only way we can reset your password is to first, verify that you are who you say you are is by matching not only your social security number but also your date of birth. If we do not verify that you are who you say you are, there is a risk that someone else could pose as you and change your information or access your personal data. The selecting official will never see your date of birth; only the HR Specialist could access that information after the position has closed. By requiring both the SSN and DOB we ensure the highest level of security for your information, which is why the system will not allow you to proceed without inputting your date of birth.”

So which is it? Who is responsible for the safety of my identity and data, me or the government? Me, or my economic circumstances? I personally don’t believe that any agency that has people apply online , and online ONLY, can guarantee my data privacy–it just doesn’t make sense, or take into account the nature of the internet and the various parameters of online access and vulnerability. But then again, I have read too much Schneier and had my own real world experiences with “the sure thing of online security”.

I actually applied for a low level TSA job at a recent job fair, a job far below my training, just to try to get a job, and the TSA called me and asked me for my SSN. They wouldn’t give me a callback number to verify their identity, just told me to go to the web and put my SSN in there. That was for a $12 dollar an hour job. Can you imagine how many poor people are giving out their SSN’s to hopefully get a job or interview?

I find myself in the gray zone of security tradeoffs–I need an income, so maybe I’ll have to compromise my own standards of security and give up my identifying data in a public arena like the internet, just to hopefully be considered for a cubie job. Reminds me of an Orwell novel. 🙂

Tamara, jobless in the nation’s capitol