X

Social Security site closed

The Social Security Administration bows to pressure and closes a site that lets people look up their work histories.

CNET News staff
5 min read
Bowing to public pressure and concerns about security, the Social Security Administration this afternoon abandoned a service that lets users get employment histories online.

The agency didn't admit that there is an actual security problem but conceded that the perception problem undermines the value of the service.

The system lets users look up a person's salary information, the amount of taxes paid to Social Security and Medicare, and the Social Security benefits for which that person is eligible.

While no one found any instances in which the information in the database was used fraudulently, John Callahan, acting commissioner of Social Security, said he was responding to the widespread fear that the Internet makes it too easy to get at personal data.

"Nothing--let me repeat that--nothing is more important to Social Security than maintaining the public's confidence in our ability to carry out one of our primary missions of protecting privacy of the sensitive data we maintain on American citizens," he said in a statement.

"That confidence has been questioned over the last few days. That is why today I am suspending the online PEBES (Personal Earnings and Benefit Estimate Statement) service in order to conduct a rigorous evaluation of the system's security features."

He said the administration will use public forums across the nation for the next 60 days "to obtain input from experts in the areas of privacy and computer security, as well as others who wish to have their voices heard."

Callahan was reacting to widespread panic over the PEBES online service stemming from a series of published reports about the system this week.

In fact, several of the nation's legislators sent a letter to the Social Security Administration asking them to stop using the Internet to transmit this vital information because of security concerns.

But experienced Netizens today wondered if the whole uproar isn't just another case of Internet hysteria.

The same service has been offered through the U.S. mail for ten years. And in the entire decade of providing the exact same information through the Postal Service--salary history and benefits estimates--there have been virtually no security-related complaints, said administration spokesman Tom Margenau.

By mail, the administration requires people to submit their full name, their date of birth, place of birth, Social Security number, and mother's maiden name. The same information is required online. The only difference is that the mail-in form requires a signature.

Margenau acknowledged that the system is not perfect: Someone could theoretically get that information and request a salary history. But he said this can be done by mail nearly as easily as through the public network, and there were no indications of any problems with the server.

Karen Coyle, a privacy expert with Computer Professionals for Social Responsibility said the Social Security Administration was in a no-win position.

On the one hand, people are calling for the government to make information available easily, quickly, and safely. The Social Security Administration, in this case, seems to have fulfilled all the requirements.

On the other hand, the agency still faces an outcry from the nation's top legislators. "Here we are complaining because the government's inefficient," she said. "And we're hindering it in its efforts to become efficient using this technology."

The system looks fairly secure, Coyle said, and she praised it as an example of how technology can be used to benefit society. "I think we should give them credit for doing what looks to me like fairly reasonable security," she said of the agency's site before it was pulled. "From what I understand, it's pretty well protected."

Coyle said she didn't understand the reasoning behind the senators' concerns. "There's a very good chance these senators do not understand computer security," she said.

Nevertheless, the issue clearly hit a nerve in the public. "My own brother called me," the SSA's Margenau said. "and he, like many people, thinks that his Social Security data is floating around in cyberspace and anybody can download this information into their system.

"Even though we've had no problems with mail system and it's the same system, somehow people think it's easier to cheat the system using computers."

The agency's site had been besieged since Monday. Even before it closed down this afternoon, people were having a hard time getting on because it was so crowded, Margenau added.

"We've gone from a rather modest, relatively quiet site that was getting 3,000 hits a day to...the most popular Web site in the country," he said. "Literally overnight, we jumped from Monday to Tuesday to 85,000 hits a day."

Despite the uproar, Margenau said no one had actually made a specific complaint about security concerns. "So far there have been a lot of allegations," but no complaints.

Through the end of March, there were 27,000 requests for information, 9,000 of which were rejected because they didn't meet standards.

Ironically, the only complaints about the service before Monday came from people who thought the security screening was too rigid, Margenau noted.

As with any computer system where private information is offered, the administration is in the position of trying to balance security concerns with the public's right to get information.

"We have to make sure we don't make things too burdensome by building in too many levels of security that the average American doesn't think we're doing them a disservice," Margenau said.

Coyle added that this appears to be a good use of emerging technologies. But as the technologies are put into use, Americans clearly are worried that their privacy will be violated.

In some cases, the fury over the Internet and privacy has made people aware that much of their private information is not really private and never really was.

"To some extent, I see incidents like this being wonderful methods of public education," she said. "We don't hear about all the information available through conventional sources because that isn't news. When hysteria is well-placed, I see it as a good consciousness-raising," she said. "But in this case, I'm not sure it's well-placed."