Death Master File

Definition

The Social Security Administration (SSA) Death Master File (DMF) is a publicly available database distributed by the National Technical Information Service (NTIS) recording the Social Security Numbers (SSNs), names, dates of birth, dates of death, and states of SSN application for individuals whose deaths have been reported to the SSA. Originally designed as a fraud-prevention tool (allowing lenders and employers to detect identity thieves using deceased individuals' credentials), it became the training set for a statistical attack that can predict living individuals' SSNs entirely from public birth data.

Key Ideas

The DMF contains records for the majority of deceased Americans whose deaths were reported to SSA, sourced from family SSA benefit claims, state vital records, and other administrative sources. Not all deaths are captured — the coverage rate improves over time.
Intended use: Fraud detection. Financial institutions, employers, and government agencies query the DMF to catch attempts to use deceased persons' SSNs. Also used for mortality verification in research contexts.
Research use: The DMF is a standard source for mortality follow-up in studies using administrative records. Researchers link study cohorts to the DMF to ascertain date of death when vital records are unavailable.
The Acquisti-Gross vulnerability: Because the SSA's Enumeration at Birth (EAB) program (launched nationally ~1989) resulted in SSNs being assigned within days of birth, DMF records from post-1989 decedents reveal highly regular, date-ordered patterns in SSN assignment. An attacker can analyze these patterns and then predict living individuals' SSNs from their birth date and state alone. See Acquisti and Gross 2009 — Predicting Social Security Numbers from Public Data.

How It Works

The SSN assignment scheme (pre-2011) consisted of:

Area Number (AN): First 3 digits, assigned by state/zip of application — publicly documented.
Group Number (GN): Digits 4–5, assigned in a nonconsecutive but deterministic order — publicly documented.
Serial Number (SN): Digits 6–9, assigned consecutively (0001–9999) within each AN+GN combination.

EAB meant that post-1989 newborns' SSNs were assigned within days of birth, so birth date effectively indexes position in the AN+GN+SN sequence. DMF records, sorted by state and birth date, reveal these cyclical sequential patterns visually and statistically. The algorithm predicts the most common ANGN (mode) among DMF records with nearby birth dates in the same state, then regresses SN on birth date to predict the last 4 digits.

SSA's 2011 Response

In June 2011, the SSA began fully randomizing SSN assignment — abandoning geographic area numbers and sequential serial numbers entirely. New SSNs issued from that date forward are statistically unpredictable from birth data. However, the vulnerability remains for all SSNs issued before June 2011, which cannot be revoked or changed.

Post-2011 DMF Access Restrictions

Following the Acquisti-Gross paper and related privacy concerns, the SSA and Congress restricted public access to the full DMF. Since 2011, only a "Limited Access DMF" (excluding deaths reported solely by state agencies) is available to the general public through NTIS. Federal agency researchers can still access the full file. This restriction addresses the oracle problem (attackers can no longer use the full DMF as a training set) but does not eliminate the predictability of pre-2011 SSNs.

Why It Matters

Research validity: Studies using DMF for mortality follow-up need to be aware of coverage gaps — the public DMF misses deaths known only to state vital records; the full SSA Death File has better coverage but is access-restricted.
Privacy policy: The paper is a canonical example of unintended privacy consequences of antifraud policy and of data combination attacks: individually innocuous public datasets (birth records + DMF) yield sensitive private inferences at scale.
Authentication infrastructure: The vulnerability exposed the systemic weakness of using SSNs — originally just account identifiers — as authentication devices. Remediation requires replacing SSN-based authentication, not just protecting the numbers.

Open Questions

How accurately does the post-2011 restricted DMF still enable the attack on pre-2011 SSN holders?
What fraction of the ~200 million living Americans who received pre-2011 SSNs remain practically vulnerable given that birth data is now more constrained (Children's Online Privacy Protection Act (COPPA) restrictions on social network profiles, etc.)?