Acquisti and Gross 2009 — Predicting Social Security Numbers from Public Data

Summary

Using the Social Security Administration (SSA)'s publicly available Death Master File (DMF) as a training set, Acquisti and Gross show that an individual's full 9-digit Social Security number (SSN) can be predicted with high accuracy from only their birth date and state of birth. The Enumeration at Birth (EAB) program (launched nationally in 1989) dramatically increased the correlation between birth timing and SSN assignment, making post-1989 cohorts especially vulnerable. The vulnerability is structural and universal — unlike data breaches, it applies in principle to any SSN issued under the old scheme.

Key Claims

• First 5 SSN digits — area number and group number (ANGN) — matched with a single attempt: 7% for 1973–1988 births; 44% for 1989–2003 births (weighted across states).
• Complete SSN matched in <1,000 attempts: 0.8% for pre-1989 births; **8.5%** for post-1988 births. For small states in recent years, >60%.
• Credit reporting agencies (CRAs) accept inquiries where only 7 of 9 digits are correct, multiplying practical risk ~100×: 9.2% of post-1988 SSNs passable with ≤10 attempts.
• The entropy of an SSN drops from ~30 bits (random) to as low as 11 bits (worst-case small states) once birth data and DMF patterns are combined.
• Validated on 621 living university students (Institutional Review Board [IRB]-approved): DMF-derived model accurately predicted first 5 digits for 6.3% in a single attempt, with roughly one-third of those predictions within 1,000 integers of the true SSN.
• Policy implication: SSNs cannot be revoked; restricting first-5-digit exposure is futile because those are the digits easiest to infer. Full assignment randomization is the only structural fix.

Concepts Introduced or Extended

• Death Master File — demonstrates that a publicly available fraud-prevention database can be reverse-engineered to facilitate the very fraud it was designed to prevent
• SSA Administrative Data Systems — DMF as a sixth key SSA data resource; privacy vulnerability of its public accessibility

Entities Mentioned

• Alessandro Acquisti
• Ralph Gross

Quotes

"Unlike data breaches, which are local threats (that is, specific to the records contained within a certain database, however large that may be), the predictability we observed is universal, in that applies, in principle, to any current and future SSNs—unless their assignment scheme is modified."

"SSNs were designed as identifiers at a time when personal computers and identity theft were unthinkable; today, abused as authentication devices, they enable an 'architecture of vulnerability.'"

My Take

The paper is a clean proof-of-concept for the general principle that aggregating individually innocuous public data sources can expose private information at scale. The key insight is that an antifraud policy (EAB) inadvertently created the vulnerability by increasing the informativeness of birth metadata about SSN assignment — a canonical example of unintended privacy consequences of well-intentioned policy. The paper directly prompted SSA to fully randomize SSN assignment in June 2011 (SSA 2011 Federal Register). Limitations: prediction is probabilistic (not deterministic), accuracy falls sharply in large states and pre-1989 cohorts, and real-world identity theft requires the attacker to also access a verification oracle (a credit reporting agency or the SSN Verification Service [SSNVS]). The botnet attack scenario is illustrative but optimistic about adversary coordination.