Social insecurity

WHEN SOMEONE hacks into a computer database, the initial questions are usually the same as with any other kind of theft: What was stolen? How did it happen? What are the thieves planning to do with what they got? But this new kind of robbery also raises a new kind of question: Why was the institution keeping the data in the first place?

This week, UCLA revealed that a hacker may have gained access to the records of about 800,000 students, faculty, alumni and staff. University officials are addressing the initial questions as well as they can. The bigger question is why UCLA -- and many other businesses and agencies -- need everyone’s Social Security numbers, the golden key to identity theft. The answer is that they don’t, at least not in their databases.

The UC system is in the midst of a two-year effort to move from Social Security numbers to student identification codes in its computer records. But UCLA still puts the Social Security numbers of new students into its computer system, a practice it is now reevaluating.

Social Security numbers are commonly required for employment, bank and credit checks and by some government agencies. But they’re also routinely requested by doctors, schools, phone companies, even health clubs. Consumers too readily assume they have to provide the information instead of asking why it’s needed.

Because so many places use Social Security numbers to organize their records, each nine-digit string becomes associated with a mother lode of data about individuals and their activities. Making matters worse, many of those companies also use the number to grant access to people’s records under the erroneous assumption that only John Smith would know John Smith’s Social Security number. This practice is so prone to abuse that some privacy advocates want to make all Social Security numbers public as a way to force companies to find other ways to identify and authenticate the people in their databases.

The UCLA incident is just the latest in a string of reminders that all data held in a computer network are vulnerable to theft. The lesson for those who collect data isn’t just that they have to take more steps to guard against hackers, but also that they should avoid collecting Social Security numbers. When they can’t, they should keep those records separate from other databases.