DATE: Tuesday, April 8, 1997                TAG: 9704080342

SECTION: FRONT                   PAGE: A10  EDITION: FINAL 

SOURCE: THE WASHINGTON POST

DATELINE: WASHINGTON                        LENGTH:   75 lines

SOCIAL SECURITY'S WEB SITE CONCERNS PRIVACY ADVOCATES BUT ADMINISTRATION OFFICIALS INSIST THEY'VE INSTALLED FOOLPROOF SECURITY MEASURES.

The Social Security Administration has made it easier for you to get your own financial information - straight off of the Internet!

But privacy advocates say there's a problem: just about anyone else can, too. All that's needed is a person's name, Social Security number, mother's maiden name, date and place of birth - information that is not that hard to get.

The SSA began offering the new feature last month on its site on the World Wide Web. The system was designed to give consumers easy access to their own ``Personal Earnings and Benefits Estimates Statement,'' the amount of benefits taxpayers may receive, as well as earnings records going back decades. It's the kind of data many consumers want for retirement planning and the like, but in the past consumers had to go to the local Social Security office to get it.

SSA officials Monday insisted that they were abiding by high standards of consumer protection. ``Security and privacy have always been a big priority at the agency,'' said spokesman Phil Gambino. ``We think we've built in safeguards to make it a secure system.''

Penalties for abusing the database are stiff. Gambino said that the system keeps track of users, and that any abuse that's detected will be punished with up to 10 years in jail and a fine of $10,000 for every offense. But the Internet is available anonymously from within corporate networks and cyber-cafes or from Web sites that strip away identifying information, and Gambino could not say whether the tracking mechanisms could be defeated in that way.

Aspects of the service have been around since last year, when the agency allowed people to order their benefits statement from the agency Web site (http://www.ssa.gov) to be mailed. About 95,000 people took advantage of that program. Then last month, the agency took the process a step further and made the records instantly available at the Internet site to anyone who typed in the required information.

That's when the shouting started.

Monday a front page story in USA Today characterized the new service as a threat to personal privacy. Instantly, the site was so jammed with online rubberneckers that it was virtually impossible to get in. The number of queries to the system jumped from an average of 10 each second to 80, said Bruce Carter, who runs the online site for the agency. The article said the online system ``gives nosy neighbors, ex-spouses, prying relatives and just about anyone else'' the ability to gather up detailed financial data ``if they have some very basic information.''

That ``very basic information'' should help lock the door to the data. But Deirdre Mulligan, a privacy expert with the Center for Democracy and Technology, a high-tech policy group in Washington, asked, ``If the three parts of a key are all available in public databases, is it a good key?''

Ironically, one of the weakest parts of the key could be the element rightly in the agency's bailiwick, Mulligan said: ``There's been so much pressure on individuals to provide the Social Security number in contexts outside of the Social Security Administration that they've basically busted a hole in the system. It's very hard for the Social Security Administration to put a secure lock on that door.''

A database with so much detailed financial information would also be a mother lode for those who build false identities for committing fraud, said Joseph Seanor, a private investigator. ``Every hacker's going to want to get into that'' for the ability to get financial records ``on millions of people at the same time.''

But a leading privacy advocate said Monday that the Social Security Administration's action fits the adage that no good deed goes unpunished. ``What the Social Security Administration has done is made it possible for millions of Americans to get important information for disability benefits and retirement planning quickly and easily without cost,'' said Marc Rotenberg, head of the Electronic Privacy Information Center. ``That's a good thing.

``The truth is, privacy is not simply about preventing others from getting information about you,'' said Rotenberg, who teaches privacy law at Georgetown Law Center. ``It's also about your right to get access to information about yourself,'' and to correct mistakes in the record.

Send Suggestions or Comments to webmaster@scholar.lib.vt.edu