US Secret Service: “Massive Fraud” Against State Unemployment Insurance Programs | Hacker News Reader

US Secret Service: “Massive Fraud” Against State Unemployment Insurance Programs

krebsonsecurity.com

676 pointselsewhen619 comments

I am amazed at how well these criminals from another country know the details of the systems in the US when we in the US have probably a handful of people who understand the end-to-end line they do.

I am not surprised this is happening. The small offices in each state are responsible for 100s of millions of dollars and they awfully unequipped for it. This is sort of thing that the federal government should do and provide a portal for each state to use so that they can track and do stuff across states to look for fraud. However i don’t know if states rights and separation of duties screws this up.

people in business in the USA hire outsiders to do the dirty work, or afterwards such relationship leaks the details provided, to others who are just willing.. Why is USA federal IT work outsourced three times before it is done? What USA business owners, former owners, their accountants and others, are just in it for the money and tired of others winning while they work so hard and lose, etc.. SO .. there is some collusion across borders, most likely

> when we in the US have probably a handful of people who understand the end-to-end line they do.

Is it a hard thing to understand or is it just something that doesn't get done?

I work for a municipal government (not in social assistance though). Very little is documented, not because it would be hard to do so, but because first everything from budget to approved software for documentation to time allocation to 5 different approvals would be required to do it. We are terrible at sharing information internally, so every thing would require meeting after meeting to chase down who knows what as well.

Actually documenting the system I work on would take 1-2 days. But we initiated an overarching documentation plan in November and it is still being worked on (if it has not died from neglect).

> I am amazed at how well these criminals from another country know the details of the systems in the US when we in the US have probably a handful of people who understand the end-to-end line they do.

It’s quite literally a criminals job to understand and abuse these systems, and there’s very clear link between their performance and their reward. Makes for a good motivator.

People frequently underestimate criminals because they don’t appreciate that these individuals are doing this work as full time job. I’m sure if you spent 8 hours a day for week, you’ll have an equally good understanding.

I always find it ironic that for all but the most lucrative criminal enterprises, if the criminal applied the same amount of effort towards pursuing legitimate employment, they would come out ahead (adjusted for risk of course).

Some people just enjoy "getting over" more, to the point that they will discount their labor used for such schemes.

Adjusted for location as well. I'm very skeptical that these Nigerians can find anything this lucrative within their own country.

How do you know that to be true?

Social engineering, much hacking, scamming, etc. don't care about race or gender or connections or degrees, all of which are very real things limiting people's professional success. Many can be done without interacting with a team and without any kind of interview, both of which are skills.

I doubt these people are discounting their time or labor. They might be optimizing for the opportunities available to them. Willingness to do something illegal could reasonably be seen as an arbitrage opportunity—something seen in business all the time.

There's a famous bit of research done by the guy who wrote Freakonomics.

He tracked how much drug dealers were actually making and found that if they just got a job at McDonald's they'd have a higher income.

If I remember correctly, that was for low level weed dealers, not scamming financial systems. A successful identify theft of a middle or upper income family will reap a payout much greater than a fast food worker.

Dealing drugs can also offer a much higher degree of flexibility to conventional work

When I was a teenager, I tried to work at McDonald's over one summer break.

They turned me down.

Freakonomics is an awful representation of economics. It's literally a collection of anecdotes and uncontrolled experiments.

I can say, based on my own observations, that is absolutely nowhere near true. Many people selling drugs to their friend groups make profit in excess of $400 a day, tax free.

I can't speak for a larger group, of course. Perhaps the average is weighed down by more casual actors.

It's only tax free if you're stupid enough not to launder the money.

I don't think that an individual proprietor earning only 100k would have a motivation to do that. One can pay rent, buy vehicles, and purchase most everything else with cash. Why give 40% to the government? Social responsibility is great, but not if it's going to get you interdicted as a drug dealer.

You can do that, but at some point you might be asked to explain how you manage to rent a nice apartment and own a car without earning any income. Outright tax fraud isn't really any more of a sensible risk to take if you're a career criminal than it is if you work a regular job. After all, they got Capone for tax evasion.

It's more likely that they'll be caught up in enforcement of controlled substance trafficking laws, and those are the more severe charges the authorities tend to pursue.

Is it? It's quite difficult to prove that someone is involved in trafficking controlled substances, if they're careful. It's not difficult to show that someone is committing tax fraud if they have a big house and a car and zero declared income.

Most people involved in such activity have incriminating communications that are very easily used in court such as text messages. The bar for proving that various messages are evidence of illegal activity is surprisingly low. One individual not only has to be very careful, but also enforce the same level in everyone who communicates with them while providing customer service (e.g. making customers happy, feel good l, not offending them and so forth).

The issue of tax fraud is only an issue if they investigate you - someone in the tax department would have to find a reason to take notice. In the case of a narcotics trafficker it's more likely that activity would be observed by drug investigators than for the tax department would determine there's someone paying a mortgage or rent that isn't a significant income tax payer. That's not really how tax investigations work.

The case for crime is, in fact, pretty clear-cut you have a bright mind, an appetite for risk, and resist societal expectations about orderly conduct - i.e. it is another flavor of "startup founder".

You only need one big score where you get away clean and you're done, your criminal career is complete in one go and you can retire. Compare that to all the fuss of operating within society, the social signalling and bargaining and courting of gatekeepers - that's only worth it if you've been groomed for it in some way.

And computer crime is as clean as it comes, in terms of the kind of damage done. The ultimate purpose is simple - change some database rows! No bashing of heads or physical entry to property needed. With appropriate choice of targets, you pass the resulting crisis over to some figurehead executive who mumbles for a bailout from the government. Numbers are shifted around again after some delay and everyone is happy.

By contrast the SV startup dynamic is one of gaining overt power over others, not just getting a high score. The product and platform acts as a Trojan Horse for this subjugation, powered by a belief(oftentimes a sincere one) that this is a grand humanitarian project, which in turn inspires cult thinking. Then to even get in as a worker, you have to fit into the cultural mold. Your userbase is likewise fostered towards dependence and ushered to mega-scale, data-driven extraction, if not immediately, then later, after the company is acquired. It's all quite a long schlep if you just like working with technology to help people.

>You only need one big score where you get away clean and you're done

The laughable part is here. People bring their problems with them. The kind of person who would pull off a big score, such as a brilliant hack or a bank robbery, won't retire to the Oregon coast and drive at or below the speed limit for the rest of their lives. A lot of those traits are traits of antisocial personality disorder. People like that are magnets for trouble. They won't lie low and relax for the rest of their days.

It's a lie criminals are not professionals. It comes with a set of other rules, rituals and codes. The money is not a big score but an unlimited amount of cashflow. The antisocials are the ones blowing up a money printing machine just for the sake of their ego. Have you ever seen estimates of the grey economy? That world is running way more efficient than civilian life because of the stakes. Guys like Pablo get that famous because he had an antisocial personality and had to blow up an airplane while he was one of the most richest billionaires in the world.

Antisocial personality disorder is almost a prerequisite for career criminals. Disagreeable enough to commit crime and not feel bad about it, extroverted enough to enter or form a gang, and low enough in neuroticism to keep your cool under pressure. I'm not trying to paint all antisocial people as "bad". It's also a personality configuration that works well in certain military positions.

Maybe. I don't have faith that the world is that meritocratic. I don't know many criminals, but I know people who are smart and competent, but who've fallen into careers with low pay and no room for advancement. Crime is something that doesn't require the resume or capital of legitimate options.

It’s very very easy in the modern world to end up in a situation where you’re not allowed to contribute positively and have very few options other than crime.

You mean with some kind of criminal record, or just a dead end career? Because the latter is your starting point, not your end point, when it comes to deciding whether it pays better to put subsequent effort into figuring out how to profit via crime versus finding better legitimate ways to make money.

I think you overestimate the lucrative opportunities available to hard-working honest people especially in developing countries where a lot of these operations are based

I don't think that's true. The criminals you hear are the only ones who get caught.

In fact, I would say criminal activities have a higher risk-adjusted return than legitimate activities, simply because there's less "supply" in this labour market due to moral reasons and risk-aversion.

As an example, let's say you find a zero-day that gives you access to any FAMG account. Their responsible disclosure programs will pay you probably ~$31,337 (real example from Google).

If you sell that on the darkweb as a "hax any Google account as service", while it is more effort, you could absolutely clear multi-millions from it (charge $50k per account hijack; which itself can lead to millions in fraud profits or selling intellectual property; etc; can maybe pull this off 50 times before it gets patched = $2.5 million).

Not to mention you'd probably be able to sell it to Saudi Arabia and Israel for anywhere from six to eight digits too depending on their operational needs.

So that's a >80x increase in earnings if you go the criminal route. It's more work, but there are brokers who will happily do the heavy lifting for you in exchange for taking a cut of the profits.

And if you reside in a country where the government essentially encourage hacking Western companies as long as you don't hack properties of your own nation (e.g. China; Russia), then the risk to you is virtually zero (as long as you don't plan to travel to a western-extradition country).

  for all but the most lucrative criminal enterprises

What you described is top-notch hacking and super high risk (99,99% of such criminals probably never deal directly with governments).

Seems similar to claim that acting pays well and take the example of Tom Cruise to prove it.

The recent interview of Marcus Hutchins says something else: he's been working full time as black hat and realized afterwards that being a white hat pays better.

Marcus Hutchins simply didn’t understand the business side of things.

He had his fingers in his ears singing la la la

I work in preventing financial crime, so I have some useful context on this.

Unless your hitting the big leagues (stealing millions to tens of millions of dollars) then the odds of you actually getting caught and prosecuted are basically 0.

This sounds silly, but it’s mostly driven by the fact that most traditional law enforcement agency (i.e. the police) don’t understand or are interested in preventing financial crime. It’s too abstract, doesn’t have a physical component, and frequently the criminals will be completely different jurisdictions to victims.

Even when you provide the police with the home address and photo ID of a financial criminal to the police, they usually won’t do anything. Again they don’t understand the crime, they don’t have the training to investigate and they don’t know what evidence is needed to prosecute. Finally the police are usually rated by the public on the number of shootings and stabbing that didn’t happen, rather than dollars not stolen.

So the only agencies that actually pursue financial criminals are people like the secret service in the US, and the City of London fincrime team in the UK.

Both relatively small agencies compared to a national police force. The end result is they only pursue whales, people and organisations that have stolen millions from one person or organisation.

If you’re not a whale, then no ones gonna chase you. You can spend years ripping off grandma‘s at $10k a pop, and no law enforcement agency will care.

Many of the US systems were/are very trust based. Unfortunately trust based systems are too vulnerable to fraud these days.

It will take time to redevelop the systems and thinking to be more fraud resistant.

However, many in the US equate validation or verification as too intrusive, too discriminatory, or both.

> we in the US have probably a handful of people who understand

When I moved to the US from Canada and HR was helping me setup my health insurance on the first day, I was overwhelmed trying to understand it and said "Sorry, I don't really understand how health insurance works here."

The HR person responded:

"That's ok. Most Americans don't understand how it works either."

That HR representative appears quite talented. Nobody knows how it works, or there would/could not be significant "administrative" changes daily as insurance companies (and really any businesses) find new ways to take more of your money without any risk or possible recourse. They do whatever they want.. at least that they believe they can get away with long enough to make a profit.

I think a lot of US immigrants are more well versed in the workings of the US government than native born citizens.

This is because they have a source of comparison, and it is on the test! (if they go for citizenship)

Although some US citizens get how well some things work in the US compared to other countries, they have blind spots for some things that don't.

I got sick in Mexico once and went to a doctor there. I paid in cash and it was something like $2. If I wanted, I could get my medicine in pill or hypodermic form.

I know there's some controversial history adjacent to this idea, but I think everyone (native born included) should pass the test before they can vote. I also think we should throw out the voting age and the felony condition and ONLY have a voting test.

Who gets to decide what’s on the test? Also, what languages would it be available in? Seems hopelessly fraught (and likely illegal).

https://slate.com/human-interest/2013/06/voting-rights-and-t...

I have a long answer to this which I can dredge up and copy paste. Here's the short version.

1/3 random questions from the immigration test as it exists today (so that no one can disenfranchise others by changing the test).

2/3 questions chosen by each candidate on the ballot. Questions must have an objectively correct answer and must be pertinent to the powers of the office itself.

The long version of this answer just adds defining objective, correct, and pertinent in a legally unambiguous way and sketches out scenarios like trick questions to show that the only reliable way to gain favor in this system is to actually be knowledgeable.

Oh gosh. Why do candidates have any business filtering voters?

I assume that it works more like a filter - does the voter know the promises and policies of each candidate in his region? Or is the voter voting blindly?

There was an idea going around that instead of voting for candidate, you would answer a questionnaire about policies, and would be matched with best fit candidate.

The questions itself would be compiled from candidates' policies, and candidate would assign the weights to each of the answers.

Why do people who don't even know what the candidates said have any business voting?

There is already plenty enough built-in momentum to not properly educate the public - "if we fuck up they don't get to vote" is some next level shit.

Just curve the test so that 80% pass.

At face value, that means 20% of the people (in a "democracy") will be unable to vote.

Basically you are saying that some people will not have the ability to decide who will govern them.

I just think it would be gamed somehow, like the games played with gerrymandering.

Are you ok with children not voting? That right there is ~20% of the population.

That will play into the hands of certain parties, as it will serve to eliminate certain demographics.

And not having a test plays in the hands of others that have a large pool of people who don't understand the system and what they're voting for.

The problem is that this system will gradually mean that people who get to vote entrench their privilege and keep out others who do not get to vote. Gradually, you'll have a permanent underclass of people who have never known voting. The effects of unequal schooling etc will be even worse than they are today and politicians will have no incentive to even consider people who can't vote.

I really should dredge out my old comment because I already address this concern. Curve the test so that 80% pass. In this way it is impossible to get a feedback loop that miniaturizes the electorate.

This is so True, as an immigrant - I have changed jobs and every orientation when talking about benefits does not break down the cost to the employee - resulting in "just sign here" so we can be done with everything mentality

> Most Americans don't understand how it works either.

When I dislocated my jaw and went to an in-network ER for treatment (it popped back in as I was sitting on the bed), I wasn't surprised to get a call from a collections agency regarding bills I never received from an "out of network" shell corporation for "consulting physicians" (never even saw a doctor, only a nurse), but I definitely didn't see it coming.

Count me an average American, I guess.

My hospital now had a very easy to use portal for bills.

And I’ve still been sent to collections for a bill that wasn’t on that portal.

Sorry, can't decide if it was a scamming attempt or it was a legit request?

That’s just a matter of perspective :)

> However i don’t know if states rights and separation of duties screws this up.

The history of the US shows that such things matter only when there is no bipartisan support.

See for example the Commerce Clause that explicitly grants the Congress the power to regulate interstate trade, yet it is used as a basis to justify intrastate regulations (e.g. drug prohibition).

This seems to e a general cultural thing where rules are seen as malleable. See how well the lockdown is (not) being adhered to.

> See for example the Commerce Clause that explicitly grants the Congress the power to regulate interstate trade, yet it is used as a basis to justify intrastate regulations (e.g. drug prohibition).

If anyone is curious, this is due to Wickard v. Filburn (https://en.wikipedia.org/wiki/Wickard_v._Filburn), a very unfortunate Supreme Court decision made in 1942. This decision was cited as precedent in Gonzales v. Raich (https://en.wikipedia.org/wiki/Gonzales_v._Raich)

It seems strange to me to fight corruption and fraud by creatiung an even larger institution with more cash to manage.

What details?

> The investigator said in some states fraudsters need only to submit someone’s name, Social Security number and other basic information for their claims to be processed.

This is the problem, a complete lack of security. Why doesn't the US use an electronic signature supported by a digital certificate as we do in Europe?

Has there been a real profitable incentive to implement the technology? Then why spend the money for a risk that may not have an impact tends to be the mindset.

Well you have an incentive when you read stuff like this:

- Hackers from China are believed to have stolen the social security number for every US federal employee in a cyber-attack much larger than it first seemed (2015)

- For the first time ever, data breaches compromised more Social Security numbers (35 percent) than credit card numbers (30 percent). The Equifax breach was largely responsible for that. (2017)

- If a cyberthief has your name, address and SSN, he is not far from being able to steal your identity. (2018)

> I am not surprised this is happening. The small offices in each state are responsible for 100s of millions of dollars and they awfully unequipped for it.

But trust us when we tell you that voter fraud isn't happening, that mail-in ballots offer no increased risks, and that non-citizens aren't voting.

Every piece of mail must enter the system and be postmarked correctly. The US postal service certainly will not accept or deliver a piece of mail with a "Miami Beach, FL" postmark addressed to the "Sacramento Board of Elections" if it comes in with a batch of Par Avion mail off a plane from Nigeria.

You understand that the standard ML training data for OCR is from the US postal service, right? They've been routing mail electronically for decades.

The election system in the US is ridiculously decentralized, which makes it really hard to commit large-scale voter fraud at the ballot level.

[Citation Needed]

Not that it's either relevant or germane to a discussion regarding an organization using stolen identity to wire funds electronically.

Multiple states have been using mail-in ballots for literally decades. No widespread voter fraud has ever been reported.

Here's an anecdote for you: a few elections back, my signature didn't look quite right on the envelope of my ballot. Got a call from elections officials to verify that I had in fact filled out the ballot.

There's a lot more control involved in mail-in voting than there are in fraudulently filling-out an online form and receiving an electronic funds transfer.

> Not that it's either relevant or germane to a discussion regarding an organization using stolen identity to wire funds electronically.

It's absolutely relevant, particularly when the article discusses "mules" in the US (with US mailing addresses) being used in furtherance of the scheme on behalf of foreign individuals.

If it can be done to steal hundreds of millions of dollars by Nigerians using recipients' PII, it's difficult to imagine how it couldn't be done with mail-in ballots. If it isn't already, it's only a matter of time until it's worth doing to someone.

Quote: "The Service’s memo suggests the crime ring is operating in much the same way as crooks who specialize in filing fraudulent income tax refund requests with the states and the U.S. Internal Revenue Service (IRS), a perennial problem that costs the states and the U.S. Treasury hundreds of millions of dollars in revenue each year."

A perennial! problem, hundreds of millions each year. It blows my mind how 80+ years later SSN is still used as identity, far beyond its original purpose. I mean with only one year of those losses US gov. could easily adopt something better.

It's crazy that we all walk around with some secret number that, if discovered, could wreak havoc on our lives.

This is especially true in this digital age of connectedness and breaches, wherein we're encouraged to use and share the number ourselves in some scenarios, but somehow expect it to not fall victim of a single error or act of malice.

It's crazy that people use it and think of it as secret number.

The Dutch system to this is pretty nice. Your BSN gets attached to a digital id (DigiD).

You might give your BSN out to a company (healthcare, doctor, etc) but that is used to create the link to your DigiD. From there if you want to login to something like your healthcare company it will then bring up a form where you copy four characters from your DigiD app on your phone. This makes sure the requests match, then you just scan a QR code and type in a pin.

So if you want to login to do something related to your taxes, or healthcare online you have very strong two factor auth.

Additionally banks work similarly for making payments or purchases online. I want to order a pizza for delivery online it redirects me to a payment page on my banks website. I then take out my bank app on my phone, type in a pin, scan a QR, and approve the payment.

> it will then bring up a form where you copy four characters from your DigiD app on your phone

What happens when you don't own a phone?

Can't chime in for Netherlands, but here in Denmark you can get an actual code card you use for 2FA. It has 100 codes on it.

If you're doing online shopping/purchases chances are you have a phone though.

My guess is they will send a code to your registered address, which is a must if you live in the Netherlands. I just lost my phone and retrieved my DigiID through this way.

I think it's possible to "assign" someone and grant permission for them to access information, a bit like power of attorney.

Bicycle down to the local Gemeente office and talk to someone?

To set up digid, you apply via official website (or app), receive one-time code in your paper mail, then proceed back to the same website/app to register your password and phone number. App registers itself if you're using one.

Once set up, you have 3 authentication methods, selectable on login page:

1) password only (low-trust authentication, not all places accept this, certainly not your doctor's office);

2) password + 2nd factor via SMS/text (high-trust);

3) password + 2nd factor via app (high-trust).

Are elderly Europeans just so much better at tech than elderly Americans? Smartphone apps. QR codes. 2FA pins.

I know folks in their 60s who positively would not be able to do any of this with any level of success.

You can always do things via mail, phone, or bicycling down to the local Gemeente office. I just don't know what the authorisation methods are for mail/phone because I use the DigiD methods.

You can make the digital side of things secure while still having accessible method for non-technical people.

I wonder, like, how much of that (and legitimate tax revenue) could be recovered or prevented each year by properly funding the IRS and other departments.

Where is the outrage compared to that of welfare queens, which don't exist in high numbers?

In context of how much "personal identifiable information" (e.g. SSN) that is stolen through data breaches in the USA - it's hardly a surprise.

The list of breaches just goes on-and-on: https://krebsonsecurity.com/category/data-breaches/

> that is stolen

Or just straight up sold by the government: https://news.ycombinator.com/item?id=20438289.

... or collected by state prison call centers and misused (though admittedly this would be a minute fraction in comparison).

https://www.cio.com/article/2417888/prison-labor--outsourcin...

I think it's time we just eliminated the concept of personally identifiable information (PII). Your SSN, birthdate, name, etc. are no longer secret. Operate with that assumption. Invest in a department in the government (e.g. digital service) to make this change once and for all. Heck, let's eliminate DST and move to the metric system while we're at it. Let's call this "moving to new standards" that will pay off in dividends in the future.

Why would a bank give someone a loan if they have no idea who the person really is?

ID cards?

How is any of this information supposed to secure anything? Name, birth date, address, etc are all public record or essentially public record. The only "secret" piece of information is the SSN, which is (a) public for almost all Americans and (b) specifically forbidden for being used as an identification number.

This is a very 'tech' response in a good way, it made me smile. I think they meant why would a bank give an anybody a loan? You have no way of knowing if an anybody already has a loan out with you and you have no ability to evaluate their risk. Why would you loan money to someone with no ability to review their credit health and financial situation? It's an impossible battle without inventing a user specific metric.

>It's an impossible battle without inventing a user specific metric.

And that's exactly what happens over here. There is no credit score, nor other such bullshit.

You get assessed for viability by proving your current income for last X months depending on the loan.

There also exists a national black list of debtors - but to get there you must really mess up and not even try to pay back your loan.

How do you price your current income with no identifying information is the point that was being made. If you can prove your income then you have identifiers.

you get a standardized form from your employer, or income transactions from the bank. They can use that data internally, but they cannot sell it nor give it to 3rd parties.

You had me until the whole “invest in government...”

I wonder what the rate/total volume (or detected volume) of fraud is? How does it compare to baseline levels of fraud? The article says the amount of fraud has kept pace with dramatic increase in claims in Rhode Island. If it's just keeping pace, why are we surprised? Do we even need to worry that much? Is the current situation making it easier to commit fraud? Or is it just generating more volume and noise to hide fraud in?

My friend's desperately needed unemployment funds are frozen because they were requested using a Romanian IP address. My friend has never been to Romania nor spoofed their IP in such a manner. The New York state unemployment website seemingly allows no recourse for this incident. They are now unemployed and unable to receive any income.

The recourse as I understand it is to try and call the agency to speak to a person. Of course the call systems are overloaded so that's easier said than done.

edit: This is the general approach by US agencies, the IRS website barfed on my info and I had to call a local office to get a person to help me (the nation wide number was 100% automated and likewise barfed on my info).

Good luck: https://www.oregonlive.com/business/2020/04/oregon-insight-h...

> Laid-off workers are confused and confounded by the department’s faltering claims system, erroneous denials and stubborn silence on key policies and questions.

> The frustrations lead people to call the department again and again – some say they dial more than 700 times a day.

> The employment department is taking steps to address the call volume. It has added hundreds of staff to process claims in recent weeks – it has 520 now and has leased a facility in Wilsonville to expand claims staff to 800.

> With jobless claims up nearly seventeenfold, though, the staffing increases aren’t close to keeping up with demand. So it may be weeks – or months – before Oregon works through its backlog in claims questions.

Calling the unemployment office right now is virtually impossible.

Conventional wisdom these days is that if you want to collect unemployment, you need to make filing a claim your full-time job. You start calling at 7am when they open, and keep re-dialing until you get through -- hopefully before they close at 4pm, and you have to start again the next day.

Also, don't call before Wednesday, if you don't absolutely need to. Monday/Tuesday are unofficially reserved for people who really need the money.

Of course, even if you get through to a person and get the right bit flipped in their database, there's no guarantees. I also hear lots of stories of people whose claims were approved 4 or 6 weeks ago and still haven't gotten a dime.

Why are Monday/Tuesday unofficially reserved for people who really need the money?

Maybe they were using a VPN proxy?

They were using a VPN that was exiting in New York City and had never exited from Romania.

Wait, why were they using a vpn? Where were they physically at the time?

Are you sure the exit point was in NYC? VPN providers don't always put their servers in the same country that their IP claims to be from.

While I agree that it's unlikely that they would serve NY customers from Romania, you will definitely see weird results from Geolocation services when going through some VPN providers.

It does seem somewhat disingenuous to not mention the VPN usage in your first comment. Makes reasonable people wonder what other details you're leaving out, even if there are none.

I failed to make it clear by just mentioning spoofing in general, my apologies.

How did NYS figure out "Romania" (even if wrongly) and communicate that to your friend?

That's a bizarre capability for a system that is as incompetent as has been seen.

Browsers send tons of information to all sorts of in-page components. If the attacker is incompetent, it's not that difficult to narrow down their location.

I wonder if CDNs can be used as "standard candles" for in-page scripts to measure latencies to multiple known network locations and infer a position from there across multiple sessions with different exit points. How many exit-point/latency pairs would I need to figure out the actual origin of a request?

Once upon a time our office IP in Helsinki was tagged as being in Spain by some geoip provider. For months parts of the internet were in Spanish. No way to fix this from our end. For example, googling for any php function automatically linked me to the spanish version of php.net.

After a few months, the issue disappeared as mysteriously as it had appeared. And we'd had that set of static IPs for about 5 years by that point.

It's a shame that such technical problems can become severe personal problems in times of crisis such as these.

remember when SSNs were being implemented and the government promised it wouldn't be used as a personal identifier?

I've only been in the USA for less than a decade but when I landed here and got my SSN I got a pretty good lecture at the window from the Federal worker about never giving this out, keep it safe, yadda, yadda, yadda...

...and was then asked at every turn, by every website and application and whatnot, to provide four or more digits of this number to accomplish even the most benign things.

There's what the US government thought it would be and then there's what it's become because zero enforcement on use of it as a national person identity number was ever enacted.

The "don't give anyone your SSN" trope has become one of those household jokes. Right up there with "American's don't pay high taxes".

And those 4 numbers that they always ask for are the only part of the SSN that isn't procedurally generated from public information.

This isn't true anymore. (Although for most adults, it doesn't matter as they got their SSN before it changed.)

> On June 25, 2011, the SSA changed the SSN assignment process to "SSN randomization". SSN randomization affected the SSN assignment process in the following ways:

> 1. It eliminated the geographical significance of the first three digits of the SSN, referred to as the area number, by no longer allocating specific numbers by state for assignment to individuals.

> 2. It eliminated the significance of the highest group number assigned for each area number, and, as a result, the High Group List is frozen in time and can be used for validation of only those SSNs issued prior to the randomization implementation date (see section "Valid SSNs").

> 3. Previously unassigned area numbers have been introduced for assignment, excluding area numbers 000, 666 and 900–999. [1]

[1] https://en.wikipedia.org/wiki/Social_Security_number#Structu...

That's great for 9 year olds. But for the people it matters for now, these points don't apply.

OP already acknowledged this: "for most adults, it doesn't matter as they got their SSN before it changed"

In 1936? Sorry, I don’t remember that.

Not personally, because I’m not 90 years old.

But you’re right that the original purpose wasn’t identifying people, however it was private banks that really latched onto it as a convenient way to identify people and associate debts to individuals.

Just goes to show how much of a net negative the parasitic banking system is on society.

Your lifestyle must be pretty ascetic then? A society that only contains business bootstrapped by independently wealthy owners is pretty small. Almost everything we have required somebody else's capital to build. There was a reason unemployment spiked when lending stopped in 2008.

There are other ways of bootstrapping businesses: people pitch in money in exchange for owning a percentage of said business. That's exactly using someone else's capital to build, but without the parasitic and immoral practice of lending with usury (aka interest).

That's not bootstrapping, just investment funding. We have that, though many still prefer debt financing instead for whatever reason. For example you can often get money "cheaper" via debt versus giving up too much ownership.

Preferring something doesn't automatically make it good or acceptable. Just like how some people prefer to smoke or prefer to gamble or prefer to drink.

Regarding your point, debt today is only cheaper because it is available and widely pushed by the government through banks. If lending money on interest were hypothetically banned, then everything would have to change, and we'd have a fair equilibrium.

What exactly is the moral framework that makes equity financing okay but debt financing not? The financier is still getting a consideration in exchange for his capital.

Lock up all capital with a small group of individuals and you will then need to acquire that capital in order to create large projects, that's pretty truistic.

A system where you instead has to convince a "capital" assignment group (really a work+resources assignment)- who would only profit if your project benefitted society - could also work.

You'd get different assignment of resources too as ability to extract maximum value from the system and lodge it with a small group of capital holders wouldn't be the principle aim.

This only works with systems where everyone is on board and there are no greedy people, ...

It may come as a surprise to people, but there have been societies which banned interest/usury, yet got things done just fine (e.g. Islam bans usury, but the Islamic Golden Age speaks for itself). Even until relatively recently, when Western colonialists forced their usurious banking system onto Islamic nations post WWII, things were done interest-free.

Coming from a jewish background (Judaism also "bans interest/usury"), I advise you to take these rules with a grain of salt. In the case of Judaism, there were (sometimes still are) many tricks to the system, for example: you could lend with interest to non-jews, you could have and trade slaves, etc.

I'd assume Islam, being similar to Judaism, uses the same kind of tricks. For example, after a quick search, I found this:

"The common view of riba (usury) among classical jurists of Islamic law and economics during the Islamic Golden Age was that it is only riba and therefore unlawful to apply interest to money exnatura sua— exclusively gold and silver currencies—but that it is not riba and is therefore acceptable to apply interest to fiat money—currencies made up of other materials such as paper or base metals—to an extent."

Source: https://books.google.cl/books?id=1MKrCQAAQBAJ&pg=PA23&lpg=PA...

Thank you for chiming in. I'm aware that Judaism bans interest, but you're also correct that thier Rabbis made loopholes such that only Jews don't lend money with interest to other Jews, but they're allowed to lend money with interest to non-Jews. Christianity bans it as well, but people don't practice what they preach so to speak.

With Islam, there are no such tricks, because it explicitly calls out tricks like what you're mentioning and warns people who engage in them. Of course, it doesn't prevent some people from claiming certain things, but you'd have to look at the overall consensus. If you ask scholars today, they will tell you that you cannot deal with interest with fiat money, the consensus is that you cannot take an interest-based loan or mortgage from a bank.

I can't find the author of the book you cited, but it seems he's misguided and conflating two things. There was no paper money back during the Islamic Golden Age, so I'm not sure why he mentions it. Secondly, he seems to be conflating Riba that applies to certain materials (explicitly mentioned in [0][1]) with Riba due to loans. The Islamic notion of Riba encomposses more than simply usury and interest. For example, exchanging 5gm of 22 karat gold for 8gm of 18 karat gold falls under Riba, and is prohibited.

What is permissible is to have exchanges of different types, as mentioned in those Hadiths. For a modern manifestation of this: I can exchange a certain amount of USD to a different amount of Euros. However, I cannot lend out $100 and ask them to be returned $105.

[0] https://sunnah.com/nasai/44/112

[1] https://sunnah.com/abudawud/23

The profit and loss sharing instruments used by Islamic banks are structured in such a way to be almost identical to charging interest.

Yes, and if you look up the opinion of present-day scholars, you'll find that many of them call said banks out on it (if it walks like a duck and quacks like a duck). While I'm not a scholar, I completely agree that it's jumping around the issue and it is almost certainly interest. It doesn't mean Islam allows it. This in my opinion, is a manifestation of what I mentioned how the West pushed their usurious banking system onto Islamic nations, and because many of those governments were installed by Western nations, now the people are having a difficult time breaking out of it.

Postal banking!

When I worked on Wall Street way back in the 90s we knew SSNs were useless for any sort of id...

Too many 'shared' SSNs in, too many stolen SSNs. I highly doubt any financial instituation is using SSN as anything more then then 'corraborating' account access at this point.

BTW - you might find this interesting: https://www.ssa.gov/history/ssn/misused.html People thought they were getting an SSN when they bought the wallet...

yeah. My college id number was my social and that was in the 90s. License numbers typically were too.

You were alive in the 30s? No, I don't think most of HN's audience remembers that time.

Try telling a Doctor's office you don't want to give them your SSN. I personally make it a point to NOT give them my SSN and they always give me hell for it. Sometimes I give up but whenever I can, I try to fight it.

What do they want it for?

Credit checks. They need to know how much of a risk you are of not being able to pay.

Identification for billing. The more information you have about someone the easier it is to collect debt from them.

It’s been easy in my experience. I say the magic words “will pay up front.”

Direct payments are better for this very reason. They also become bonuses for those working. Banks and broken state systems have really caused problems getting stimulus out as expected.

Lots of people calling for temp UBI like Cuban [1]. It was obvious from the beginning we needed this.

With everything we learned from the Great Recession 'bailouts/stimulus' we should have expected this and just not gone the bank route or unemployment alone. Direct payments takes pressure off everything, unemployment, state budgets, individuals, mortgage/rent, small business, demand from purchasing power etc.

[1] https://www.marketwatch.com/story/mark-cuban-says-families-s...

how would a buggy implementation of payment dispersal relate in any way to any perceived need for UBI?

I didn't say buggy, I said broken, sometimes on purpose.

In "Study finds 44% of U.S. unemployment applicants have been denied or are still waiting" it shows the systems don't work [1]. This is one article, study or example in many, many reports on this.

Direct payments, at least during the crisis and maybe auto UBI during recessions, would make it to everyone, not prevent people from weighing going back to work, not overload state budgets, reduce unemployment, and more. Some systems like Floridas were meant to not really work at all to minimize usage.

Basically anyone in a state with a bad unemployment state system suffered. Direct payments gets around all that by using identity and tax system information.

Direct payments to everyone also get past the whole idea of selective stimulus. Money to everyone gets to where it needs to be that no central planning could ever predict from food, gas, housing, insurance, health, etc [2].

Direct payments during recessions would make the floor higher and bring back purchasing power demand sooner, or keep it with some semblance of consistency in times like this.

[1] https://www.cnbc.com/2020/05/15/44percent-of-us-unemployment...

[2] https://www.cnbc.com/2020/04/15/coronavirus-stimulus-checks-...

If only we saw this coming.... oh wait... Equifax's data breach of 143M records.

People have been calling for social security number system to be updated. In what world does it make sense to prove your identity with just a username (ss #) and not a password as well?

. . . a substantial amount of the fraudulent benefits submitted have used PII from first responders, government personnel and school employees.

Seems like this should have generated some red flags, as public sector employees haven't been subject to layoffs.

Makes you wonder if the infamous OPM breach (https://en.wikipedia.org/wiki/Office_of_Personnel_Management...) has been distributed beyond China.

No wondering, I just assume that's the case. Like, whatever the Chinese equivalents of 4chan and pastebin are would be in constant discussion over the best ways to exploit that information. OPM is a big umbrella over the US Federal Govt. They even got biometric data in the form of fingerprints.

There are certainly worse things to breach but it's basically HR for the US gov't. Imagine your company's HR dept getting totally owned, then people using the CFO's data to get large loans, make harmful business deals or blackwash someone high-profile.

That’s funny because my dad has been struggling to get unemployment due to state bureaucracy (he was working remotely for a company in another state, which complicates the filing). I guess the same bureaucracy is probably what enables the fraud.

If you pay taxes in the state, shouldn’t it be enough?

Yes he is entitled to it. The problem was that it was unclear which state he was supposed to file in (because he works remotely out of state), and one state's department just said to go to the other state.

Well, if I am employed in one state, that means I am unemployed in almost 49 others, doesn't it? Time to fill out some paperwork!

For certain things, this perhaps one of them, there are benefits if handled on a federal level with more oversight.

You wouldn't need to handle it centrally, you could do something like log all "single-state" transactions against a name, SSN, & bank account, and publish to reach of the other states your data -- preferably through a federal data store, but it could still work otherwise?

Is that all it takes to get unemployment now? Just an application and they take your word for it? I thought you needed to get legitimately laid off (i.e. not quit or be fired for cause) by an employer in the state who notifies the state of this fact for you, and perhaps who has to pay part of your benefits.

And there's always both upsides as well as downsides to handling things federally versus state.

I’m surprised banks literally don’t have the ability check for suspicious behavior like blatantly having the same account receive multiple unemployment benefit dollars from a state that the person doesn’t reside in...

That’s not the bank’s responsibility. This is no different than the issues IRS faced with fraudulent refund activity. Unemployment systems should’ve invested in KYC-like systems, knowledge authentication, etc.

Simply look at the talent running unemployment departments though. No engineering mindset, no accountability, hence financial fraud with no repercussions for government or perpetrators.

For the love of Vint Cerf, please get involved in local government if you’re a technologist. It is the only way this gets better.

Doesn't it kind of become the bank's responsibility once they become aware they're holding onto criminal proceeds? Or is that why banks prefer not to pay attention, so they don't become aware of such things?

Most technologists likely have an aversion to anything as backwater bureaucratic as government “tech” programs. Couple that with pay that wildly trails the market and the outcome is fairly easy to predict I think.

What if the resulting code was open source and someone paid for the effort out of their own pocket. Non profit 18F style. Might even be able to distill requirements from existing code if that code can be retrieved with a FOIA request.

I can empathize with not wanting to work directly for the bureaucracy. There are alternate paths to success.

https://18f.gsa.gov/

Interesting idea! I don’t know how to think about the threat model of “pay for it yourself, and then the government will run your code for essential services”. I suspect there’s a juicy target there, but it’s something I hadn’t considered so thanks for giving me something to mull about.

An independent application security assessment would need to be performed prior to handoff of the code base (with follow ups each time you cut a new release), but if you can meet the requirements of all 50 states (not trivial, but also likely not overly onerous), that’s a huge reduction in duplicated effort.

Glad I could provide something to ponder!

I don't know about the US, but I had the same misconception in Brazil until I ended up training government employees. What I encountered was an extremely motivated and intelligent crowd that, even though they were underpaid, were motivated by a desire to make things work. It stuck with me that, while some companies had the best talent money could buy, these agencies had the best people no money would ever buy.

Besides, even a small government deals with amounts of data that rival larger enterprises.

Well, no. I wish that was the case but no. You would be surprised how invasive BSA law is. The main reason banks basically gave in on SARs was the legal protection they have for it. This coupled with little average teller is trained results with suspicious activity report stemming from customer saying 'none of your business' to a teller.

And I assure you that when auditors ask an officer question why SAR was not filed ( most recent Moneygram case ), BSA officer is sweating bullet.

So based on current setup in US, it is banks' responsibilty. And just to add to this, this scheme is being actively copied across the world.

FinCEN case link: https://www.fincen.gov/news/news-releases/fincen-assesses-1-...

I think we might be taking past each other. A bank and money transmitters are required to meet AML and KYC requirements (in this case, making sure the illicitly obtained funds aren’t laundered with mules or other means), but I propose that it’s the state unemployment insurance department’s responsibility to put benefits into the right deposit accounts in the first place.

My bad. I completely misread your post. I never thought of that to be honest.

My first reaction is hesitation, but it is mostly, because I am not sure how that would work in practice.

My Citibank credit card pulls in my Chase deposit account details using my Chase login and password (I assume using Plaid under the hood). Perhaps something similar between unemployment systems and your bank, as the bank has already done all of the hard KYC work. They’ve got your PII (including SSN), and your account numbers. Use SSN as the key (I know, I know, we need to get away from the SSN as a citizen ID, baby steps) between the two. You also get to piggyback on 2FA/MFA systems banks have in place.

Why is it so hard to enforce banks to report such transactions? Doesn't the US force foreign banks to report balances of US citizens residing overseas? Oh the double standards.

FATCA is an injustice of epic proportions. You can thank the US government of 2010 for that hypocrisy. It was used by the left as a way to “get” “fat cats” — it’s literally in the name: FATCA(ts.) Chuck Schumer was a highly vocal proponent. Instead it harms everyone overseas while for actual fat cats, it has been business mostly as usual.

I suspect you're being downvoted by US citizens who have never lived abroad and are blind to the difficulties FATCA causes for non-"Fat Cat" American expats.

Your comment is entirely on-point.

Could you expand on that: how does it is cause harm, why aren't overseas "fat cats" affected?

One reason is that it causes the cost to be borne by those overseas bank, just to address the incompetencies of the US government and the bizarre law to tax its citizens living overseas, which I think only one or two countries do.

It causes harm to American expats because FATCA's terms are horrible for banks. Basically, they have a whole host of new reporting obligations for their US citizen customers, wherever they are in the world. If their compliance fails, their US operations will be subject to a 30% withholding tax on all transactions. American citizens are the rare exception for banks outside the US and the compliance costs and huge operational risks make it very unattractive to accept US citizen clients. It is very difficult to find a bank willing to take them on as a customer, and those that do often put restrictions on their accounts.

Fat cat expats are relatively unaffected because they can afford to set up all kinds of complicated legal structures, companies, trusts, etc. to skirt the law and anyway have enough money that even with increased compliance costs they are still worth keeping as customers.

Finally, in general, US tax law regarding foreign earned income is completely absurd and nearly unique in the world, and direct compliance costs on expat Americans--for example, FBAR requirements--are equally absurd. I believe this is a result of the structural disenfranchisement of expats in the American political system. Expats vote where they last resided, so lots of places might have 0.5% expat voters, but no one place has 100% expat voters. So no politician has any incentive to represent expat interests.

Banks already have responsibility to prevent money laundering by submitting a form when you deposit over $10k in cash, it’s called a currency transaction report and sent to the IRS.

I'd put it as much on the state. From the bank's perspective it's just an ACH transfer. The state knows what it's for and is arguably in a better position to detect anomalies. And the state should be doing better due diligence to verify identities and eligibility.

States are processing claims in cobol on mainframes from the 1970s. I think you overestimate their data science ops.

They were wiring large amounts of money to people in Oklahoma rather than their own state. That there is no effort put into preventing fraud, which was guaranteed to happen, is down to negligence of the state government. Part of that is on the voters who allocate tax dollars in an idiotic fashion whenever given the chance.

There are plenty of cases where someone would be paid unemployment insurance out of state. The most common one is moving back to be closer to a family support network after losing a job since many people don't have much in the way of savings, at least not enough for a few months rent while they look for work. In most states, unemployment insurance is paid for by employers per worker and after paying in for a certain time, the UI program essentially owes the unemployment benefits to the worker once they lose their job. Where that worker chooses to go with their checks is up to them.

Banks already have fraud protection on credit cards and are responsible for reporting suspicious amounts of depositing (above a certain amount). Thus is the basis of my shock that something similarly obvious isn’t covered.

Why aren't all public transaction public?

Money paid from central government should all be publicly viewable, shouldn't it? Then anyone who wishes could look to see if an account had more than $X or more than $Y transactions, or more than one stimulus cheque, etc?

This is a good question that I’d like answered.

I agree, but I hope such analysis requires a warrant or just cause - instead of having banks check their customers activity, it should come from the other side, institutions that send the money out perform a cross-reference for the same person (whether defined by name, account, etc). Then the issue is some people are working, but under the table, and collecting benefits. That’s a bit harder to detect

Banks absolutely do have this ability and I would guess SARs from banks are what led to the Secret Service eventually uncovering this elaborate scheme. Though I imagine more SARs would have come from the outgoing transfers (from the mules’ accounts to the criminals) than from the suspicious unemployment deposits. Generally government money is considered “clean” but if a mule suddenly started receiving more money than usual it would be investigated regardless of the source.

Same thing is happening with the UK furlough scheme. Government is paying 80% of people's salaries while they're off work but some employers are actively defrauding the scheme and telling those people to work...

The true scope of the fraud will come clear when IRS starts coming after the named beneficiaries of the fraudulent disbursements.

In WA state (not sure about other states), the unemployment insurance agency does not automatically withhold taxes from disbursement checks. (It is an option the beneficiary can choose).

The IRS will come looking for those taxes.

I got a letter yesterday informing me I made an unemployment claim. Bummer.

Not surprising given the creaky state un-employment systems. I would not be surprised if bank account numbers are compromised as well.

The bank account numbers on a personal check or the one you give your employer for direct deposit?

Aren't those the same?

Yes

Heh welp pardon me for having more than one bank account

> I would not be surprised if bank account numbers are compromised as well.

I don't that works too well for this kind of scam. What do you do with the money? ACH it to a totally traceable other account? This scam relies on a network of trust, that the mules will draw out the cash and take their cut (and only their cut) and walk the funds to another location for tender.

That’s what I don’t understand about this kind of scam. It seems like an awful lot of work. Juggling all of your fake internet significant others or employees and then building up enough trust to make the ask. I can’t imagine the payout is that substantial given how much effort would be required.

Think about the mule more like a drug mule. Someone who doesn’t have much to lose, is recruited by gangsters, work is ok as long as they do what they’re supposed to do, and they are beaten or killed if they go off script.

It amazes me that there is no authentication provided by governments in the US to citizens. They just accept a social security number as if it was some sort of password, when it was never intended for that purpose. Other countries give citizens an electronic ID to authenticate themselves. It seems this would prevent hundreds of millions of dollars in fraud and identity theft.

> It amazes me that there is no authentication provided by governments in the US to citizens.

Vast numbers of Americans would view that as a big step towards totalitarianism and taking their guns away.

Except if its about voting and then any amount of intrusion is fine.

Many of them quite literally want voting licenses.

And on the flip side, any amount of intrusion is fine, unless it's about voting.

Voting is a much more important right than the other rights, because voting is fundamental to the existence of a republic. One could argue that the right to bear arms exists for the primary purpose of protecting the right to vote.

Voter ID fraud is exactly the kind of thing that infringes on right to vote. Stronger protections on voting is what protects this right, not the other way around.

As someone who not only lives in a country with a widespread voting fraud (done by government officials), but also have been an observer on number of elections and have seen this taking place first-hand, I can't understand how relaxed are Americans about this issue.

> Voter ID fraud is exactly the kind of thing that infringes on right to vote.

There's a difference between "infringing on the right to vote," which is where you're literally preventing from someone from voting, and "diluting a legitimate vote", which is where your vote doesn't weigh what it ought to. Mathematically, it's the difference between scoring a zero and scoring some fraction less than one.

It turns out that, at least in the USA, advocates of voter ID requirements and other unnecessary impediments to voting in fact desire the opposite effect - that their votes be worth more than they would be if widespread voting by qualified citizens were easier than it is.

> I can't understand how relaxed are Americans about this issue

We're relaxed about it because the data (and we have measured and investigated, many times) says that voter fraud here is so rare that it falls well beneath the noise floor of statistical significance.

That's not really true. The Right is generally united on the point of wanting universal ID. Nothing totalitarian about a nation being able to reliably identify and distinguish its citizens.

Unfortunately the political Left believes that such ID, specifically when used as a means of election security, would lead to discrimination.

The problem is that if the ID is not free, it could constitute a Poll Tax:

https://history.house.gov/HistoricalHighlight/Detail/37045

Which is against the constitution. It also disenfranchises voters who do not have a permanent address.

Those are both pretty simple issues to address. Many Democracies around the world use some form of voter ID and we could easily just follow their implementations with some adjustments.

Right but every proposition suggesting those elements gets struck down. It isn’t about voter ID, it’s about not letting poor people vote

> Unfortunately the political Left believes that such ID, specifically when used as a means of election security, would lead to discrimination.

I'm not an US citizen but this is the first time ever I've heard this extraordinary claim.

Do you have any source to substantiate your assertion?

This is quite a common claim from the Left in the US. If you do a quick search in Left leaning publications on the issue of voter ID you'll see that stance dominates their discussion of the issue. I agree it's an extraordinary claim, but it's a conspiracy they've latched onto.

You can in fact see a child comment below where someone is commenting that the purpose of such ID is to disenfranchise the poor.

> This is quite a common claim from the Left in the US.

What about the source? Are you able to find anything that corroborates your extraordinary claim? Because I asked for a source, and you just reiterated your baseless assertion.

There are many sources, if you don't trust me you should search yourself.

Here's one, representative of the general attitude. Voter ID's are discriminatory or pushed with discriminatory intent: https://www.huffpost.com/entry/heres-what-you-need-to-kn_b_9...

> Voter ID's are discriminatory or pushed with discriminatory intent:

Your own link does not support your baseless assertion. The only claim is that so far voter ID laws have been crafted to exclude non-white US citizens from the electoral process.

Taken from your article:

> New studies suggest that the motivation of these laws is suppressing non-white voters, and worryingly, that they will be successful at doing so.

Do notice that the remarks refer to voters (thus, citizens with the right to vote) who, due to their race, are being excluded from casting their vote.

If that's the best source you managed to produce then I'm afraid that you were either lying or very confused, because your original claim has zero basis.

> crafted to exclude non-white US citizens from the electoral process.

Reads a lot like

>> pushed with discriminatory intent.

You seem to be confused about what the point of disagreement is

I dunno, this claim isn't extraordinary. MSNBC/CNN/Nytimes/WashPost say stuff like this all the time. It's a very common talking point. Certainly (in my opninion), the reason why some people are so interested in voter ID is to make voting harder.

Maybe the commenter above is thinking of a different point, or coming at it from an oddly phrased perspective.

The Democratic party relies on a certain segment of immigrant or immigrant-related citizens to vote in support of them. And if licensing / IDs are perceived to target and identify who is not a citizen (your relatives, friends), then they could lose support. I suppose it could be seen as a kind of "discrimination". And if some social services, policing, etc were to be able to use such ID, then illegal aliens would certainly be more at risk of being discovered or face more stringent (less porous) treatment in the law enforcement system.

I personally think this is a ridiculous situation from every angle, and unfortunately it's all tied up in our immigration and economic policies, so it's hard to disentangle or fix.

> so it's hard to disentangle or fix

Give the Id to everybody who wants it for free. If someone cannot prove citizenship, but they can prove having worked or lived in the US for more than 5 years (checks, bank receipts, etc.), give them citizenship.

There, problem solved. That way, you only discriminate against those who are either in the US illegally and are not working, or are working but have been illegally living in the US for less than 5 years, and both situations are fixable by the individuals themselves (work for 5 years and "earn" your citizenship).

Of course, what many want is an Id that can actually be used to prevent poor people from voting, while also being able to employ those same poor people at very low rates using the fear of "reporting them".

Some places have tried to institute voter id laws that require ids that are difficult/expensive/time consuming to get, sometimes specifically making it harder for the most downtrodden segments of society to vote. That's really bad and so there's an outcry. Sometimes the nuance of "discriminatory ID requirements are bad" gets lost in the zeitgeist and circulates as "ID requirements are discriminatory and bad."

You might just be surprised at how many US citizens do not have a state issued ID card. There are just a lot of poor people who can't afford to pay for the ID or their parents never kept their birth certificate and they just don't have the slightest clue what to do to get another birth certificate. It perplexes me, but some people are just that broke or just can't get it together enough.

If you are a citizen of the united states, you get a vote if you're 18, according to the constitution. No tests, IDs, or other things are required. To add any additional burden is counter to the constitution, and as a result any additional burden could be seen to prevent people from voting that have the right to vote.

Nevermind that when you add additional barriers, discrimination occurs against anyone that cannot meet the barrier, or does not want to meet the barrier.

Example: - "tests" in the South during civil rights to prevent african americans from voting

- Requiring any sort of payment or money to create a Voter ID in a state. If the person does not have money or time this is discrimination and against their rights as citizens (you are not required to prove you are a citizen. your ballot can be provisional)

- Requiring someone be able to read. It's not a requirement to vote. Any forms requiring reading are a no-go.

- Requiring them to have a permanent address (again, leads to discrimination for those without addresses.

- Requiring someone take a lot of time they cannot afford to get an ID (again, some folks are working too many jobs to go to the DMV for a day)

the list goes on...

If it were assigned for free when you were born and there was no effort associated with getting it or working with it, then there would be no issue. The current problem is that a driver’s license takes a long time to obtain (because the DMV wait time sucks as we all know), and because it’s not free. This means that it’s a lot harder for someone holding down 3 jobs or working during DMV hours to get one. You are basically making it more difficult for an already under-represented group of people to vote. It’s not that it’s impossibly hard or totally preventative, it’s just another obstacle.

You are conflating two things: a national/"universal" form of ID, and voter ID.

Voter ID is the requirement to show ID at polling stations in order to vote. That's what the left is generally concerned about. It's a separate concern from whether a national ID card ought to exist.

On the other hand, the existence of a national ID card is generally opposed by people on the right, which is the opposite of how they feel about voter ID.

The right at this point has long been pretty in favor of the surveillance state. Both sides have frankly.

How about making the id voluntary to get, but required to get benefits. Want to get the guvmint out of your life? Sure, then don't ask for unemployment benefits.

As an American: see the classic "Get your government hands off my Medicare" line. I don't know how many of us actually paid attention in Civics or bothered actually trying to understand how our government is supposed to work.

"Voluntary to get, required for some benefits" is another way to say "involuntary". What is citizenship but a collection of benefits?

How is that different from requiring vaccines for public school, a license to drive a car or fly a plane, or even a safety course and hunting license to hunt? Most of the things that are benefits of citizenship that don’t require any voluntary steps are true “public goods”, like national defense or the societal benefits of education, etc.

It seems more like the whole "Raise your drinking age to 21, or the federal government will withhold road improvement money from your state." It's coercion.

> "Voluntary to get, required for some benefits" is another way to say "involuntary". What is citizenship but a collection of benefits?

This is pretty clearly a poor extrapolation. For example, Global Entry. Is signing up for Global Entry involuntary? It is voluntary to get, required for some benefits.

You're not getting any intrinsic benefits. If you are a US citizen, you are allowed to return to the US after international travel. Global Entry doesn't change any of that.

On average, it does make returning easier, which is nice... but the machines could be out of order, or you could be flagged for questioning in the usual manner, etc.

If “making something easier” doesn’t count as a “benefit”, I think that maybe there’s a fundamental disagreement about what it means for something to be beneficial.

Global Entry is pretty clearly beneficial for the user, as part of the border control experience. Whether having things like Global Entry is beneficial to society is, as `tptacek points on parallel to your comment, a very different question.

Global Entry is deeply problematic for exactly this reason, and all it does is speed you through a line at an airport!

The main purpose of government is providing infrastructure like roads and bridges, as well as enforcement of property rights and security through police and courts, as well as through healthcare and armed forces.

You get all of that without this hyothetical ID. Unemployment benefits is somewhere much further down the list. It could be argued to be a security measure both to keep the crime rate lower and to prevent an uprising from disenfranchised poor people, but it serves this purpose just fine even if a few people voluntarily opt out.

The US government exists to collect taxes, pay debts, prove for common defense and provide for the general welfare.

Roads were historically a local and state priority, so be careful with your modern conservative principles, as they probably are not compatible with your lifestyle.

The main purpose of government is providing infrastructure like roads and bridges

Roads and bridges being a government function is a somewhat recent notion that we've grown accustomed to.

Historically in the United States, roads and bridges were privately owned, and users paid a toll to a private person or company to use them. This was one of the many disagreements between the states that led to the Civil War.

There are plenty of private roads and bridges still in existence in the Untied States, mostly in the older states.

One example: http://www.dcdbc.com

> The main purpose of government is providing infrastructure like roads and bridges

> Roads and bridges being a government function is a somewhat recent notion that we've grown accustomed to.

> Historically in the United States, roads and bridges were privately owned, and users paid a toll to a private person or company to use them. This was one of the many disagreements between the states that led to the Civil War.

> There are plenty of private roads and bridges still in existence in the Untied States, mostly in the older states.

> One example: http://www.dcdbc.com

I've always wondered about the bridge at Dingman's Ferry. Reading through the website, I wonder how they could possibly enforce the penalty for overages in terms of tonnage. Since they are a private entity would law enforcement issue a citation or would the bridge corporation be forced to litigate?

Wouldn’t anyone who did that be subject to a civil suit for damages? Also the bridge owners would have insurance.

In addition to standard economic devices like tort and insurance, the bridge owners could have a part of the road before the bridge that is designed to buckle or alarm if a weight is exceeded. That would save them a lot of money and frustration.

I figured as much with regards to civil suit, was just curious about public enforcement of private regulations when the lines appear blurred. Further, I wonder by what authority they can even set monetary fines? Like, why stop at $X for a fine? I ask because their site lists specific penalties which seem somewhat arbitrary [0]. I can't arbitrarily "fine" someone $1000 for stepping on my lawn. I can certainly take them to court for trespassing and possibly collect some damages, but those damages are not a fixed value in a fee schedule. So I wonder how this corporation has the authority to impose fines.

[0]: https://dcdbc.com/ratesandrestr.php

It looks like it's not a fine in the sense that refusal to pay can result in suspension of your driving license and possible wage garnishment. They don't even call it a fine but a "penalty". Basically they ask you for $50 or $100 depending on which limit you exceed, and refusal to pay risks a court case. I'm guessing the bridge needs to be inspected after the weight limit is exceeded or if a taller vehicle strikes the structure. The cost of inspection likely exceeds the penalty. They could easily ask for thousands of dollars in compensation. And even if you win the case, you have to pay for a lawyer and spend time in court. It's easier for both parties if the driver just pays the penalty.

I don't think it's a particularly recent notion. Ancient cities are the archetypical government, providing defense, some sort of justice system, and (often paved) roads. We see evidence of that from as far ago as the nearly 6000 year old city of Ur. Where larger empires existed, they often built larger road networks between cities to facilitate commerce and troop movements. The Inca road system and the Roman roads are well known examples of road networks built by their respecive empires. The Romans are also kind of famous for their bridges (viaducts and aquaducts).

Of course the less important roads were and still are often private, and the early US had an atypical lack of government that made this more common. But I don't think that proves that governments providing roads and bridges is a recent phenomenon, it's in fact rather ancient.

Employment is also voluntary yet we are somehow okay with it being necessary to not become homeless and will often accept terms which are very biased towards the benefit of our employer.

How about you get evicted and cannot get food stamps for your family, because your non-driver ID expired three months ago and you have a hard time getting a day off to take a bus downtown to DMV?

That’s reality for millions of people.

Go get your ID situation fixed.

edit: To get an EBT card in NYC you can do it all online if you have a valid (ie, not expired, ID card.) If you do not have a valid (ie, expired, ID card), then you have to go to the DMV so they can take your picture and you sign a few forms. The forms are available in 22 languages. At the same time they may work to get you a new, valid, ID card.

How is this unreasonable?

How are the DMV opening hours/wait times? Now imagine that impact on a person with some minimum wage job. You have a valid point but the marginal cost of bureaucracy to a poor/disabled person is often a lot higher than to someone for whom life is going smoothly. Also, it's easier to fall off the smooth track than to get back on.

What is the alternative to get a valid ID card and an EBT card? I understand there's a hardship for someone that can't get away for a few hours to travel to the DMV office. But it's the same hardship for everyone. There are basic requirements:

1) You have to go to the DMV office

2) You have to agree to have your picture taken

3) You have to fill out 3 forms (offered in your native language -- 22 languages are offered)

4) You have to provide a mailing address for where the EBT card will be sent

And then you have to be on the other end of that mailing address to receive and activate your EBT card.

This all seems like very easy procedures to follow to get food stamps.

I understand there's a hardship for someone that can't get away for a few hours to travel to the DMV office. But it's the same hardship for everyone.

No it isn't. The marginal costs are different. If you earn $2000 a week and through some mischance have to give up a day's earnings to go the DMV your $400 loss is an annoyance. If you earn $500/week your loss as a percentage of income is the same but the economic impact of losing $100 is probably much bigger.

I think you have to factor in the other side of the equation as well.

SNAP benefits are worth, let’s say $400/mo. Giving up $100 to add a recurring $400 payment doesn’t seem so bad.

There are clearly other ways to solve this that don't involve depriving people of food stamps. Most every other developed country has figured out some solution.

First of all, in most countries an expired proof of citizenship is accepted for many purposes because it's assumed that people didn't go out of their way to coincidentally lose their citizenship or permanent residence when the ID expired. If it proves residence or driving qualifications, then there are certainly other reasons why it should expire.

Suppose we have an administration, decentralized or otherwise, that stores the records of the people concerned. They can then be contacted and details can be verified.

This informal verification already occurs on many levels, particularly in the US due to the lack of consistent ID. Try flying on a flight without photo ID, entering the US as a US citizen without proof of citizenship, etc. You will be permitted to do so with a bit of extra hassle while you're identified to a reasonable degree of confidence.

I've found that HN and other online communities have a disproportionate number of users who have no idea of rural life in America. As such they cannot fathom a poor, rural person without a birth certificate or a photo ID or the ability to get either.

There is a non-trivial portion of citizen minorities who cannot get IDs because they do not have birth certificates.

First of all, an ID doesn't need to have anything to do with citizenship. It can also be a claim of residence like a driver's license in the US.

Second, if people are eligible for benefits, they are clearly being recorded in some fashion. If the benefit requires permanent residence in the US, I would presume most states are attempting to verify this as well.

In either case, this can be used for either a residence ID or a stronger ID that proves citizenship or immigration status, the latter resembling the national ID cards that many EU countries (among other places) have.

USA is set to require a passport or state-issued Enhanced ID [0] for domestic airline travel this year. It's about as close to a "national ID card" as it can get.

[0] https://www.dhs.gov/enhanced-drivers-licenses-what-are-they

Here is your comment:

>First of all, an ID doesn't need to have anything to do with citizenship

Here is the comment further up that this comment is in the context of:

>It amazes me that there is no authentication provided by governments in the US to citizens.

Do you see why we are talking about citizenship now? Especially when much of the discussion is revolving around voting as well, which does require a certain citizenship status.

The discussion was about unemployment benefits, which in most every case is not limited to US citizens. I believe that when the person who you quoted used the term "citizens," they meant it in a looser sense to refer to people eligible for unemployment benefits, which is what I responded to. Citizenship is also not sufficient proof to receive benefits, so I'm unclear why we're trying to add another confounding factor when states already have a (less than comprehensive) system for tracking residency that can be adapted.

Or social security numbers. Or tax returns. Or proof of address. Or... basically anything that can reasonably indicate that they are who they say they are.

You can get an ID without a birth certificate, many people do. And it has nothing to do with minorities; a large percentage of people without birth certificates are white.

We have those. They're called Passports. But the rub is that some states and local municipalities will not accept a US Passport as ID. Which makes no sense what-so-ever.

> Sure, then don't ask for unemployment benefits.

Does that mean they would get to not pay taxes that pay into unemployment funds too then?

This line of thinking sounds consistent but actually isn’t: even if you’re against the government interfering in your life, you’re still entitled to the benefits that you paid for. Your line would only be consistent if the individuals could opt out of paying. This is the source of the “coercion” claim that libertarians make.

Better identification requirements is actually a right wing view in the US. Requiring it is now considered discriminatory.

You're forgetting the other half of the story which is insisting on requirements without providing the means to get it.

Parts of the right.

The more libertarian parts are terrified at the idea of a database of Americans.

> Vast numbers of Americans...

Very vocal (and provocative) minority

They are just loud and there aren’t many of them.

The bigger issue is that people who need services like unemployment and food stamps most have low penetration rates for things like valid government IDs.

After 9/11 there was an attempt at a national ID card, but it never pans out. https://www.aclu.org/other/5-problems-national-id-cards does a decent job laying out the rationale why it never gets that far.

What we got instead is Real ID, https://en.wikipedia.org/wiki/Real_ID_Act?wprov=sfti1, which is a set of guidelines that States and federal agencies must follow to authenticate people for the issue of their ID and anti-counterfeit features that the ID should have. In other words, the issue was put onto the states.

In Oct 2020 a passport or state-issued Enhanced ID [0] will be required to board a domestic flight in USA. It's about as close as they could get since no one wants a "national ID card".

[0] https://www.dhs.gov/enhanced-drivers-licenses-what-are-they

That requirement has now been delayed until Oct 2021.

Reason #4: ID cards would function as "internal passports" that monitor citizens' movements

I don't understand this one. This was never a thing in the EU, even though IDs are mandatory in just about every member state.

I spent on-and-off four years in Italy and while I initially had to present and ID to my landlord there, who then needed to pass this data to the police, nobody bothered me after that or checked if I'm still there.

Hell, even after a law was passed that initially basically forbade anyone who was in the country more than half of the year from driving a car with foreign plates I still wasn't bothered by anyone, because as I was a citizen of a Schengen area state, there was no reliable way to determine when and where was I lately.

That's interesting. When I changed jobs and moved from NY to Indiana, so my wife could pursue a graduate degree, I had every intention of maintaining my ID and permanent residence in NY, (since I could always still receive mail there via my parents, who allowed me to maintain my permanent residence there whenever I rented or was resident in student housing.)

It quickly came to my attention by communicating with car insurance that I could not do this legally (they sought me out, I have no idea what caused this, perhaps a National Change of Address record triggered?) my car insurance would be terminated because my car was no longer "garaged" in NY, and a lack of insurance on my vehicle registered in NY would trigger a suspension of my license, (and eventually a bench warrant could be issued potentially leading to my arrest, if I did not take action before 30-60 day window passed.)

I wonder if you got lucky, or if this scenario doesn't play out the same way in EU? FWIW, it turned out that everything about being an Indiana state resident is cheaper than living in New York, and it really was to my benefit to get my home permanent residence changed to the new state.

(It was very surprising that I had to do this, though, as a student you are allowed to maintain your primary residence in a different state, I guess this justification works for undergraduate but not for a spouse's PhD study...)

Car insurance and registration is one of those "interesting" areas if one bothers to peek below the surface. I've got a couple stories about it, but how about this (details removed to avoid personal information) one.

A few years ago, my girlfriend moved overseas for about a year, nearing the end of her time overseas I went over and we got married as we had planned. A short while later she returned and moved in with me, having mostly gotten rid of her car/apartment rental/etc (and moved the remainder of her personal items she didn't take overseas to my place) before she left the US. Within a couple weeks of her return, I received a letter in the mail from my automobile insurance stating that they had reason to believe that additional adults of driving age and related to me were living in my house but weren't on my insurance. I either had to notify them of said persons and sign some paperwork indicating that they would never drive my vehicle, or I had to add them to my insurance (for an additional $$$ a year of course).

Now when I got married overseas we did some some paperwork local to that country. But the state I was living in, there was additional paperwork that needed to be completed stating that I had been married overseas/etc. As far as I'm aware that paperwork had not yet been filed before the insurance company contacted me. Nor had my wife changed her address from her foreign one.

So, somehow, not only did the insurance company discover that we were married, they somehow found out when my wife had flown back to the US as well (she returned a bit after me for various reasons). Its not hard to come up with ideas for how they might have put these details together, but I've never managed to find any evidence of the existence of the kind of channels/databases that must have existed for them to pull this off, considering it was a low key event.

And all that for a couple hundred $$$ annually you would probably have to pay had you added your wife to your insurance?

How is that even legal?

Re: #2 and #3, we already have the shadow national databases, just none of the civil benefits.

https://news.ycombinator.com/item?id=17275958

https://news.ycombinator.com/item?id=18987985

If it were harder to scam the social safety net republicans would lose another piece of their argument against making it more comprehensive.

One of the reasons they are happy to cripple it.

https://www.politico.com/states/florida/story/2020/04/03/its...

I am as conceptually socialist and communitarian as they come but there are many reasons for the federal government not to be the identity provider.

It should set the rules (the GOVERNance) by which identity providers provide that service, but it should not itself be in that business.

My favorite way of thinking about it is- the US federal government is a singleton. In any system, you want your singletons to operationalize as little as possible, because they are hardest to change.

Another way- the US federal government is an immortal entity. It represents a perpetual accumulation of all kinds of debt- legal, administrative, technical, financial, whatever. Building and scaling new operational systems within an infrastructure consumed by debt is doomed.

The thing it can do is creating the rules and policies by which a federation of private entities can operationalize a particular need. These entities have limited lifespans, can fail, and have profit and efficiency motives, can compete for business, and are overseen and supervised.

This structure exists in lots of areas, and is more successful in some- banking- less in others- military contracting. But it's vastly preferable to that work being done in the singleton itself.

Cheers.

If governments are singletons, what are individuals? Maybe individuals are other objects? And now the individuals don't need to hold a reference to a government service object if they want to authenticate a message they get from another object. They just ask an identity provider object. But which one? Do individuals have a list of identity provider objects? But what if the sender is using another identity provider object they don't have? Ah! The message could contain a reference to an identity provider. But why should the receiving object trust it? Wouldn't it have to ask a government service whether the identity provider is to be trusted? No silly, we don't want a government reference! It could ask other individual objects whether they trust that identity provider object! Then cache the response? Help me out here, how does reputation work?

Seriously though, you're just moving the problem around. Adding complexity. I mean, does an identity provider object still respond to messages when it's entered bankruptcy proceedings? If you're going to use an analogy, find one that informs.

Snark aside, agree that identity is a complex problem- and compartmentalizing it into components with well-known lifecycles that have known failure modes is the right solution.

The alternative- a single monolithic identity system? No, thanks.

Note- large governmental IT systems underlying programs like Medicare and Medicaid are not operated by government employees, they are operated on a contractual basis by large IT shops. You just don't know who the operator is. That's arguably suboptimal- but a different conversation.

To the specific question- what happens in this model when an identity provider goes into bankruptcy- the same thing that happens when any entity providing critical services goes into bankruptcy.

When a consumer-facing bank fails (for instance), the bank's customers

a) don't lose their money b) don't lose access to banking services

Their accounts are taken over by a comparable entity operating in the same geographical area.

When a critical insurance provider fails, the other entities providing comparable insurance in the operating areas have to take those contracts (even if they are terrible contracts, which they likely are, because they caused the provider to fail).

It doesn't always seem like it, but this kind of market partitioning and supervision is something that in the US both federal and most states do quite well. We should have more of it.

Cheers.

...debt- legal, administrative, technical, financial...

If you're right, then you can institute devolution of any of those things and the issues you cite are going to build up over time. It will just happen at different levels in because it's spread around some many different systems.

The unemployment issue is an excellent example of this. You want to know the reason why Congress gave a flat $600 to all UI recipients even if it would be more than they were making before? Because there isn't a single unemployment system, there are 50 systems each unique, each with their own "debt", and trying to implement appropriate strictures in all of those systems would have delayed that part of the stimulus for months, if not longer.

The way you deal with those issues is by having infrastructure that is built to deal with the issue. Call it societal/social/legal "garbage collection". Whether or not we have such infrastructure, you don't get rid of the problem by shuffling it around.

UI is a program geared toward optimizing payment speed, with fraud looked at as something that is addressed via audit. Historically most fraud or bad reporting can be addressed by capturing future benefits.

With the unprecedented load being placed in these systems, you’re going to see things like email and sms used more, which enables new paths for fraud. Pandemic unemployment is also geared towards gig economy workers, which again is a new frontier of fraud.

It removes a lot of friction if you police transactions after the fact. The only trick is to make transactions un-doable if they turn out to be fraudulent.

I received a letter on May 8th telling me that I applied for unemployment benefits... but of course I did not. I am also in WA state. I filed a fraud report, so we'll see how it goes. So incredibly frustrating...

Me too, I just got one (although it wasn't saying I applied, it was just referring to my "claim #" and telling me about a retraining opportunity). Where did you file your fraud report? I've been meaning to but haven't figured out where to call yet.

I had the same opportunity letter, something about entrepreneurship but also referenced a claim number.

Here's the link: https://esd.wa.gov/unemployment/unemployment-benefits-fraud

(thanks - once I typed my comment I thought "hmm I bet I can just _find_ that form" and lo! it was findable).

Considering whether to also send a paper letter, as those still seem to be "more official" and the state ESD IT systems are clearly a bag of frowns.

It's good luck that the entrepeneurship letter-sending program actually works off my real home address, not whatever the scammers may have input. I certainly didn't receive any other letters from the state regarding my "claim".

Keep in mind the fraud is in the hundreds of millions and the size of the program is in the hundreds of billions ($260B from the CARES act alone: https://www.nelp.org/publication/unemployment-insurance-prov...)

I'll use the food stamps argument: All I see is millions and regardless of how insignificant that number is with regard to how many the program has helped, I'm going to argue the whole program should be shut down because my party says so and uphill bootstraps.

If it's 200M of fraud that's less than a percent. I don't think you can safely say less than 1% of Americans have had their identities stolen so they've done a hell of a job if you ask me.

This pairs well with the high amount of income tax return fraud.

Basically, someone files your taxes for you and steals your refund check.

That explains why I see so many "volunteer" tax preparers on various sites.

Doesn't surprise me in the slightest, given that two days ago someone in Michigan attempted to use my wife's info + email to get unemployment benefits. We live in Seattle, never lived in Michigan.

Managed to file a fraud claim in this case, but only because they happened to use her email address for some reason.

People should look at this as a business opportunity.

Look, states are losing tens of millions of dollars a year in fraud. I bet they would pay many millions to prevent it with smart data analysis and red flagging...

But it will be outsourced to some bullshit consultancy that will take 10x the initial budget and end up not delivering anything.

True, but part of this higher cost would also be to handle all the "requirements" from the government from years of accumulated desires from the people (accountability, supporting minority owners, prioritizing US suppliers, hiring veterans and the disabled, reporting sexual harassment, etc.). In the end, it's all one big cycle with each part blaming another, when in reality this is roughly the best we can do with a system where everyone acts in their own self interests and agency.

In such a system, doing anything takes a lot of time and money. Look at extending subway lines in NYC. The unions, negotiations with property owners, environmental regulations, etc. also impose a major cost and roadblock. Not saying these are bad things to support, as we do want those things, but we should recognize that each of these requirements reduces efficiency (probably exponentially).

All monies from stimulus to unemployment should've and should be directed right into taxpayer's bank accounts; those who made less then 75k last year instantly get the funds. If they are not needed up to the discretion of each person to do the right thing or not.

The unemployment system was a terrible choice with it's antiquated technology systems and no surprise tons of fraud going to scammers while many Americans still haven't gotten their funds to survive on.

Duplicate: https://news.ycombinator.com/item?id=23200553

Interesting that it's the banks that are catching this.

I know we trash banks, and they do some terrible things to customers, but they have become important partners in fighting financial crime including AML (Anti Money Laundering) and other crimes.

I'm sure some banks are using ML to detect anomalous transactions, and I wouldn't be surprised if one or more ML models are what first flagged this activity as suspicious.

Every time our Government wants to help people with cash payouts, there's always massive fraud. You'd think they'd learn.

Could it be possible that the unemployment numbers being reported in the media are larger than the actual number of people unemployed at this time? As in, the economy isn't really in as bad of shape as we are being led to believe.

Jokes aside, blockchain w/zero knowledge proofs could actually help here a lot.

I'm already on the hook for fixing the in-laws WiFi, printer, and IoT cat water bowl -- how could this possibly scale to the masses?

> I'm already on the hook for fixing the in-laws WiFi, printer, and IoT cat water bowl -- how could this possibly scale to the masses?

IoT cat bowl? Leave it out...

As for how it'd scale, I'd say a look to the past would suggest that much like we saw with COVID, every State takes an initiative to deploy it [1] based on each departments need [2]. Hell some States have their own mining operation they were able to fund through some work/jobs program, and were able to get it funded through tax money.

Personally, I tuned out when people at our local meetup were pushing for this: it seemed like government lobbying and I have no interest in pandering to politicians so I stopped listening--my co-founder was doing enough of that for her other ventures and I felt disgusted just asking her about it, let alone doing it myself.

But if I recall correctly, they did manage to pilot test it. Its just that, while I advise everyone to pay their taxes, I hardly see the novelty or utility in pitching politicians to see this tech as a viable means to collect taxes. Especially since the actual talent in this space is already spread far too thin, as it is.

These were ETH guys, so being the Bitcoin guy (maximalist, as they often called me) in the room I didn't want to see needless bloat on the network (after 2017 we all had main-net tx paranoia) so never really bothered to ask any further questions.

1: https://statescoop.com/colorado-lawmakers-push-for-blockchai...

2: https://choosecolorado.com/blockchain/

The ironic part of this is the spam comment (that was not removed from there on purpose) and most likely is one gear of this fraud system

It's almost like decades of governance by people who say government is the problem leads to ... inept governing ...

Pardon my ignorance: Could someone explain to me why this is under the purview of the Secret Service?

It's a bit of a historical oddity, but the Secret Service is responsible for policing counterfeiting and wire fraud. When the USSS was founded in 1865 there was no federal police agency (other than USPIS I believe), so they handled that particular crime and no one has taken the jurisdiction away from them.

https://www.secretservice.gov/investigation/

Why I love HN. Thank you!

Wow Nigerian Scammers have really kicked it up a notch since the “Prince of Nigeria” days

I guess the equitax data breach will lead to real consequences. Just not for equifax.

Ah this is what happened to the lady I faxed stuff for at the UPS Store. That sucks.

Indeed. This complex Nigerian crime ring is best known as PRINCE.

I'm not surprised this is happening in Washington State. Here the voter registration requirements are writing a name on a piece of paper, here's your ballot.

But no voter fraud is ever detected. Hmmm.

Source for voter fraud happening at a meaningful level in WA?

When no verification is done, how can fraud even be detected?

So you have no evidence of it happening then? And we're just supposed to assume by default that it's happening even though you can't provide any proof?

This has nothing to do with voter fraud, and how easy or hard it is to register to vote doesn't seem to bear on the topic.

When they send out ballots with literally zero checking to see if the recipient is an actual person, that sounds a lot like what is happening with the unemployment benefits.

This is a political choice. By choice, the identity system in US is broken. Therefore, it will be used for personal gain. And fraud scales well with technology.

Brought to you by Equifax!!

This is a repost. @dang

I only see https://news.ycombinator.com/item?id=22990237 but it has only 3 points.

From the FAQ:

> Are reposts ok?

> When a story has had significant attention in the last year or so, we bury reposts as duplicates. If not, a small number of reposts is ok.

That's allowed. And 'at'ing people here does nothing as far as I know.

Gee I sure am glad hard working class action lawyers were able to secure me “highly valuable” credit monitoring services after corporate negligence allowed my sensitive information to be stolen.

I find it ridiculous that you cannot buy pseudoephedrine without the pharmacy checking whether you've purchased any quantity of the OTC medicine in any other state via a inter-agency, multi-state networked solution... And yet this kind of stuff still exists.

There is more than enough way to solve these problems, but for some f'n reason there is no will...

Probably not not helpful, but meanwhile just a little bit north in Canada they sell excellent otc allergy medicine with pseudofed. Just wild what we choose to prohibit.

Meanwhile banning coffee roasts and pieces of outerwear because they sound vaguely like the name of scary-looking guns.

I feel like there's just so much in the state now, we need mandatory sunset on anything like this.

Review of legislation and rules/regulation should be routine, rather than boutique, and each time we should be called upon to make a positive case for each rule.

> banning coffee roasts and pieces of outerwear because they sound vaguely like the name of scary-looking guns.

Huh??? Reference?

Looks like it was a mistake: https://nationalpost.com/news/trudeaus-gun-ban-appeared-to-b...

Okay okay, technically it didn't apply since there was no authority, though it shows the haste involved in producing the list. It also appeared to include a plastic toy-grade BB gun, because a PMC once imprinted a similar name on a private batch of firearms that were never sold or imported into Canada.

Furthermore, apparently the firearm used in the shooting that prompted this sweeping ban was never sold on the Canadian market. It was illegally purchased, illegally smuggled into Canada, and you know, illegally discharged to kill people.

There is no connection between the Canadian domestic market for semi-automatic rifles and the shooting, and yet the resultant rules target only the Canadian domestic market for semi-automatic rifles.

https://nationalpost.com/news/trudeaus-gun-ban-appeared-to-b...

Not sure why you are being downvoted. I thought down voting because of viewpoint disagreement was discouraged on HN.

The recent CA gun rules are a knee jerk reaction that will not make anyone safer. It will however further Trudeau's goal of disarming law abiding citizens.

Legal or not there is no need in Canada for a person to own a semi-automatic rifle. Even with the guns there is no need for supersonic bullets and large grain/large mass bullets.

If anything would help it would be heavily restricting access to ammo. I don't understand how people with illegal handguns can even find the ammo for them.

> Even with the guns there is no need for supersonic bullets and large grain/large mass bullets.

Even assuming you could make it such that criminals only get ahold of small subsonic ammunition, that would not have a marked effect on the lethality of criminal acts committed with firearms, and likely would have no impact on the rate of wrongful homicide.

> I don't understand how people with illegal handguns can even find the ammo for them.

Manufacturing and/or smuggling ammunition is easy, and most criminals do not go through a lot of ammunition. In places where smuggling is restricted successfully, criminals find other ways to kill and intimidate people, including manufacturing firearms and explosives; which, it may surprise you, is pretty easy, and pretty easy to do without getting caught. If you want to commit the resources to monitor every machine shop in the Americas and build a trillion dollar system of fences and surveillance outposts between jurisdictions, be my guest though.

> Legal or not there is no need in Canada for a person to own a semi-automatic rifle

Why do you think you know that?

In a free society, the law should not be concerned with defining what is permitted, but with determining what is impermissible. To determine what the law should prohibit, it is not sufficient to ask yourself whether the law would inconvenience you.

When you make laws, you have to be ready to put people in prison for disobeying them, you have to be ready to look their families in the eye and say “I think your father/son/mother/daughter should not be free for the next ten to fifteen years because he possessed the wrong shaped metal object”.

There are many, many people in Canada who are guilty of no malum in se conduct, yet illegally possess firearms simply because they would rather risk the legal ramifications of keeping them than destroy them simply to satisfy the law.

You're going to have to tell me that every time the law sends such a peaceful person to prison and destroys their property, it is worth it. It is no more just to imprison people who possess firearms for their own lawful purposes than it is to imprison people who possess drugs for the same.

> Legal or not there is no need in Canada for a person to own a semi-automatic rifle.

I struggle with statements like this. I’m in the prairies. You know what semi-automatic rifles are great for? Predator control. As an easy example from two weeks ago, a pack of coyotes came into my in-laws farm yard and started attacking the sheep. Would a bolt action rifle work? Sure, but significantly less effectively.

> Even with the guns there is no need for supersonic bullets and large grain/large mass bullets.

Are you referring to the 10kJ rule? Or just in general? It’s always tough to tell where someone’s actual understanding of these things is, versus misconceptions. Supersonic bullets are absolutely necessary for hunting game, as are “large mass” bullets (although 10kJ is not generally necessary for the game you’ll encounter around here).

The vast majority of the rifles that were recently prohibited fired low-mass high-velocity bullets. In many provinces, those bullets were not allowed for hunting because they did not have sufficient energy to reliably kill wild game.

> If anything would help it would be heavily restricting access to ammo. I don't understand how people with illegal handguns can even find the ammo for them.

You’re talking about people who are already in possession of a smuggled handgun, and you can’t conjure up a way for them to get ammunition?

Ammunition is currently regulated the same way firearms are: you have to have a firearms license, after having taken a course and been vetted by the RCMP. The people who are causing the vast majority of (non-suicide) firearms death in this country are not people who give a crap about the firearms licensing regime.

Pseudoephedrine in Canada has to be mixed with acetaminophen, which is difficult to separate back out for meth cooking.

That's what they said about acetaminophen and opioids, even though cold water extraction is easy peasy.

As for separating pseudo and acetaminophen? Right here: https://www.erowid.org/archive/rhodium/chemistry/thecure.htm...

Legit large scale meth labs have actual chemists on their payroll. It's not some junkies with a couple high school chem classes under their belt.

There's no upside to fixing it for the political class.

To the contrary, this sort of thing is beneficial to the political class because each side can point to it and blame the other side.

In fact, the worst case scenario for the political class is a well-functioning society with no urgent-seeming problems to be solved because in a situation like that people will start to wonder why we need the political class at all.

Isn’t that what I just said? There’s no upside. The political class would rather have fraud (real or imagined, as is the case with election fraud) to use as a hammer with which to bludgeon the other side.

"There is no upside [to fixing it]" is not quite the same as it being actively beneficial to those tasked with fixing problems to have the problem remain unfixed.

> for some f'n reason there is no will

Short of overhauling personal identification in the U.S., I don’t see a simple solution. Making unemployment benefits more tedious to claim is politically risky.

> Making unemployment benefits more tedious to claim is politically risky

Any change (resulting in potentially reduced benefits) to any social service results in the following headlines in the next days news:

"President X yanks benefits for the nation's most vulnerable"

President Trump already did this, right before the coronavirus crisis.

https://www.google.com/amp/s/www.vox.com/platform/amp/2019/8...

Why? Because cutting benefits is popular with his supporters.

Callously cutting benefits for a miniority of the populat is populist for the selfish majority.

"Callously cutting benefits for a miniority of the populat is populist for the selfish majority."

The beauty of this argument is that it works for any level of welfare at any given time. Dems could award unemployment benefits of 100K per year and when Reps point out this is crazy, unsustainable, and unfair to tax payers you can trot out the "Callously cutting benefits". Is there any form of welfare reduction you wouldn't call callous? What about the "Callous theft of the incomes from hardworking taxpayers"?

-"Poor minority" demand free medical care ? Steal it from the middle class -"Poor minority demand" ..paid vacation, paid sick leave, paid maternity leave, 4 day work week, free childcare, free whatever.... Steal it from the middle class

And before you say "The middle class gets to benefit from it too!!!" Thats a bunk argument because if they wanted those services they would pay for them like every other service. All of this is just wealth redistribution from those are creating value to those who arent for the market.

How is personal identification an issue for unemployment but not for buying medication?

Just to add a little to the fire: When you go to the airport do they check your ID before you get on the plane or after?

IMHO implementing a 2FA or a ID verification wouldnt be a burden on anyone but the bumbling bureaucrats. This problem isnt limited to UI, its a major problem (10's of billions) at the IRS. Who will send a refund before they even check the return or the income.

They send the refund to the first filer, with no verification! But when it comes to collecting the funds, they will hunt you down if your EIN doesnt match your entity name on the most obscure forms...

To add more on the fire: you can fly without identification in the US.

Source: have personally done it twice

How recently?

Public airport or private?

"Retail" or privately hired pilot?

I'm guessing people only tell the story when they fly a commercial mainline airline out of a commercial airport, simply because "yeah my buddy has a Cessna 172 and we flew to California" just isn't a very good story.

I did this last in 2016 when I forgot my wallet at home on my way out from SJC flying on Delta.

But you didn’t fly until they could positively identify who you are. If they couldn’t identify who you are, you wouldn’t have been on those airplanes.

But I didn't need to carry "identification". I just had to answer some questions.

It is a simple solution, it’s just that some states don’t want strong ID laws. They are willing to turn a blind eye to illegal immigration for votes. As much as I find that unconscionable, it is up to the states to design their IDs and ID laws.

> more tedious to claim is politically risky

I would call that ‘more efficient’.

Besides, they apparently have ‘hundreds of millions of dollars’ to spend on it.

There are various attempts on county and state level to implement forms of (blockchain) based personal identification systems that would be flexible and reveal only the necessary information based on the recipient and issued by the state (Florida / Seminole county is working on such a system). But one big issue is definitely the lack of technological literacy in the ranks of government officials.

This is an assertion without evidence. Numerous states have intentionally made unemployment benefits more tedious to claim. Florida is particularly famous for this at the moment with hundreds of news articles about it. All their changes to the system came with essentially zero controversy or political risk. (No doubt there were a handful of ineffective local organizations that complained at the time but no one's reelection was remotely threatened.)

Lots of the solutions involve something like a national citizen ID program (for an efficient implementation). Done right it fixes tons and tons of problems that cost normal people piles of time and money every year, plus whatever the costs are to businesses and government. But a few political factions—mostly on the right, if you go looking for them, like religious folks who see such IDs as end-times related (yes, seriously), some stripes of libertarian, and the very much real group of people who don't want government to work well—are very against solutions of that sort.

Because the “War On Drugs” is moralistic signaling...

EDIT: The following may be specific to the U.S. state.

Also ridiculous but only tangentially related: Psychiatrists (or similar functions) cannot send prescriptions for ADHD drugs (Adderall / Amphetamines etc) to pharmacies (by any method) [EDIT: at least in Washington State as of March 2020]. You need to pick up the physical prescription from the health care provider, then take it to any pharmacy. The pharmacy may not even have the medication, and certainly will need some time to fill it on the spot.

Of course this is a controlled substance. Somehow this process is imposed by the DEA perhaps together with the FDA (unsure). I know it's a running joke to throw out the term Blockchain, but this really is where Blockchain might be a good solution. Regardless I don't see how a physical piece of paper changes the potential for abuse or any tracking of the patient. The pharmacy doesn't exactly make me verify my identity any differently from normal prescriptions to be picked up.

Also, the prescription is generally only issued for a month. You may get a few prescriptions with different start dates into the future. So every month you will make your pharmacy scramble (and waste your own time) because they could not prepare for your prescription to be filled.

All of this is even more annoying in the time of COVID-19. I need to unnecessarily have in person interactions for things that can happen remotely or virtually.

This is not true anymore, Adderall can be sent electronically to the pharmacy. It makes things so much easier since I don’t have to find time to get into the office to pick up the paper prescription.

Since when? In Washington state it was still true 2 months ago.

It definitely depends on the state. Something to possibly check into, if you have a primary care doctor you can ask them to conference with your psychiatrist so your primary can prescribe it through normal means. I don't know Washington regulations for that, so it might not help.

I've been getting my adderall prescription sent electronically for the past 6 months, since I moved here.

Another post claims they've been getting it sent electronically for a few years: https://news.ycombinator.com/item?id=23215206

I did a quick search and found that Washington State Senate Bill 5380 [0] that was signed into law in May of 2019 says that Schedule 2 substances can be prescribed electronically in 2019. There are exceptions to that and your prescriber may not participate in it.

[0] http://lawfilesext.leg.wa.gov/biennium/2019-20/Pdf/Bills/Sen...

This isn't the case in NY from my understanding as I've seen psychiatrists send ADHD prescriptions digitally to both physical pharmacies and delivery pharmacies (Capsule). So it might be a restriction imposed by your state.

Interesting! Maybe it's a Washington State thing then.

They actually must be sent electronically now in NY, or at least that’s how my doctor explained it to me.

I’d assumed that was for all prescriptions, but it could just be controlled substances.

I was recently told by a pharmacist that this applies to _all_ prescriptions in NY. YMMV, though.

This makes sense because information about controlled substance prescriptions are stored in a central registry so law enforcement or other government agents can review them easily. The federal regs only apply to controlled substances, so the e-script systems 'probably' direct controlled substance scrips to the DEA registry. But, the health providers, insurance companies, health systems, pharmacies networks/chains, and so on, are probably keeping a copy of everything.

> Also ridiculous but only tangentially related: Psychiatrists (or similar functions) cannot send prescriptions for ADHD drugs (Adderall / Amphetamines etc) to pharmacies (by any method). You need to pick up the physical prescription from the health care provider, then take it to any pharmacy. The pharmacy may not even have the medication, and certainly will need some time to fill it on the spot.

This is not true, at least in California. I take a certain ADHD medicine that’s a Schedule 2 drug. So I’m limited to 30 day prescriptions with no refills (so my doctor sends in 3 at a time), but my doctor can most definitely send them direct to my pharmacy.

This is exactly what my doctor in Oregon does. I've never had to deal with a handwritten prescription.

My psychiatric nurse practitioner certainly wanted to reduce her own possible COVID-19 exposure here in the Seattle area but stressed that she could not call or send in the prescriptions for Adderall because of government regulations. Unclear who that regulating body is however.

IANAL

So I looked it up because that is very perculiar, and my quick skimming of the laws seem to imply that Schedule II through V drugs can be sent electronically:[0]

> (1) Information concerning a prescription for a controlled substance included in Schedules II through V, or information concerning a refill authorization for a controlled substance included in Schedules III through V, may be electronically communicated to a pharmacy of the patient's choice pursuant to the provisions of this chapter if the electronically communicated prescription information complies with the following:

> ...

[0]: https://app.leg.wa.gov/RCW/default.aspx?cite=69.50.312

Thanks for checking! :) I'll bring it up with her.

I think all of us agree that the paper prescriptions are ridiculous, especially at this time.

I wonder if we have the same practitioner. I'm having the same issue with mine; she's part of a couple, they practice in Redmond.

I doubt this is an issue specific to the NP. Regardless, we have different providers.

Maybe it's a lowly nurse practitioner vs deeply trusted MD issue?

Doubtful and she works with a MD.

I have many friends in the medical field. This MD vs NP hatred needs to stop.

NPs can be specialized and have great knowledge and experience in their particular field.

And my NP visit is cheaper - absolutely worth it to me.

I think you misunderstood the parent comment. The commenter is not saying NPs are a problem, they are pointing out that NPs aren't treated with due respect. The sarcastic use of "lowly NP" gives it away.

Can confirm!

Sarcasm comes across poorly in online communication, so I should probably use it less :)

My understanding is that an NP is considered as autonomous as a physician. I know several of my friends who are PAs and they're lobbying to be treated the same as NPs, as they feel that some of their restrictions are unnecessary and bureaucratic, logistical issues only, rather than based on patient care.

Exactly. Lots of MDs are of course frustrated because they spent more time and money on education.

The focus should absolutely be on patient care.

My GP doc in WA sends electronic prescriptions of Adderall. When I was using a solo psychiatrist, he would give 3 mos of (1 per month) printed hardcopy prescriptions.

Note, getting the scrip from my GP requires an annual HIPAA privacy waiver and random piss tests. Privacy waiver is because they share medical records of patients prescribed controlled substances with law enforcement or any other local or federal government agency that wants to take a peek.

Super valuable info. Thanks for that.

> requires an annual HIPAA privacy waiver... Privacy waiver is because they share medical records of patients prescribed controlled substances with law enforcement or any other local or federal government agency that wants to take a peek.

So, how good is a regulation if you need to waive it for something as basic as getting your medication?

Makes me respect GDPR even more.

Yes, it totally sucks, and it almost caused me harm trying to avoid it. I am sure I was not the only one. I imagine some poor souls got into some real trouble even suicide.

The American Medical Association, et al., sold out their patients in exchange for not being held accountable for the US opioid crisis. (my opinion of course.)

My doc didn't think it was any big deal, she said I was her first patient to question it. She thought the waiver had some limitations, I showed her that it did not have any limitations except that access had to be for official use (which is not much of a limitation.) The records are stored in an electronic registry that various local or federal government agencies can access without warrants or notice.

As a lawyer I cannot imagine voluntarily entering into such an agreement against the interest of my clients. I still find it shocking.

I had a similar issue with refusing to give a podiatrist I saw one time my SSN.

The rationale was, prior to getting a surgery once, I was asked in pre-op to review my EMR information by the nurse. The info was completely wrong and very dated. I asked the nurse where the info was from since I had never been to that hospital chain before. Her comment was an affiliated urgent care I went to years ago was in their medical system. But the brand name was different because they were acquired. I was pissed. What if I had been rolled in unconscious and that EMR record was meaningfully inaccurate against my wellbeing?

So now it raises eyebrows but I refuse to provide any nonlegally required info. And to OPs point the response is one of almost mocking surprise. But the counter argument is, why would I trust you to not sell my data going forward? What if I'm wheeled into a hospital unconscious and your medical records from 20 years ago somehow cause me harm? Absolutely no way.

What are they testing for? To make sure you’re taking the ADHD meds or to make sure you aren’t taking other meds?

It is a general drug abuse screen, referred to as: PAIN MANAGEMENT PANEL 4 RFLX

It tests for dozens of drugs, including THC.

All patients prescribed a controlled substance have to take it.

Here is a link to a random lab describing it: https://etd.paml.com/etd/display.php?id=8412

>All patients prescribed a controlled substance have to take it.

I was told that I "may need to" take this test at some point. I never have and have been taking adderall for many years.

I guess I did overstate it. I was thinking about the health system I use.

I assume the drug testing requirements may depend on the state or the provider. It benefits the provider/health system by providing evidence they are taking reasonable precautions to limit abuse.

Also, I don't know if psychiatrists in WA are held to a different reporting standard than general practitioners. When I used a solo psychiatrist, no testing or privacy waiver required. When my insurance changed, I lost that psychiatrist and went to a regular doc in a large health system (UW Physicians). They require the testing and waiver.

But the law was changing when I made the change, so it may apply to psychiatrists now, too.

UW is a special case. By law they have to accept everyone in the state and medicare has special requirements for some medications. To avoid discrimination they have everyone take the same tests.

I just realized I didn't answer your question.

They are testing for abusive behavior to identify drug abusers, re-sellers, or negligent providers (over prescribing).

I have read some people complaining that their provider will not prescribe the drug they need if THC comes up in the test. That is not universal, it probably depends on the individual provider or the health provider system.

The best part is that law enforcement can review the records at will (as long as they can articulate an official reason which is a very low bar.)

> The best part is that law enforcement can review the records at will (as long as they can articulate an official reason which is a very low bar.)

True, but a positive test wouldn't be enough to arrest someone for drug possession. I doubt it would even be enough to get a search warrant with.

It varies state-to-state. In Michigan it is as op described. You have to go in person to get a physical prescription. A few years ago it changed briefly but it changed back. Since COVID the rules have been relaxed at least in MI.

Yep. For a long time in Michigan it was physical prescription only, but they could write you two additional 30 day scripts at the time, or you could get a longer script if you were going to be out traveling. But you still have to take it to the pharmacy yourself every 30 days in most cases. (again, much of this has been relaxed.)

My gut says that a lot of this is because of all of the regulations around handling and amount-on-hand rules in MI. There is one not-terrible side effect to the resulting process however; Since typically you'd just wait to get it filled (or pick it up ASAP,) It limits the risk of an electronic fill sitting around and getting 'lost'.

That's odd that you can't get a 90-day supply. I'm also on a Schedule 2 drug for ADHD in California and have gotten a 90-day supply with Kaiser.

Granted, when I was seeing an individual psychiatrist prior to having Kaiser, she said I could only get a 30-day supply as well and would just send 3 at a time too. I feel like there is a way to do a 90-day supply that many providers either don't want to do or don't know about.

Edit - It might be something that's possible with electronic scripts and not possible with paper.

It can also be related to your insurance and employer's choices when setting up the benefits.

I don't think insurance will allow you to triple fill something and don't prescriptions for controlled substances expire?

You don't triple fill all at once. The doctor calls in one prescription for, say January, then one prescription for February, then one for March. You have to go to the pharmacy each month, but the doctor only 4 times a year. Basically the doctor can prescribe a prescription that doesn't start until a certain time. So the start time on the three prescriptions differs.

That's how it's done in FL for non-opioid schedule II. None of our Dr's can call or transmit Schedule II Rx, they have to be hand carried paper scripts.

Opioids are limited to a 3 day supply tho (with some tight exceptions, for those patients that can afford a PM Dr).

With Kaiser at least, if a doctor sends an Rx to the pharmacy the pharmacy can likely see the history. If the doctor sends a 90 day Rx and the last fill date was around 90 days prior, it's plain from that data the abuse is unlikely. They can also easily ping the doctor to verify the Rx and after so many Rx'es would flat the Rx as ok for 90 day supplies. But that's just me spitballing.

Some random pharmacy can't see the fulfillment history from other pharmacies. They only way they could see abuse would be after the fact. They don't want to set themselves up for a lawsuit or criminal investigation so they just limit their Rx amounts.

If they imposed this in California you'd see mass exodus of Adderall addicted techies leaving.

I’m in Minnesota and take both a stimulant and testosterone. You can pick up the prescription from the doctor and deliver it to the pharmacy, or they can mail it in. They can’t use their online system, which I would think would actually be the most secure out of those three options. 30 days only for the stims, 90 days for testosterone.

For healthcare purposes, a fax is usually considered a "paper copy" (unlike, say, an email) so it is quite likely that this is in fact legal.

In PA, my doctor's only been able to send Adderall prescriptions directly to the pharmacy within the past couple years. If yours doesn't, check that it's not a rule from your insurance. My insurance makes me sign a form to choose the only pharmacy location I can use for those meds, amd I need an appointment with my doctor every 6 months.

It's hard to tell what's a federal law, a state law, or my insurance company judging me as a likely junkie.

I had a hell of a time when I chose that in PA and the pharmacy didn't have the medication in stock.

It was 2 months before I was able to finally get it, because I made the mistake of trying to change my pharmacy to one that had it in stock.

Uh what? This seems like the kind of thing solvable with routine electronic authenticated messages from doctor to pharmacy. The problem there is mandating the dubious paper method as the only way.

> ...with routine electronic authenticated messages from doctor to pharmacy.

These are professions that still use fax machines. The concept of sending scrips between random doctors and pharmacies over electronic means is too daunting (HIPPA, privacy lawsuits, child protection laws etc). They would rather stick them in envelopes. Giving it to the post office won't get them sued.

Perhaps for some, but for the last 5-10 years all my doctors have had me specify a pharmacy and the prescriptions gets sent their directly without me having to hold anything physical.

Why do they have to make this such a pain in the ass? They are trying so hard to restrict abusers that it makes it almost impossible to get treatment if you actually have ADHD. Do you know what people with ADHD do? Forget to make appointments because they got distracted. Essentially the system is set up to be hostile to ADHD sufferers to actually get help . I ended up having to pay concierge mental health to consistently be able to fill this script. The doctors would sometimes refuse to see me because of this diagnosis, and the pharmacies would lie to me that they were out of the medication and to come back on x date. If I do this they just repeat the same statement and choose a different random day. This was so much trouble that I spent years without treatment and it affected my life terribly. I did things like cause 10s of thousands of dollars in damages to apartments due to Inattention, almost getting myself fired, driving extremely poorly, almost failing out of school. This condition is preventing me from doing things I really want to do with my life because theres a wall of motivation I have to get over, even for things I enjoy.

Why would doctors and pharmacists refuse to serve you? What's their incentive?

Legal liability or the general threat of having to expose themselves to additional scrutiny of government agents.

If a government agent determines that the doc is over-prescribing they can get into big trouble.

It is because of the US Opioid crisis, but the regulations are directed toward all controlled substances, not just oxycodone.

I sometimes forget to take my ADHD medication on several days and only realize after the fact that I was very unproductive. My friends will also notice that my mind was more cluttered again. I dive from tangentially related thing to the next, only connected in my mind by emotion. Eventually I reach a stack overflow - I'll have no idea how the conversation started or what the real topic or task were.

It isn't very effective if it allows you to forget to take it.

You can still suffer from the same, every day normal forgetting of things on ADHD medication. It doesn't instantly make you superhuman. You still need systems to remember things effectively, ADHD or not.

that's like saying pain medication isn't very effective if you just hurt again afterwards.

it is somewhat ironic that you have to remember to take something that helps you remember to do things.

Meanwhile meth is ridiculously easy to get and can even be ordered on the dark web with little chance of getting caught.

The whole system is just shockingly stupid.

This is what my doc told me, that prescriptions had to be via paper in my state. Another doc said he sent electronically but had to pay a high fee to set up a system to do it for him.

During covid, my doc all of a sudden started sending electronically.

I’m not sure if my doc was wrong, or lying, or just didn’t understand the stupid regulations around some meds.

Lots of small clinics that don't write lots of prescriptions use paper. (I do some IT for one.) It's not regulation, it's cost. As long as it's cheaper to buy the paper and take the time to print on it than to pay monthly fees to the appropriate online clearinghouses, some doctors will do exactly that.

Lots of prescriptions that don't see "abuse" can be communicated to the pharmacy with a phone call. Amphetamines are not such a drug.

It’s funny 90% the time people throw out the claim “blockchain is a good solution for this”, what they really have in mind is just an append-only database controlled by trusted parties. (Before someone tells me the story of Coca Cola’s supply chain, thanks, I’ve heard dozens of times.)

What is this Coca Cola supply chain story?

Yeah, the 'decentralized' part of blockchain seems to slip people's minds a lot.

A centralized ledger database is the right solution sometimes.

> I know it's a running joke to throw out the term Blockchain, but this really is where Blockchain might be a good solution.

Why so complicated? Most use cases for Blockchain could be solved by public-key cryptography, technically backed by using a national government issued, RFID capable ID card (drivers license, passport, whatever) and it's trust chain.

So from my understanding, most prescriptions are handled over the phone/fax, and regulated drugs require some kind of verifiable signature that a fax does not comply with. I believe mail works fine though, as none of this makes sense.

There is an e-signing program that I think lets the pharmacy watch the signature being made or something that is now fixing this issue, but I hear it is both expensive and rather difficult to use.

Look for a pharmacy that offers delivery, they can make the trip to your doctors office for you as again these regulations are ridiculous.

Physical signatures are nearly worthless a digital signature ensures that the prescription is valid unless the doctors computer or the pharmacies is compromised.

This would presumably be no worse than keeping people from forging paper prescriptions.

It would logically be based on a public private key pair like gpg.

I was a bit mistaken, the law requires a full written prescription, not just signature, and it can't be a copy. The system in place allows for electronically writing prescriptions so they will still comply with the written requirement.

There are more security requirements like what you describe, but much of this is about making a new standard comply with laws from the 70's.

Every month I end up playing the game of "will they have my medicine?" and regularly have to drive around different pharmacies to find one that can fill the prescription that day (because they only fill one every thirty days, and there is exactly a thirty day supply given, so there is zero buffer).

This becomes far more problematic if I have to travel for work (which was very common pre-COVID) and I'd literally have to drive an hour to a 24hr pharmacy and wait until 12.01am on the day of my flight, then wait half an hour to get the prescription filled, drive an hour home, then leave at 5.30am to get my morning flight.

And if the refill date occurs when I am away, I'm SOL - CA won't take a prescription from WA for a controlled substance. I usually have to ask my wife to go in early to pick it up, then spend a ton of money to overnight the medicine to my hotel.

There needs to be a system that allows for people who have been taking the same stuff for years to have SOME kind of buffer or slight flexibility. The current system is bullshit.

> Every month I end up playing the game of "will they have my medicine?" and regularly have to drive around different pharmacies to find one that can fill the prescription that day (because they only fill one every thirty days, and there is exactly a thirty day supply given, so there is zero buffer)

This is an utterly absurd situation - surely the people coming up with this stuff must realise this?

If anything, stupidity like this could actually cause more people to go to the black market.

It is deeply annoying for me.

What is genuinely enraging however, is when my son runs out and we can’t get him his medicine. His symptoms are honestly pretty bad and he is aware of them but can’t do anything about it. Hearing him ask “daddy, why can’t I have my medicine?” is both heartbreaking and enraging.

In the end, we asked the doctor, who agreed to issue us a slightly different prescription for him a few days after we filled the first one. This let us get the second prescription Refilled immediately so we thankfully have a small buffer for him now.

Laws like this are bullshit.

This reminds me of Gabe Newell's famous quote, "Piracy is a service problem." If you could buy your medicine illegally as easily as people pirate digital goods, you absolutely would.

I have seriously considered buying a buffer quantity on one of the various TOR-based markets.

If you don't mind me asking, what's the drug/medication?

For me, just adderall. I won’t die if I don’t get it but I have fairly bad symptoms if I miss a dose.

This is an insidious predicament to be in, having once been through this myself. I take it you are also forced to make the decision to burn meds to be able to function while driving to and from pharmacies or face life altering withdrawals to conserve your 30 day supply while you are navigating this BS pharmacy refill circus act we find ourselves subjected to when filling a script we've been on for years, yet met with disdain or a watchful eye meant to keep tabs on a suspected criminal/drug seeker by an overworked and grossly understaffed pharmacy tech who acts as a gatekeeper to getting it filled and will give you a hard time if you are from out of town.

We aren't opioid addicts abusing the system and putting a strain on tax payers, we need this stuff to be a functional and contributing member of society because our brains don't produce enough dopamine for myriad reasons. Why subject us to this hell every 30 days, we need medical reform NOW!

I don't know if it's because you're talking about a psychiatrist or not, but my wife takes Vyvanse for ADHD, prescribed by her family doctor. Ours just retired, and while he wasn't allowed to do more than give her a paper prescription to pick it up each month, the NEW doctor can, because she is set up to send it electronically.

Most other prescriptions he could call in, but I think in WA there's a special system you have to get set up with to do it yourself.

Now my wife doesn't need to physically pick it up anymore. If it would be useful to you, I can find out from my doctor's office what system they had to be part of to allow them to call in prescriptions like that.

This isn’t true in Washington. My psychiatrist has been sending my ADHD meds for digitally for a few years now.

https://www.addcenterofbellevue.com/ If you’re interested in a new doc.

I know this is only dealing with a tiny portion of your comment, but why do people think digital prescriptions require a proof of work database, when matching a UDID and changing a 0 to a 1 would suffice?

I don't understand why it has to be so complicated. In most of Europe you go to a pharmacy with your health insurance card and 30 seconds later you walk out with the drug you have been prescribed. On the rare occasions when it is out of stock you can come back later (usually it takes only a few hours) or go to another pharmacy around the corner where the chances are they will have it.

A odd, underdiscussed, difference I noticed between the US and Germany (and presumably other European countries) is around packaging. In Germany pretty much any medication comes packaged for retail in a cardboard box with tablets on one of these bubble sheets. Similar to most over the counter stuff in the US. In the US the pharmacist puts the tablets into an orange container with the precise counts requested by the prescription and with an individualized label. I wonder how much of the logistics issue in the US is from the individual packaging work required.

Yes, I have seen that in American sitcoms and films. In Europe, as you say, they come in cardboard boxes. The pharmacist will cut out and keep the barcode in the case of prescription drugs.

It would be enforced by the DEA, but as far as I remember, the requirement that only paper prescriptions are accepted for C-IIs is written into the law itself. So only Congress could change it.

There is actually a way to e-prescribe, but there are strict security requirements and I think it varies by state. IDK why blockchain is needed though, an ordinary digital signature ought to be enough and that's what the e-prescribing rule requires.

I find this post interesting because the OP lept to blaming "The Feds" and specifically the FDA and DEA (two frequent targets of popular ire) even though subsequent replies make it clear the OP has no factual basis for any claims made.

> I find it ridiculous that you cannot buy pseudoephedrine without the pharmacy checking whether you've purchased any quantity of the OTC medicine in any other state via a inter-agency, multi-state networked solution

Not defending the practice, but the supposed reason for this is because pseudoephedrine can be used in cooking methamphetamine [1], and supposedly the 'cooks' had mules going around buying up stock everywhere to use in their labs.

The 'check' was supposedly to catch the mules buying large quantities across plural pharmacies/states to use in the cook's labs.

Sadly the unintended consequence is every time one has a head cold and buys original formula Sudafed, some government tracking database somewhere knows one bought that product.

[1] https://www.chpa.org/Meth.aspx

In the state of Oregon, you can't get the 'real' stuff without a prescription. So you get to pay for a Dr visit, to get decent cough medicine. Or you stock up when you are near Washington. :-)

Or you could purchase meth (easy to come by, as with the majority of illegal substances) and do the reverse synthesis in your kitchen? /s

https://web.archive.org/web/20120301155008/https://heterodox...

In the UK they seemingly just removed all the active ingredient. I couldn't understand how it wasn't working for me, Sudafed had been an almost miraculous way to clear a head cold (mucus blocked sinuses); then it just didn't work anymore. Of course they put caffeine in to try and make it feel like it was working ...

Recently, after careful analysis I found they do still make it (or they make it again), but it was a definite bait-and-switch.

One of the common pseudophedrine OTC replacements seems to be ineffective for alleviating nasal congestion.

Phenylephrine Is No More Effective Than Placebo for Nasal Congestion https://www.jwatch.org/na39054/2015/09/17/phenylephrine-no-m...

When ingested. It's a topical medication, it's ridiculous they put it in a tablet. Get the phenylephrine in a spray and it works like magic.

I think parent understands this, and is comparing the controls around pseudo vs the inefficiency of the unemployment system. It’s just the conversation swerved to everyone checking in about whether their doctor can call in their adderall prescription.

The difference here is that one system has federal “war on drugs” muscle behind it, and the other... very much doesn’t.

>There is more than enough way to solve these problems, but for some f'n reason there is no will...

Because the point of the unemployment bureaucracy is to prevent the utilization of unemployment insurance. The easiest and cheapest way to do that is to just make the whole thing suck, which also, as a side-effect, makes it vulnerable to malicious actors.

White collar crime is treated very differently from street crime or other kinds of lower class crime. I'd almost say it's not prosecuted at all. You have to be pretty flagrant or step on the wrong "third rail" to go to jail.

Make a few grams of meth? Go to jail. Launder billions in drug money at a major financial institution? Get a small fine and probably keep your job.

The current president of the United States is a borderline white collar criminal, though most of his past scams are of the "greasy" sort that are just barely on the right side of the law.

It's basically all about the social class of the criminal. The word "villain" comes from the same root as "villager" and means a person of lower social class.

https://www.etymonline.com/word/villain

A while back I found a fascinating crime map of white collar crime. It showed the inverse of what you see for street crime, with huge white collar crime hotspots in richer more upscale neighborhoods. In Compton (Los Angeles area) you are more likely to have your wallet stolen. It's safer to walk around in Santa Monica or Newport Beach, but the person you pass on the street is more likely to be stealing your pension.

You want a reason, watch this

https://www.pbs.org/wgbh/pages/frontline/meth/

I have no idea whether or not to trust frontline because they've seemed on the wrong side of things for certain topics I know more about but, at least that made it clear to me why that stuff might be a controlled substance

There is no will to improve those systems because people on unemployment aren’t typically a group that can donate funds to politicians.

If it’s trivial to do this type of fraud, imagine how easy it is to falsify voting records. Especially in states that don’t have strict voter ID laws.

It may be easy to engage in Tax and UEI fraud, and they get away with it because the money has already left the country, but they do get detected, regularly. To follow your metaphor out, if this were happening with voting records, we'd have lots of people reporting that they went to vote and their vote was already cast. That is not the case.

The way to commit voter fraud is to determine non-voting registered voters in a given jurisdiction and submit ballots on their behalf.

In some jurisdictions there may be 1000s of non-voting registered voters who have moved away, died, or never voted at all (automatically registered voters, etc.)

Pulling that off for thousands of non-voting registered voters would require hundreds of conspirators, assuming generously that one conspirator could physically vote in ten voting locations in a day, and if you have any errors which cause double voting you're very likely to be busted.

Nevertheless, voter fraud happens. While I agree it doesn't effect the outcome of that many elections, I think the loose handling of voter rolls and voter identification, contribute to a distrust in the integrity of US elections.

Interestingly, vote by mail may be more secure than polling stations, because vote-by-mail often requires signature matching (matching signature on ballot cover with signature on registration). But the ACLU is fighting tooth and nail against signature matching.

Care to cite any proven examples and cases?

This page summarizes some, and it includes a link to a database of convictions.

https://www.heritage.org/election-integrity/heritage-explain...

Did you actually read through those? They're either local elections, or single instances. Neither of which would be considered impactful or even of scale to change much of anything... But

It's rather strange that they left out the most recent and egregious instance of fraud. It just happened in NC. Funny how quiet the right gets when its one of their own...The GOP busted for fraud. Election invalidated. Just more projection from the party of projection. You can do better.

The NC case was related to ballot harvesting which is illegal in NC and is discussed in detail in the link below.

Ballot harvesting is a practice celebrated and embraced by progressive democrats. Recent changes in California law make ballot harvesting easier and more susceptible to fraud. Now, according to headlines at least, the GOP is ramping up their efforts to get more into the ballot harvesting game too.

The NC case is described in some detail herein: https://www.heritage.org/election-integrity/report/vote-harv...

All true, but not anywhere in line with your previous claim:

>In some jurisdictions there may be 1000s of non-voting registered voters who have moved away, died, or never voted at all (automatically registered voters, etc.)

The database you mentioned consists of a grand total of 1,285 proven instances of voter fraud over 4 years. Nearly all of them are for single individuals voting twice, usually by submitting a absentee ballot, then voting in-person. There are vanishingly few instances of someone manipulating an election on a significant scale, by tens or hundreds of votes.

So which is it? Are there thousands of instances in multiple jurisdictions per election that we've completely failed to detect, or just a few thousand nation-wide over multiple elections and four years?

This comments demonstrates a willful ignorance to actual facts and shows a bit of gas lighting. So cite the stats, the studies or any meaningful article that shows there is what you claim. False voting records.

People say this on message boards all the time but I have literally never had a problem buying pseudoephedrine. I just walk up to the counter and ask for it. It's faster than buying a steak at the meat counter.

It's not as if any of us are unclear on why sudafed is controlled.

I'm not sure what you are trying to argue here. It's not difficult to buy pseudoephedrine but it is tracked by the ID you provide. And if you go over the limit you can't purchase it anymore. Is this what you are disputing?

You're missing the point. It's the fact that our government created / mandated this multi-agency, multi-state, multi-private/public process and it was implemented in a matter of months. All to prevent people from buying too many boxes of decongestant at one time... The scale of that particular problem pales in comparison to the 100's of billions being tossed to thieves via flawed IRS and UI claims processes.

You lost me at "all to prevent people from buying too many boxes of decongestant at one time". Obviously, nobody --- including the government --- cares how much "decongestant" you need. The problem is that pseudoephedrine is extraordinarily close to methamphetamine and the meth synthesis process is trivial. You can't buy sudafed without an ID for the same reason that you can't buy codeine off the shelf.

It seems that the two of you are talking past each other.

The earlier comment is pointing out that it’s “ridiculous” that the government isn’t able to solve the problem from the article, given that they’ve clearly been able to build a system to track pseudoephedrine sales. They don’t seem to be making any claims about it being ridiculous that they need to talk to a pharmacist to get it, which is what your reply implies they said.

My one and only foolproof strategy to getting a bureaucracy to take security seriously: wait for a giant breach and tell them "I told you so." If you've got a remediation plan on hand and ready to fire, that's your chance to get funding.

Not my money syndrome?

This is because the shadow government is looking to force The Jesus to return.

Not kidding here.

> There is more than enough way to solve these problems, but for some f'n reason there is no will...

It's pretty straightforward. Most people are simple-minded or dishonest enough that they can't understand or admit that policies they like can be inefficient or flawed. In the case of pseudoephedrine, the public conversation doesn't have too many advocates for meth dealers or trivially inconvenienced shoppers. By contrast, any inkling that a government program could be run more efficiently is immediately met with howls of outrage that reform proposals are just cover for the real goal of forcing poor people to starve.

Once you know what to look for, you'll see this for _almost literally every topic_ of this type, from infrastructure to public schools.

Interestingly, there is exactly one top-level comment right now on HN. (Now there are two.) That comment, and the ensuing thread is about buying pseudoephedrine. How does this relate to fraudulent unemployment insurance claims?

No, there is not just one top-level comment. Minimize that comment, then click “more” to see additional top-level comments.

As for the comment you commented on, that comment would be better placed as a child comment, but it’s about interstate commutation issues, which clearly relates to the topic.

More like massive fraud against tax payers. The State is part of the problem here, not a victim. Glad the money I earn by laboring is being taken from me (without consent) and literally handed over to criminals.

Edit: I see some of you just down vote what you don't agree with. That is OK it doesn't make me wrong. The state is complicit here in funneling tax payer money to fraudsters due to their own incompetence. This money is being taken out of the hands of those these programs are for. Anyway, I'll stop making you uncomfortable with the truth now.

Reply on news.ycombinator.com