Hacker News Reader

There's a nice sketch on this point by Mitchell and Webb: https://www.youtube.com/watch?v=CS9ptA3Ya9E

David Mitchell discusses it further here: https://www.theguardian.com/commentisfree/2018/nov/25/identi...

It's a generalized problem that American corporations have worked hand-in-hand with the government to make sure that they avoid the vast preponderance of legal culpability for any and all malfeasance they cause. You almost have to hand it to them. Almost. As with all systemic issues we face, we can't fix it until we "fix" Citizens United, and that -- as well as any other Constitutional Amendment these days -- will be nigh impossible.

In this particular case the corporations in question - banks - would love to see the problem solved too. They don't want to make fraudulent loans in other people's names.

The problem is that America's government does not provide a strong form of identity. In fact, strong identity is culturally resisted: civil libertarians[0] have been adamant that America should not have national ID cards of any kind. Great, except that this now makes fraud a lot easier.

Today, if you are a bank you don't actually have any good options to verify the identity of a new customer. Names are quite common, people move all the time, phone numbers change and can get stolen, SSNs were specifically designed to be easily forgeable[1], most Americans do not have passports, not everyone has a US birth certificate, not everyone can get a driver's license, the ID-only cards you can get are intentionally designed to be a pain for the above two categories, etc.

[0] This is also one of the few times where I don't have to distinguish between left- and right-wing libertarians either.

[1] If you were born before 2011 you can obtain valid SSNs by incrementing or decrementing the last four digits of your own. You will get the SSN of someone else who was born in the same hospital as you. The first five digits are just a function of the state the SSN was issued in and when you were born. There is no check digit, they only started randomly issuing numbers in 2011, and even then it does not matter because compromised SSNs are never reissued unless you are an FBI informant.

> America should not have national ID cards of any kind. Great, except that this now makes fraud a lot easier.

No, it makes establishing trustworthy business transactions slightly harder. Only slightly, and the necessary technology has been off-the-shelf for some time now.

> Today, if you are a bank you don't actually have any good options to verify the identity of a new customer.

The folks at my local credit union and I know each other personally. It would take a "Mission Impossible"-style impersonation to get them to succumb to fraud ("identity theft".)

> In this particular case the corporations in question - banks - would love to see the problem solved too. They don't want to make fraudulent loans in other people's names.

It is true that banks very much don't want to issue loans that turn out to be fraudulent.

But, they very much more strongly don't want any liability for ruining peoples credit for issuing those fraudulent loans. So they'll rather take the former than the latter. Shift the blame to the innocent person who has no way to prevent it.

Agreed. I believe it is this issue alone -- not voting or gun ownership or anything else -- that will push the US to implementing a verified identification. Loss from consumer financial fraud. And, again, this will be the government only acting, because of the interest of big business.

It's a generalized problem that American institutions of all sorts have successfully lobbied for policies that take advantage of the current neoliberal consensus of "individual responsibilities" and individual-level solutions for system problems that need systemic public policies.

Examples

climate change: individuals should choose electric cars, run their thermostats higher in the summer, lower in the winter, and lower their carbon footprint. Ignore industries that dominate the generation of greenhouse gases

obesity: no, it's not the product of individual fallibility. That's the dominant narrative, but the problem is the food system

retirement savings: join your companies 401k and max out your contribution, get an IRA, save more. Don't blame companies that stopped funding pensions, but let the financial industry capture huge profits from managing funds. Oh and don't have any affordable housing for retirees.

plastic waste and garbage: recycle! return your bottles for deposit! But the “Keep America Beautiful” campaign, was actually the product of beverage and packaging corporations such as the American Can Co. and the Owens-Illinois Glass Co., later joined by corporations such as Coca-Cola and Dixie Cup.

As someone who's lived in a couple of countries, I think one reason credit bureaus are so heavily relied on in the US (and UK) is because they lack a centralised identity database that regulated financial institutions are able to draw from.

Credit bureaus — as well as the various credit building products that are so common in these countries — are required to play that role.

Strengthening government identification would only be reasonable after the US has the equivalent of the GDPR. As it stands right now, doing so would just be another vulnerability for private surveillance companies to abuse just as they've abused social security numbers, driver's license numbers, and even phone numbers.

One way to ensure something never gets done is to bog it down with a bunch of politically challenging prerequisites.

It's already "bogged down" - I described a direct concern. Brushing that aside is equivalent to saying the concerns don't matter.

Social security numbers were introduced for the sole purpose of administering the social security program. The protections on private entities abusing them were neutered, which is how we ended up with the backwards regime under discussion. People have a vague fear that social security numbers are important and shouldn't be casually shared, which is the only thing holding back (for example) grocery stores from demanding your social security number to get the regular prices.

If say the US issued everyone a cryptographic identity via a smart card, there would be little stopping every single business from demanding that you scan this card. Imagine needing to link your singular legal identity to every single online service, so they could better associate your surveillance records. Big tech is currently doing its best to accomplish this through phone numbers, but at least it's possible to get additional phone numbers.

The nature of the problem you are describing (private companies having a more reliable unique ID to correlate data than phone number) seems incrementally worse than what we have today. In practice, most people rarely, if ever, change their phone number. I don't like that companies demand my phone number to get cheaper groceries, but in practice I just type in "(local area code) 867-5309" [1] into whatever terminal is asking for my phone number and get the discount 100% of the time.

The consequences of the problem the proposal is trying to address seem larger to me. Currently, you can be denied access to capital and even basic financial services because identity management has been outsourced to unreliable third parties with no incentive to do a better job.

[1] Sorry Jenny https://youtu.be/6WTdTwcmxyo

Yes, I agree it is incrementally worse. I agree that de facto, the surveillance industry is practically inescapable. The technical ability to avoid various forms of tracking requires an extreme amount of effort and unreasonableness. I myself will put in such unreasonable effort on many things, but I still cannot manage to do so for everything.

Still, there is a difference between this de facto state of affairs, and a de jure mandate from the government to make us more trackable.

If were talking about the deficiencies causing the original topic, the right answer is to rebuke this nonsensical concept of "identity theft" and make companies fully liable for their attempted frauds (ala the top level comment of this tree). If we're talking about constructively building systems to do things the "right way", then privacy needs to be incorporated in such systems from the ground up, as the previous bait and switch with social security numbers has demonstrated.

In the UK there is a Jeremy Bentham philosophy, where by people get loaded up with debt because it generally keeps them productive and out of trouble. Then the UK can attend G7 conferences because its GDP is high enough. Some call it slavery by another name! The US Mil call it punching above its weight and the UK is generally recognised as the no1 soft power in the world. Forget expensive military hardware & Police hardware, intelligence led psychological warfare on the population is cheaper and more deniable when rumours are put out in the community as people voluntarily police their manor like vigilantes watching Emmanuel Goldstein figures. The innovation in innuendo based intimidation and harassment is quite entertaining and its all deniable. The techniques used to create the Nazi's can be deployed in tight knit communities via community watch schemes and the like, no paperwork so the Police are happy with that and the security services can also deny it.

I find your ideas interesting and I would like to subscribe to your newsletter.

Thats the best thing about authority figures, they are believed until they can be proven otherwise, I'm not in a position to prove otherwise. I often wonder if autism is being used as a cover for child abuse!

Innuendo amongst other things is the perfect trigger for paranoia, and in such situations, people will get banged up in a mental health hospital and have drugs forced down their throat otherwise they just get labelled as uncooperative, and then other drugs will be forced down their throat and their detention period increased, perhaps even indefinitely. Its a clever system and there is no judge or jury to convince, you just go straight to mental hospital without passing Go!

You cant argue against this craze for labelling everything as mental health issues, Doctors will not have their authority challenged. I even had a GP tell me how I could suicide myself!

You dont run a country by being nice!

You got a lot to learn, now obey your authority figures and back to work!

Ah yes the portmanteau of negative down votes in order to maintain the aspect of I'm wrong and the downvoters are right. Its the final say #FreeBrunoPowroznik

>Credit bureaus — as well as the various credit building products that are so common in these countries — are required to play that role.

No they absolutely are not. You know what institutions, after government, should have been in principle be absoultely ideally placed to help with identity in a private distributed way?

BANKS (credit unions too perhaps). Lots of secure, physical locations people were used to going into. Already have a need to deal with serious physical security, and lots of money. Already tons of KYC infrastructure. Well regulated and trusted overall. Reasonable numbers of choices. Valuable in-house dogfooding opportunities. This should have been a slam-dunk service for banks themselves to do, and one near impossible to replicate the same way online which also would have been quite helpful for them vs online-only challengers. Each local branch could have a dedicated room or rooms to take photos and video, verify documentation, history, references, whatever else, all the stuff that was (and in much of the world still is) needed to prove ones' identity and open an account. Then the banks could all have their own CAs and give people a signed cert attesting that all this had been done in-person at XYZ location, every bank required to do it themselves with cross signing possible, and all online account usage required to use PKI, no password/email crap. And we'd live in a different, better world.

Instead they've tried to outsource or externalize that. That should be absolutely on them. All the tech has been easily possible develop for something like 20 years (OpenSC even first release was 2001). I'd love to see a law along the lines that financial transactions and products including loans, credit cards etc that are only backed by stuff like described in this article (name, SS#, birthday etc) are simply unenforceable in court and that defendants can challenge it along the lines of anti-SLAPP statutes where the challenge happens pre-discovery and stops the whole process with attorney fees going to the defendant if they win. Bank tries to after somebody for unpaid debt and all they have are info like that? Case dismissed, they can just eat it. Criminal for credit collectors to go after it too. Bet we'd see some changes in a hurry then.

> a random symmetric 9 digit number some government assigned me

SSNs aren't even that random, they're very deterministically generated for the most part. If you know when and where someone was born its not too hard to guess the first 5 digits or so, meanwhile the last four digits are routinely shown places.

The geographic numbering scheme was thankfully stopped for anyone born in June 2011 or later ( https://www.ssa.gov/employer/randomization.html)

Wonderful news. Now its more challenging to steal an 11 year old's information :)

Thanks for sharing this!

It's true but part of the problem is also that people submit to it. The credit system "works" because for the most part, the information they provide is legitimate enough, to the detriment of victims of fraud who now have to prove their innocence.

If people with the means (those that have "fuck you" money and can afford to walk away) suddenly turn around and say "nope" and are happy to have bad/fraudulent credit, the entire credit system collapses - banks need to lend to survive and if the credit system stops being useful in verifying someone's creditworthiness (because even creditworthy people's records are contaminated with bad/fraudulent data) then banks will switch to a different system that doesn't have these problems (and that system could be to manually search for bankruptcy records and evaluating proofs of income, like it's done in many European countries), or lose out to those who switch because the "fuck you money" people will prefer them as they're willing to ignore the credit history system and use alternative means of evaluating creditworthiness.

Of course, a legal solution that outlaws this privacy nightmare is best, but that's a lost cause in the US. The market-based approach described above is more likely to work.

If someone somehow hacks your brokerage account and steals everything, you may be completely out of luck. The bank will consider it your fault, not theirs, unless it's a mass hack (multiple accounts). The law will probably agree with them, and you'll be out your savings.

Totally agree. As an example of how little companies do in these cases to verify things and how lazy they are about ensuring when they pursue claims that they are doing so against the relevant person, here's my story.

Some time ago someone obviously signed a gas contract for a company and just put my home address as the billing address. The first I heard about it was when I received a gas bill for a property that I have absolutely no connection with. It was addressed to a company I have no connnection with at my home address. I've lived in the same house for over 10 years and this company has never been associated with my address in that time. I don't think it was before either but w/e.

I accidentally opened this bill because I receive a lot of mail and didn't realise it was incorrectly addressed. Having seen that it was the wrong thing I wrote to the company explaining their mistake. I also gave them the name and address of the actual officers of the company who had the debt (this is public information in the UK where I live). I didn't hear back except that I received 3 or 4 more bills all of which I returned to sender.

A few months later I received a legal letter from a collections firm saying they had been engaged to collect this debt and I had to pay up or they would take me to court. I wrote to them explaining the situation saying that this debt, company and the property and debt underlying the address was nothing whatsoever to do with me and that I had written to the creditor to that effect some time ago.

I didn't hear back until a few months later, when I received another legal letter from a different person at the same collections firm basically repeating the threat to take me to court. I wrote to them again and also called them up to explain. The person at the collections agency thanked me for calling and said they would deal with the matter.

A few more bills arrived. I returned them to sender (at least once in an envelope with a covering letter explaining the situation again). Then I received a notice saying a default court judgement had been entered and that the bill had to be paid. I wrote to them again and said they had to stop harrassing me and actually pursue the collection against someone associated with the actual company.

It was super clear that at no time did anyone associated with either the original creditor or the collections agency make the slightest effort to actually try to collect this debt from someone who was actually responsible for it. This is in spite of the fact that I spoonfed them the names and addresses of actual people who were associated with the company responsible etc. This situation could also never have occurred if they had actually made any effort at all to check whether the company was associated with the billing address.