Hacker News Reader

Comment by hnthrow90348765 | Hacker News Reader

Intent to drop in, make major changes, and pretend like they won't break anything is ill intent

We criticize engineers who drop into a code base and try to make changes without understanding. You can be forgiven for doing it a few times, but after that you're doing it intentionally. And if they hired engineers that didn't know this, that's incompetence at both levels.

Not only is this different code bases and IT products, it's across organizations and done very rapidly.

I am also not convinced that they don't simply have malicious intent most of the time.

View on HN

Elon has been operating in bad faith since the Twitter Files (so, the very start). Announce X, publish receipts that show ~X, but nobody reads receipts so checkmate.

The "140 year old people in social security DB" post is just the latest example of bad-faith. Either there is actually >>$100B of social security fraud and that's the story or he wants to pretend like that's the case when he knows full well that presence in the DB does not indicate eligibility or payouts.

Agreed. Show the check numbers, mailing dates, bank transfers, etc. If there's actually really tens of billions flowing out to dead people monthly... demonstrate that. Should NOT be hard at all.

Should not be hard... if it exists. Which is why I'm 99% sure it doesn't. But the lie will go twice around the world before the truth gets its pants on, as always.

For sake of testing your position, let's assume the fraud is true and he does what you want and publishes the details like that.

What about the corner-case person who actually is legitimate and now has incredibly private information out there to make stealing their identity trivial? As a statistical anomaly who is often that corner case, I'm glad you're not the one making the policy. I wish Elon wasn't as well, and I'm sure there's going to be a giant mess at the end, but using government power (which Elon has, whether rightly or wrongly) to publish personal information about people (which they get by force giving their monopoly on government power) especially without trial or due diligence is very wrong IMHO.

This is what courts and process and testimony are for. Doing this reliably in the face of bad actors with minimal stepping-on-fingers is a solved problem.

Unless you don't actually care about the truth and want to send a convenient lie twice around the world before the truth gets its pants on. Then you should act like Elon is acting.

> What about the corner-case person who actually is legitimate and now has incredibly private information out there to make stealing their identity trivial?

Elon usually has doesn't have any compunction about throwing innocent people under the bus if he thinks he gains something even if indirectly.

But that aside, you can show evidence of massive fraud, without revealing private information to general public. Can certainly reveal it to relevant authorities.

To relevant authorities who are properly vetted? Feels like ouroboros…

You would have to quantify what properly vetted is a unelected bureaucrat is. I guarantee vetting for three positions are probably little more than validating you don’t have outstanding warrants.

I understand that these 140/150 year old recipients are actually the results of incomplete birthdate data.

To steelman the argument though, it seems reasonable to audit these recipients so that we can get their true birthdate entered. The number of recipients who lack a valid birthdate because they found a way to fraudulently claim benefits is likely non-zero, but probably low. But in any event, cleaning up the data can’t be a bad thing.

Why spend money chasing people who aren't collecting checks? That sounds like waste to me.

Also those identities can't collect checks, because if they tried it would set off alarm bells and reviews because they're over a standard "assume they're already dead" limit.

Imagine the brouhaha these same folks would be raising about "wasting your tax dollars hiring historians" if that other direction was in their self-interest.

This is also the same argument made against IRS audits on lower tax brackets. Basically, its not generally worth audits of low income citizens. Because the manpower required to perform the audit exceeds the revenues recovered.

Yet audits of individuals making < $25k per year is over 5.5 times higher than those in all other income brackets (1.27% vs 0.25%). So we chase down citizens when likely they probably don't even had a tax burden anyway. Maybe they misfiled some taxes and should be taxed a few hundred or even a thousand dollars more. But the manpower to chase down these little checks is a net negative on the department.

Sure, it is possible you find fraud in some of these low income cases. Someone claims to only make $25k but really they run a cash business and make $80k. But these are likely so limited thanks to other validations the IRS has access to, that the number of cases that reveal this is extremely tiny. So back to another argument on here, there an expectations that fraud is non-zero, and we accept that because getting fraud to zero is not worth the cost.

If something costs more to fix than it costs to leave sitting around, fixing it is less efficient. In this case it's already been investigated prior to DOGE, and deemed not worth the effort to clean up [1].

[1] https://oig.ssa.gov/assets/uploads/a-06-21-51022.pdf

I think the problem they should be considering more acutely is, eventually the number of people trained in that specialized knowledge will go to 0, and they will then be paying the cost to either train more (and the increased risks of less familiar people) or replace the whole thing with no backup plan.

Given the age of the COBOL programmers I know, that window is rapidly shrinking...

You fix the system not because of the cost today but because the cost it will eventually cause.

Poor record keeping and bad policies about data validation tied to sending money to people if not today will eventually result in massive fraud.

Furthermore the notion you put forth is trash lazy thinking. Cost or no cost you do things the right way. But I don’t even buy you can calculate the cost of doing it wrong correctly to even have a sound conjecture that fixing it is more costly.

Your point is also covered in the audit report linked by the parent.

Cost was not the only factor. They seem to be trying to handle missing data the right way rather than use a kludge.

They did not want to add inaccurate death data to Numident records, for a variety of reasons, one being that it could cause release of information for living people when they're accidentally added to dead people records. The SSA also thought adding annotations would legally require a new regulation and would have impacts on other consumers of the data (ie. states, etc).

How to handle missing death data in this case does not appear to have a clear and simple solution. But it also does not appear to be evidence of poor record keeping for modern records or a major cause of concern for "eventual massive fraud".

Missing data means == no payments until data is updated.

This creates a driver, somebody who is motivated to get it fixed. If the person does not exist they won’t be calling for their check, or if the entry fraudulent, fraudster will run the risk of exposing them self in the process of trying to get the checks flowing again.

But what if the right way is judging the pros and cons of perfection and doing what makes the most sense?

OIG Response:

  We acknowledge that almost none of the numberholders discussed in the 
  report currently receive SSA payments. However, SSA issued each of these 
  individuals a valid SSN and these SSNs could allow for a wide range of 
  potential abuse. 

  [...]

  We also note we initiated our 2015 review upon the receipt of information 
  that a man opened several bank accounts using SSNs belonging to 
  numberholders born in the 1800s who had no death information on the 
  Numident. In addition to being used to obtain employment or open bank 
  accounts, identity thieves can potentially use these SSNs to create 
  synthetic identifies, obtain credit, government benefits, or private 
  insurance.

> these 140/150 year old recipients

What is the evidence these exist?

To quote patio11,

“The optimal amount of fraud is non-zero

He was talking about the banking system. But he was also hinting at something bigger. There is a game theory problem often referred to as the meter maid problem. What is the optimal amount of meter maids in a city, where optimal can be defined in at least a few different ways, but roughly means the cost to revenue optimal. You end up with a couple of obvious extremes, no parking enforcement means no cost, but no revenue (plus parking may end up out of control if charging for parking is more than just revenue generating). The other extreme is thay you have enough people policing parking that no one ever fail to comply, this is the highest cost, but not the highest revenue, because you don’t get revenue from ticketing. So the answer is that the optimal number lies somewhere where the number of meter maids allows some percentage of people get away with failing to comply with parking rules (whether deliberate or accidental can further complicate the problem since both will happen).

So back to your steelman. Cleaning data is most certainly a desirable thing, but it is likely not the optimal thing, especially if the cost is high. And unauditable access to systems is a very high cost. Seems to me much of this auditing could be done in a much more acciuntable way.

On top of that, there's an assumption that there's no existing cleaning effort. I'm sure there is and it's just a difficult problem. The cases left must be either in progress, hard to track down, or not actually meaningfully active.

Or, as is really common with the federal government, the agency is actually underfunded and hasn't been able to modernize because the Republicans in congress have been trying to starve the administrative capacity the classic, slow way until now.

Like with the IRS. I've made mistakes in filing, and gotten a notice from the IRS about it, but sometimes years later (!). In the meantime, if you "audited" the IRS records, you'd see that my records are out of compliance and could claim "See, there's fraud!". In reality, the IRS just has slow antiquated systems, and is barred from giving taxpayers direct access to their records. Which is by design from the rich and anti-government.

Presence in the DB allows for downstream fraud, even by accident. If that DB is the source of truth for SS payouts elsewhere, clean up the data. There's no reason for it to be there.

> Presence in the DB allows for downstream fraud, even by accident.

That's like saying null columns in a particular database table must be filled in (or have the row entirely erased) because someone, somewhere, somehow, might infer the wrong thing about them, if they completely ignore all the other tables and business rules.

___

"Hello, I am Oldy McOldperson. Give me money."

"...Sorry sir, but that person would be almost 150 years old now, and that's well past our Impossibly Old threshold of 115 years. Furthermore, one our other databases says that person was reported as missing 90 years ago."

"But Oldy's--I mean, my precise confirmed date of death is still blank, therefore I'm alive, so give me money!"

"Sir, only a complete moron would believe that's how it works."

The reason given that the SSA does not clean up the data is it would cost too much for little to no administrative benefit. They also don't want to add new inaccurate data to the system.

The no administrative benefit bit checks out with napkin math. Of the 18.9 million entries for people age 100 or older they are paying out benefits to 44,000. The total number of people in the US age 100 or older is around 90k to 100k, depending on time period for comparison.

There's an Inspector General audit report in a nearby comment for source.

Social Security receives payments as well as makes them. SSNs are keys for both.

The “super old person” SSN numbers are in the DB mostly because non-citizens are using them to pay into the system. If you delete those numbers, the next payroll run will inject them right back in.

And you would remove important accounting metadata for each payment. Metadata that is consumed by the systems that prevent fraudulent payments from going out.

The only way to stop the fake/bad SSNs is to go into the field and address each instance with employers. This is time-consuming and expensive, which is why no one has done it much.

Show us the (public) Court Filings. The formal start of education to evaluate if there is truth, if there is a guilty party, and to legally render a verdict. The check numbers and other PII can be evaluated by the courts. We the People can know the numbers; the scale per case and in sum, of the 'fraud' identified.

Elon has been operating in bad faith since he called that hero diver a pedo

Elon has been operating in bad faith since he came to the US on a student visa and then illegally worked for a startup.

And then faked his degrees

Any sufficiently advanced incompetence is indistinguishable from malice

This is correct. Depending on the stakes, the right answer would be to err on the side of caution. Certainly repeated incompetence in a private setting would be grounds for suspension or termination.

People with malice like Elon Musk have noticed the widespread use of this aphorism and repeatedly leverage it to their advantage.

Yes and: fraud and errors are often indistinguishable.

At what point does incompetence /become/ malice?

There is certainly a level of incompetence that requires active ignorance to one's naivety. I'd certainly consider a stubborn person who arrogantly ignores concerns of experts malicious. The active nature certainly matters.

Yes. Consider the concept of negligence. It is malicious to take action without exercising reasonable care, and part of reasonable care is ensuring that you are the slightest bit qualified to perform the action.

I obviously agree, but for anyone reading along, this is also the legal definition: reasonable care. Reasonable is determined by peers, not the general population. So...

Reply on news.ycombinator.com