Letter to Nancy Berryhill, Social Security Administration - Social Security Partnership with Equifax

Letter

Dear Acting Commissioner Berryhill:

We are writing in regards to the partnership between the Social Security Administration (SSA) and Equifax, reported by various news outlets in recent days. Given Equifax's recent security breach, this partnership raises serious questions as to whether the personal data SSA maintains on behalf of all Americans may be at risk of identity theft or other cybersecurity threats. In addition to an immediate threat assessment, we request information regarding the steps you will take to remedy any potential breach of SSA's online systems and what resources are necessary for SSA to ensure that the data of every single American is safe.

According to public records, SSA contracted with Equifax to develop, maintain, and support SSA's E-Authentication program starting on February 25, 2015. According to a February 10, 2016, Equifax press release, SSA had "completed integration," with Equifax.

On September 7, 2017, Equifax notified the public and Congress that it had been subject to an enormous security breach that compromised the personal data of 143 million Americans. While investigations are ongoing, it appears that Equifax failed to undertake routine security patches, allowing hackers to gain continuous access to extremely sensitive personal data for weeks.

As a result, nearly half of all Americans are exposed to potential credit and identity fraud due to Equifax's failure to follow security protocols and its delayed and ineffective response to these breaches. While Equifax claims it has resolved this particular security flaw as of July 29, 2017, it has not explained how its network and information security policies allowed for this lapse in the first place.

On September 8, 2017, the following statement was posted to SSA.gov, "Although we sometimes use Equifax to help verify your identity when setting up a mySocial Security account, Social Security never shares Social Security numbers with Equifax. For concerns regarding the Equifax data breach, please contact Equifax directly . . ."

We are concerned, however, that the statement, may not comprehensively describe the relationship between Equifax and SSA. Instead, it appears Equifax built, maintained, and supported, SSA platforms. If that is the case, SAA's users could be vulnerable to the same breach that targeted Equifax, whether or not SSA proactively shared Social Security numbers with the company.

In light of these circumstances, we respectfully ask that you promptly provide us with detailed answers to the questions below.

Our questions are as follows:

What assurances can SSA provide that the data SSA maintains on behalf of all Americans is safe following the Equifax breach?
What threat assessments has SSA conducted to determine whether online data of all Americans is at risk due to its partnership with Equifax and what are the results of those assessments?
Please describe all steps being taken and the timeline for those steps, including whether SSA conducted an internal investigation or hired outside consultants to determine potential compromises to the E-Authentication system.
If no such steps have been taken, why not? When does SSA intend to take such steps?
Does SSA have the necessary resources to effectively assess potential compromises to the E-Authentication system? If not, please describe what additional resources are needed.
When did Equifax notify SSA of the breach to its own system? Who in your office was notified and what information was provided to your office? Did Equifax express any concerns about the security of SSA's data given this breach?
Has Equifax provided SSA any information about the components used in developing SSA's E-Authentication? Specifically, was the Apache web application that was breached in the Equifax hack used in the SSA E-Authentication? If so, is it still being used and has it been consistently monitored and patched?
Has SSA quantified how many customers could be potentially compromised if the E-authentication system were to be breached? If not, why no? If so, what is that number?
Has SSA partnered with Equifax beyond the E-Authentication system? If so, please provide complete details of each project undertaken with Equifax.
Has SSA alerted the Treasury Department, the IRS, and the Office of Management and Budget about this potential breach, and has SSA offered to brief them on potential vulnerabilities, or provide assurances as to how SSA can confirm Americans' data is safe? Please provide the dates and nature of these communications.
If SSA determines that there are potential threats to all Americans' personal data, should the online portal be taken offline to protect that data?
If it were determined that taking the portal offline was needed to protect the security of all Americans' data, how would such a shutdown impact SSA's customers?
What resources would SSA need to augment staffing and hours in field offices and phone centers to ensure continued quality of customer service?
What contingency plans does SSA have in place to protect Americans if SSA data were breached?
In light of these events -- does SSA intend to reevaluate or withdraw the Vision 2020 program, which intends to force more Americans to interact with SSA online by downsizing staff and field offices?
What resources will SSA require to meet any unforeseen needs associated with potential threats to the security of Americans' online information? Can these needs be met with SSA's currently anticipated funding levels for Fiscal Year 2018? If not, how soon can SSA present Congress and the White House with a revised appropriation request?

Finally, in addition to prompt and thorough responses to the following questions, we ask for your assurance that after a thorough investigation, SSA will take any and all appropriate actions that the fact pattern warrants including taking steps to nullify its contract with Equifax and assess whether a new contractor would be better equipped to address potential vulnerabilities as well as consideration of the merits of a recommendation of debarment of Equifax to the GSA Interagency Suspension & Debarment Committee -- preventing the company from soliciting offers for, obtaining additional, and renewing federal contracts. If any of these steps have already been taken, please provide additional details, including the dates of such steps.

Due to the time sensitive nature of these issues we ask that you transmit answers to us no later than five business days following the receipt of this letter. Thank you for prompt attention to this matter.

Sincerely,

Source