Zach Friesen is elated. He has an acceptance letter from his dream college. The 17-year-old high school senior from Denver celebrates over dinner with his mom. He seems on the verge of living out his dream of leaving his Rocky Mountain home, moving to sunny California, and attending a university that will give him an edge to get into an elite law school. But a few months later, something unsettling happens. He is turned down for a federal student loan. He is startled. Without a $30,000 loan, it's highly unlikely the aspiring lawyer can pay for his first year at the University of California-Berkeley. The whole situation makes no sense.
Weeks later Friesen gets another jolt. He had applied for a summer job as a stock boy at Radio Shack to earn some money for college. But Radio Shack rejects him. The manager tells him he can't work there because he has a red flag on his credit. What? There must be some mistake. This is a teenager who stashes his lawn-mowing money in a shoebox in his closet. He has never even owned a credit card.
Friesen and his mom call the police and explain the situation. An officer comes to his house in suburban Denver and tells him he may be a victim of identity theft. Meanwhile, all of the credit-check activity doesn't go unnoticed. The next day, a collector calls him and tells him he owes $40,000 on a house boat he bought when he was seven. The accusation is beyond preposterous—a first-grader charging a fancy houseboat. He explains this to the bill collector, who isn't interested in explanations—pay up the $40,000 or tell us where you are hiding the houseboat, he orders Friesen. Otherwise, we will repossess your belongings. The threat almost amuses Friesen. What are they going to repossess? The shoebox in his closet?
The absurd scenario leads to a series of humiliating calls to credit agencies and collectors, hours upon hours on hold. Law enforcement isn't much help. Instead of relishing the last semester of high school, the straight-A student feels hopeless and lost. Identity theft has hijacked his youth.
"It is like a Kafka novel," says Alessandro Acquisti, associate professor of information technology and public policy at the Heinz College at Carnegie Mellon University. Acquisti has never met Friesen, but he has heard many similar identity theft horror stories. Last year, identity theft totaled an estimated $48 billion, up from $119 million in 1999. And everyone pays for those losses, he says, in higher credit-card fees and indirectly in higher taxes because retailers can write off losses from identity theft.
Minors, including toddlers, are a small but fast-growing demographic of identity theft victims, Acquisti points out. That's because young people such as Friesen are unlikely to check a credit report until later in life. In fact, the largest population to discover they are victims of identity theft are people ages 18 to 28, according to the Identity Theft Resource Center. And in this wired, connected society, it's never been easier for a thief to steal someone's identity, Acquisti says.
In another bizarre twist, the research of Acquisti and Ralph Gross (CS'08), a postdoctoral fellow, reveals that an accomplice to identity theft may very well be the U.S. government. The pair spent four years looking at patterns of Social Security numbers and discovering just how easy it can be to guess them. They made national headlines last summer when their research showed it is possible to predict most, and sometimes all, of someone's Social Security number by merely examining public data. The predictions are most accurate for young people—specifically those born after 1988, the year the Social Security Administration (SSA) began handing out numbers sequentially at the time of birth. Armed with a birth state and date of someone born after 1988, a person can guess the first five numbers accurately 44 percent of the time on the first try. That jumps to a staggering 61 percent with just two tries.
Police tell Friesen that the theft of his Social Security number likely led to his credit problems. The thief apparently used Friesen's number, changed the age on the credit application, and took out a loan on a houseboat without paying a cent. Friesen calls credit agencies and credit-card companies. He implores the voices on the other line to believe that he is only 17. Honest. There is no way he took out a big loan 10 years ago. They are dismissive. "It's your responsibility to solve your problems," they tell him. "We will provide you with the paperwork."
Months pass, but it's difficult to unravel the mess because the crime is a decade old. It's much easier to correct the problem, he finds out, when you discover it within 90 days. Tracking down the thief is also frustrating. Friesen later learns from an FBI agent that the suspect who stole his identity is believed to be hanging out on several stolen house boats on a Florida dock, successfully eluding police. By now, Friesen is angry at what happened. He's also worried. What if the thief who has his information strikes again? It seems that every day he has to claim to someone that he's innocent. Although the soft-spoken and studious teen isn't a screamer, his mother, Letty, sometimes yells at the credit agency workers. During one particularly galling call, she throws the kitchen wastebasket across the floor in frustration. It's the low point of a terrible summer. She also pays $1,200 in notary fees, legal fees, and stacks of Post-it notes as she fights to get her son's good credit back.
Finally, by mid-July, four months after he was turned down for the Radio Shack job, Friesen has the $40,000 taken off his credit report. But it's not as though the problem is solved. He faces a long road to get his credit restored. And it's too late to get a loan or explain his predicament to Berkeley. He decides to go to the University of Colorado in Boulder, where he doesn't need as much money for in-state tuition. That summer, he still can't find retail employment. No one will touch the teen with the abysmally low credit score. Finally he takes a job working on a dock.
While Friesen is setting up scaffolding on the dock in Colorado in 2004, Acquisti and one of his students, Ralph Gross, have just begun their ground-breaking work on privacy issues. They are examining a then-brand-new social network called Facebook. The next year, they write one of the first published articles concerning privacy on Facebook and describe the kind of personal information college students are revealing online. "The more you see other people do it, the more likely you are to do it," Acquisti says. "It's the herd mentality."
As time goes on, people have no inhibitions telling the world their hometowns, their ages, their pets' names, information that could make it easier to meet online friends, but also may attract online thieves trolling for personal information. "A person would feel very uncomfortable if they were undressing and saw a neighbor watching them," he says. "That same person might feel comfortable posting a semi-naked photo on Facebook."
Acquisti, an economist born in Italy, has great empathy for identity theft victims because he himself had his information compromised while he was a doctoral student at, coincidentally, the University of California-Berkeley. In 2002, while studying information management systems, he registered for a conference online and received a confirmation email with his credit-card number and name. He wrote back, "You shouldn't send this information on the network." Sure enough, weeks later, he saw a bogus charge on his credit card and had to call the company to have it removed. He didn't endure the type of ordeal that Friesen does, but it is a pivotal moment, one of the reasons he became a pioneer in "the behavioral economics of privacy."
The problem with Social Security numbers, in Acquisti's view, is that they were used as identifiers before the age of personal computers and identity theft. Now, in our wired society, they are vulnerable. Nevertheless, businesses continue to use the numbers as authenticators of people's identites without even requiring face-to-face verification. "They are saying if you are able to produce the Social Security number, that's sufficient to prove you are the person," he says. Alarmed at that routine, Acquisti and Gross, in 2005, began their four-year study of Social Security number patterns to find out whether it's dangerous for businesses to rely on them for proof of identity.
Poring over the SSA's Death Master File, they crunched numbers for months on end. At first, they were in the dark. But then they devised an algorithm. It became easier than they thought to predict numbers from public data. This was especially true for young people who live in less populous states. The first three digits reflect the geographical area, and the next two often correlate with date of birth. The last four numbers were harder to guess, but Acquisti and Gross still found a pattern related to date of birth. The culmination of their research, in which Acquisti was the lead author, has landed them on the front page of many newspapers, including The New York Times and The Washington Post. The researchers have also been interviewed on CNN, National Public Radio, Slate, and on and on.
In a statement released to the media, the SSA downplays the Carnegie Mellon research: "The public should not be alarmed by this report, because there is no foolproof method for predicting a person's Social Security number. The method by which Social Security assigns numbers has been a matter of public record for years. The suggestion that Mr. Acquisti has cracked a code for predicting an SSN is a dramatic exaggeration."
But Acquisti says the SSA is missing the point. He never purported to crack any code because the issuance scheme is public knowledge. "We showed that the scheme, coupled with demographic data, is sufficient to make narrow, reliable predictions of individual Social Security numbers."
The SSA says it already had a plan in place to randomize Social Security numbers, unrelated to the report. But Acquisti says that if the administration only randomizes the first three numbers, as he read in one report, it won't solve the problem. The SSA would not comment on how it plans to randomize numbers. No matter how the SSA changes future number assignments, Acquisti says randomization won't protect already-assigned numbers anyway. He would like to see a law prohibiting businesses from using a Social Security number as an authenticator, something the SSA has also discouraged businesses from doing.
As for Friesen, he ended up earning his undergraduate degree at the University of Colorado. Identity theft is still a big part of the 23-year-old's life, though. After being the subject of a newspaper story on identity theft, he was approached by LifeLock, an identity theft protection company, to be a spokesperson. Friesen, funded by LifeLock, travels to high schools and college campuses throughout the country to educate young people on how to protect themselves from identity theft. He advises them to check their credit reports regularly, be cautious of giving out their Social Security numbers, and not reveal too much on Facebook and other such sites. It is cathartic, he says, helping others.
He still wants to be a lawyer, but the crime that happened when he was seven, and remains unsolved, still dogs him. He says credit agencies told him they would restore his good credit, but for reasons that baffle him, it just hasn't happened. He can only get a loan at 15 percent interest and is putting off law school for financial reasons. "My credit is pretty much wrecked."
Sometimes he's wistful about life at Berkeley and wonders whether he should have pushed to get there. "It's heartbreaking," he says. In his lowest moments, he imagines what might have been.
Cristina Rouvalis is an award-winning former newspaper reporter. She is a regular contributor to this magazine.
