Safeguard Your Social Security Number

The FTC Warns About the SSN Scam

Your Social Security number is an important key for an identity thief. Scammers want it, and they think of all sorts of ways to trick you into giving it away.

Here at the Federal Trade Commission, we’re getting reports about calls from scammers claiming to be from the Social Security Administration. They say there’s been a computer problem, and they need to confirm your Social Security number.

Other people have told us that they have come across spoof websites that look like the place where you would apply for a new Social Security card – but these websites are actually a setup to steal your personal information.

If you get a phone call or are directed to a website other than ssa.gov that is claiming to be associated with the Social Security Administration, don’t respond. It’s most likely a scam.

Here’s some tips to deal with these government imposters:

• Don’t give the caller your information. Never give out or confirm sensitive information – like your bank account, credit card, or Social Security number – unless you know who you’re dealing with. If someone has contacted you, you can’t be sure who they are.
• Don’t trust a name or number. Con artists use official-sounding names to make you trust them. To make their call seem legitimate, scammers use internet technology to spoof their area code – so although it may seem they are calling from Washington, DC, they could be calling from anywhere in the world.
• Check with the Social Security Administration. The SSA has a warning about these scams and suggests you contact them directly at 1-800-772-1213 to verify the reason for the contact and the person’s identity prior to providing any information to the caller.
• If you come across one of these scams, please report it to the Social Security Administration’s Fraud Hotline at 1-800-269-0271 and then tell the FTC about it. https://www.ftccomplaintassistant.gov/

 

The Social Security number has become a national identification number in the United States, and as a result of this it has also become the key to identity theft. Many people assume that they are required to give their SSN whenever and by whoever asked. That is simply not true.  Federal law does not prohibit a merchant or other business from requesting your SSN. However, there is no state or federal law that requires you to provide your SSN to any entity not authorized by law to require it.

 

Agencies that may require your SSN:

• Government tax and welfare agencies, including the IRS, other federal agencies (for health benefits and other entitlements), state/local tax or revenue agencies.
• State professional/occupational/recreational licensing agencies.
• Other governmental agencies -- under federal law, they must tell you why your SSN is needed, whether giving your SSN is mandatory or voluntary, and how your SSN is to be used.
• Employer – You employer can require it for wage/tax purposes, but NOT from a job applicant.
• Banks and securities brokerages -- under the USA Patriot Act, 31 U.S.C. § 5318, financial institutions are required to establish minimum standards for properly identifying their customers opening new accounts (include checking, savings, loans, safe deposit boxes, and/or investments). Under federal regulations adopted in May 2003, banks, savings associations, credit unions, securities broker-dealers, futures commissions merchants, and mutual funds were required to have Customer Identification Programs (“CIPs”) in place by October 1, 2003. Information required to identify customers under a CIP includes name, date of birth, address, and a social security or federal tax identification number.
• State motor vehicle departments – the may collect your SSN but some state laws prohibit the recording of your SSN on your driver’s license or state identification card.

According to the Social Security Administration: Organizations should avoid using Social Security numbers (SSNs) as identifiers for any type of transaction.

 

In an effort to curtail identity theft, the Social Security Administration (SSA) is initiating a public information program to encourage the use of alternate identifiers in place of the Social Security Number (SSN.) Many organizations including businesses, government agencies, medical facilities and educational institutions continue to use the SSN as the primary identifier for their record keeping systems. [The Social Security Administration is] seeking your support, as well as the support of the general public, in helping to ensure the integrity of individual SSNs.

Identity theft is one of the fastest growing crimes in American society. The routine and often indiscriminate use of SSNs as identifiers creates opportunities for individuals to inappropriately obtain personal information. Repetitive use and disclosure of SSNs in organizational record keeping systems, multiplies the susceptibility of persons to potential identity theft. Through misuse of SSNs, individuals are subject to the danger of identity theft and its repercussions. Access to an individual’s SSN can enable an identity thief to obtain information that can result in significant financial difficulties for the victim. While this can be disruptive for the individual, it can also lead to civil liability for the organization and its individual employees if someone is harmed by information that has been made available to others.

An organization’s collection and use of SSNs can increase the risk of identity theft and fraud. Each time an individual divulges his or her SSN, the potential for a thief to illegitimately gain access to bank accounts, credit cards, driving records, tax and employment histories and other private information increases. Because many organizations still use SSNs as the primary identifier, exposure to identity theft and fraud remains.

• Never list an SSN when posting a paper record on a public bulletin board
• Never send SSNs via an electronic format
• Never have a computer log-in system where a person has to use their SSN
• Never use SSNs on ID cards
• Never send SSNs on postcards
• Never store SSNs on unprotected computer systems
• Never carry a Social Security Number card on your person 

Guard Your Last Four. Although most widely used and shared, the last four digits of your SSN are in fact the most important to protect. These are truly random and unique; the first five numbers represent when and where your Social Security card was issued (prior to 2011). So don’t use the last four of your SSN as a PIN, or as a way to confirm your identity over the telephone. Ask companies to use an alternative identifier.

The ACLU recommends that you "Use caution when giving out your SSN to a government agency. They are required by the Privacy Act of 1974 to tell you why your SSN is necessary, whether giving your SSN is mandatory or voluntary, and how your SSN will be used. [Always get a written copy of the Privacy Act requirements when a government agency asks for your personal information.] And stop giving your SSN to private organizations. Suggest they use an alternative identifying number. If they refuse, think about taking your business elsewhere."

The Electronic Privacy Information Center (EPIC) has stated "The widespread use of the SSN as an identifier and authenticator has lead to an increase in identity theft. According to the Privacy Rights Clearinghouse, identity theft now affects between 500,000 and 700,000 people annually... Identity theft litigation also shows that the SSN is central to committing fraud. In fact, the SSN plays such a central role in identification that there are numerous cases where impostors were able to obtain credit with their own name but a victim's SSN, and as a result, only the victim's credit was affected."

The bottom line is that use of your SSN to identify you across multiple records and systems of records puts you at risk. Whenever a business or government agency asks for your SSN that risk is increased. Always understand what use will be made of your SSN if you provide it. For government agencies, always obtain a written copy of the Privacy Act provisions related to their request for your SSN. For private businesses, always ask that they not include your SSN in their records and that they use an alternate identifier. For businesses that insist on having your SSN, consider filing complaints with the Better Business Bureau and your state consumer protection agency. As a general rule whenever you are asked to provide your SSN (or even your last 4) - Just Say No!

 

 

Russia Orders Messaging Apps To Hide Cooperation With Law Enforcement

According to an article in the Moscow Times: Messaging services in Russia have been banned from disclosing any cooperation with law enforcement agencies, according to a new government decree.

A 2015 law requires internet companies to store Russian citizens’ personal data on local servers accessible to local law enforcement. Over the past year, the popular Telegram messaging app has been embroiled in a legal battle with Russia's Federal Security Services (FSB) over refusing to provide access to the online conversations of users, including suspected terrorists.

The new decree orders messengers to ensure the non-disclosure of any information regarding specific facts and contents" when cooperating with the authorities.

The messengers are also required to provide remote access to their systems no later than three months after receiving a request from the FSB.

Last year, Telegram appealed to the UN  to intervene in its legal battle with the FSB over online privacy rights.  Telegram's founder, Pavel Durov, has previously said that the FSB's demands violate the constitutional rights of Russian citizens to the privacy of correspondence.

--
I respect Telegram for standing up for the privacy rights of Russian citizens (and all users of Telegram), much as Apple did in the United States when faced with demands from the FBI to create a backdoor to defeat the encryption on iPhones.

Telegram, has a feature called "Secret Chats" which increases the security of your communications by providing end-to-end encryption. The Telegram FAQ page says:

"Secret chats are meant for people who want more secrecy than the average fella. All messages in secret chats use end-to-end encryption. This means only you and the recipient can read those messages - nobody else can decipher them, including us here at Telegram (more on this here). On top of this, Messages cannot be forwarded from secret chats. And when you delete messages on your side of the conversation, the app on the other side of the secret chat will be ordered to delete them as well.

You can order your messages, photos, videos and files to self-destruct in a set amount of time after they have been read or opened by the recipient. The message will then disappear from both your and your friend's devices.

All secret chats in Telegram are device-specific and are not part of the Telegram cloud. This means you can only access messages in a secret chat from their device of origin. They are safe for as long as your device is safe in your pocket."

You can download Telegram here: https://telegram.org 

PacSafe

Protect your valuables while you're out exploring with the Pacsafe Travelsafe portable safe, which is available in two sizes - five liters (5L) and twelve literes (12L). The poly-canvas material is embedded with Pacsafe's patented 360-degree eXomesh locking system, a stainless steel wire mesh that helps prevent would-be thieves from breaking into the safe.

It comes with a TSA accepted 3-dial combination lock, and it features a padded EVA foam laminated and soft brushed polyester lining, water resistant exterior, and handles for convenient carrying. The 12L model can fit a 13-inch laptop, while the 5L model can store an iPad (10-inch tablet)

When you're not using it, the Pacsafe Travelsafe portable safe conveniently folds down flat to fit into your luggage.

PacSafe Travel Safe is an excellent way to secure valuables in your vehicle against smash and grab theft.

Opt-Out of People Search Databases (UPDATES)

At the beginning of the month (January 2018) I posted a list of links allowing you to Opt-Out of People Search Databases.

Here are an additional ten data broker opt-out links. All of these are now also included in my original post.

DOB Search - https://www.dobsearch.com (Select "Manage My Listing")
Info Tracer - https://members.infotracer.com/customer/terms?tab=optout
Go Lookup - https://golookup.com/support/optout
LexisNexis (KnowX) - https://optout.lexisnexis.com/oo.jsp
PeopleLooker - https://www.peoplelooker.com/f/optout/search
Public Records Directory - https://publicrecords.directory/contact.php
Research.Com - https://www.research.com/people-search/opt-out
Seek Verify - https://seekverify.com (e-mail: privacy@seekverify.com to opt-out)
US Identify - http://www.usidentify.com/company/privacy.html (See para. IV. Choice & Opt Out)
Truth Finder - https://www.truthfinder.com/opt-out/

What are data brokers? Spokeo, White Pages, Intelius, Been Verified, People Finders? This article by Abine* is a good overview of data brokers and how to opt-out of having our data displayed by many of these companies. The article ends with a recommendation to use the Abine "Delete Me" service to help remove your personal information from the Internet. 

*Abine, Inc. is The Online Privacy Company. Founded in 2009 by MIT engineers and financial experts, Abine’s mission is to provide easy-to-use online privacy tools and services to everybody who wants them.

Zello - Walkie-Talkie App

Zello is an application startup located in Austin, Texas. The application emulates push-to-talk (PTT) walkie-talkies over cellular networks. The apps is available for Android, iOS, Blackberry, Windows Phone, Windows PC, rugged mobile devices and two-way radios. Zello is free while the Zello@Work application is free for up to five users. For more than five users Zello@Work costs $6.00 per user / per month. Perks that Zello@Work offers include private networks, dedicated servers, management interfaces for users and channels, higher security, cloud history and tech support.

 

Zello turns your phone into a walkie talkie and works anywhere in the world as long as you are connected to the internet! Please note however that the Zello app cannot function without cellular data service or an available Internet (WiFi) connection on your cell phone. Users can join channels and instantly send voice messages or photos, and the app even works over older 2G networks.

 

Zello made the news in June 2013 when Turkish protesters used it to circumvent government censors. As a result, Zello was the top most downloaded application in Turkey during the first week of June 2013. In February 2014, it was blocked by CANTV in Venezuela. Zello issued workarounds and patches to overcome the blocks to support approximately 600,000 Venezuelans who have downloaded the application to communicate with each other amidst protests. It "has been one of the most downloaded applications in Ukraine and Venezuela." In April 2017, the Roskomnadzor instructed Russian Internet Service Provides to block mobile access to Zello. Under Russia’s data privacy law passed last year, all companies processing the personal data of Russian citizens are obliged to store it on servers within the country’s borders for a half of the year and provide it to law enforcement if necessary. Zello has more than 400,000 users in Russia. In August 2017 during relief efforts following Hurricane Harvey in Texas, Zello became a popular method for communications between volunteer rescuers and people stranded by the widespread flooding. The app received over 6 million signups in one week as Florida residents prepared for Hurricane Irma.

 

According to the Zello Support web-site: "Starting in June 2017 all private voice messages in Zello are end to end encrypted when you are using a version of the app released after 06/06/2017. Voice in public channels is not encrypted as they are open to the public and anyone can listen."

 

Zello's encryption protocol is:

• 1024 bit RSA for authentication, digital signatures and secure media session keys exchange.
• 256 bit AES for audio and call alerts.
• TLS for control traffic encryption between Zello client and Zello server

Zello can also be connected by a radio bridge to your computer, allowing you to use your radio to communicate over the Internet. The procedure to do this easy, and demonstrated in several YouTube videos.

 

Baofeng walkie talkie Zello bridge/repeater

 

How to Make Zello Crosslink in 4 Easy Steps!

 

I like Zello, and recommend it a one method of communication. There are some limitations to the Zello App - it requires an Internet connection, and it is possible for governments to block Zello; but overall Zello is an excellent communications tool.  

 

 

FireChat

FireChat is a mobile app that uses wireless mesh networking to enable smartphones to connect via Bluetooth, Wi-Fi, or Apple’s Multipeer Connectivity Framework without an internet connection by connecting peer-to-peer. FireChat was introduced in 2014 with the ability to post messages to public chatrooms that counld be viewed by anyone using FireChat. In 2015, FireChat added private messaging, allowing users to communicate privately with each other, and in July of that year added end-to-end encryption to protect one-to-one private chats.

FireChat builds its own mesh network, connecting directly to other FireChat users up to 200 feet away. FireChat's store and forward function allows users to pass messages anywhere within the mesh network, and the more people using FireChat in an area, the large the mesh becomes. In an area without cellular or WiFi service, several FireChat users could establish a mesh network providing communication over as large of an area as there were FireChat users available to participate in the mesh. Once the mesh includes users with Internet access, FireChat then has the ability has the ability to send and receive message anywhere in the world.

FireChat is available for both iOS and Android. A YouTube Video explaining FireChat can be found here:  https://www.youtube.com/watch?v=GogPPT3ePGQ

Intelligence Oversight

An Introduction to Intelligence Oversight and Sensitive Information: The Department of Defense Rules for Protecting Americans’ Information and Privacy 
-- April 2013 - The Army Lawyer - DA PAM 27-50-479

History abundantly documents the tendency of Government - however benevolent and benign its motives - to view with suspicion those who most fervently dispute its policies. Fourth Amendment protections become the more necessary when the targets of official surveillance may be those suspected of unorthodoxy in their political beliefs. The danger to political dissent is acute where the Government attempts to act under so vague a concept as the power to protect ‘domestic security.’ Given the difficulty of defining the domestic security interest, the danger of abuse in acting to protect that interest becomes apparent. . . . The price of lawful public dissent must not be a dread of subjection to an unchecked surveillance power. Nor must the fear of unauthorized official eavesdropping deter vigorous citizen dissent and discussion of Government action in private conversation. For private dissent, no less than open public discourse, is essential to our free society...(United States v. U.S. District Court, 407 U.S. 297 (1972), also known as the Keith case.)

Intelligence Oversight Related to CONUS
(Inspector General of the Marine Corps, Oversight Division) Oversight related to CONUS antiterrorism / force protection a few preliminary questions posed and answered.

Pentagon Releases New Procedures for Intelligence Collection

Intelligence Oversight applies to Department of Defense (DOD) intelligence activities, and is addressed by each military service. Here we will look briefly at how the US Army addresses intelligence activities:

Army Regulation 381-10 "U.S. Army Intelligence Activities" (May 3, 2007) applies to any Army component performing authorized intelligence functions. This includes "installation, organization, or facility security offices [e.g. operations specialists and anti-terrorism officers] when carrying out intelligence activities".

Intelligence activities are defined as: "Collecting information concerning, and conducting activities to protect against, intelligence activities directed against the United States, international terrorist and international narcotics activities, and other hostile activities directed against the United States by foreign powers, organizations, persons, and their agents."

Army law enforcement, "USACIDC, garrison provost marshals and security officers" as non-intelligence entities are not subject to the provisions of this regulation [AR 381-10], but must comply with DODD 5200.27.

It is DoD policy to protect the privacy and civil liberties of DoD employees, members of the Military Services, and the public to the greatest extent possible, consistent with its operational requirements.

DoD will not maintain information on how an individual exercises rights protected by the First Amendment to the Constitution of the United States, including the freedoms of speech, assembly, press, and religion, except when the record is pertinent to and within the scope of an authorized law enforcement, intelligence collection, or counterintelligence activity.

The collection, use, maintenance, and dissemination of information critical to the success of the DoD efforts to counter terrorist and other criminal threats must comply with all applicable laws, regulations, and policies regarding the safeguarding of personal freedoms, civil liberties.

When collected or received personally identifiable information concerning individuals will be handled in strict compliance with section 552a of Title 5, United States Code (U.S.C.), also known as "The Privacy Act of 1974". 

The DOD has published a Quick Reference Guide for Reporting Questionable Intelligence Activities at: http://dodsioo.defense.gov/Quick-Ref/

Most intelligence personnel correctly associate questionable intelligence activities with improper collection on U.S. persons; however, that is only one aspect of questionable intelligence activities.

A questionable intelligence activity is one that may violate the law, any Executive Order (such as EO 12333, United States Intelligence Activities) or Presidential directive or applicable Department of Defense policy (such as DoD 5240.1-R, Procedures Governing the Activities of DoD Intelligence Components that Affect United States Persons), as well as your parent organization's specific guidance.

Examples of a questionable intelligence activity include, but are not limited to, the following:

• Alleged abuse and mistreatment of detainees and prisoners by or directed by intelligence personnel.
• Tasking intelligence personnel to conduct intelligence activities that are not part of the organization's approved mission, even if they have the technical capability to do so.
• Providing intelligence services and/or products without proper authorization.
• Failure to file proper use statements for imagery collection associated with U.S. persons.
• Collecting information on U.S. persons, even through open source, when it is not part of the unit's mission.