Vulnerabilities / Threats
11:00 AM
Lysa Myers
Lysa Myers
Connect Directly

Defending Against Identity Theft In The Military

Our military troops are twice as likely to be victims of identity theft as the general population. The reason is in the structure of military culture.

People in the military knowingly agree to put their lives in danger when they enlist, but there’s something else they’re putting on the line that they have not agreed to risk. More people reporting identity theft are members of the military than of any other demographic in the US. While this is shocking, upon further analysis, it is not particularly surprising.

According to a 2013 Federal Trade Commission study, people in the military report identity thefts at twice the rate of the rest of the population. Why is it that their identities are at greater risk? The answer is in the structure of military culture itself.

Peril is all in a day’s work
Historically, the military has had a culture of identifying each soldier by an assigned service number as much as with a given name. Since 1974, this number has ceased to be a separate, assigned service number; it was changed to be the Social Security Number (SSN) by all branches of the military.

In 2008, the federal government acknowledged the danger of the overuse of SSNs for the civilian population, yet this practice is still very much in place for members of the military. It wasn’t until two years later that the government even acknowledged the issue for service members. While most people are becoming increasingly sensitive about the use of this identifier, in the military, people are still trained to give their SSNs in the course of daily life.

My own awareness of this culture began while researching the use of SSNs in the context of healthcare: Federal interactions are some of the last remaining places where SSNs are still required for identity verification. This means that people who are dependent on the government for employment or financial assistance are required to provide their SSNs, to people and on forms, much more frequently than the general population. 

And government ID is far from the only time military members are obligated to disclose parts of their SSNs: If they want to get their laundry done, or even check out sports equipment at the gym, it’s customary to offer up the last four digits of their SSNs like a sort of password or a membership number. This all leads to a culture of devaluing this identifier in the minds of service members, which is very much at odds with its value to cyber criminals.

The silver lining here is that use of the SSN as an ID number is slowly being phased out both in visible data on ID cards and on their magnetic stripes. But identification “dog” tags for various branches of the military still visibly display this data.

Extra criminal motivation
Aside from the ID theft buffet created by the rampant overuse of SSNs in military culture, cyber criminals also have an extra advantage to help them put the screws to service members: Having bad credit can seriously limit soldiers' careers, whether it’s due to their own mistakes, predatory lenders, or ID fraud.

Criminals have historically viewed soldiers (especially those who are new, young, or about to deploy overseas) as "money delivery machines." Laws have been enacted to try to curb some of the more egregious instances of criminals taking advantage of soldiers, especially around so-called “payday loans.” But the unfortunate fact is, because creditors can report delinquent credit to commanding officers and put a soldier’s future career at risk, those creditors have more leverage to compel payment, regardless of how sketchy the terms of the loan are. Online loan scams in particular can be a big source of military identity theft.

In recent years, a number of sites have also sprung up offering “group ID verification”, for different groups with their own unique membership numbers, such as military members and students. It is common for these sites to offer deep discounts to these groups in exchange for their ID numbers. Those ID verification sites can frequently be a data grab, where criminals turn right around and use the data for ID theft and fraud.

Service members can protect themselves
While service members are at greater risk for identity theft, they also have extra means to protect themselves. In a document specific to military personnel, the FTC website has a number of great resources for how to tell if an ID has been stolen and what to do if it is. Note in particular that service members, when deployed, can make use of an “Active Duty Alert” that can help prevent unauthorized accounts from being created.

The single best thing service men and women can do to protect their credit is to regularly run a free credit check report. Beyond that, they should secure any documents or files that display their SSNs, and shred those documents they do not need to keep. While the system as it currently exists is imperfect, our military can still protect and defend individual identities.

Lysa Myers began her tenure in malware research labs in the weeks before the Melissa virus outbreak in 1999. She has watched both the malware landscape and the security technologies used to prevent threats from growing and changing dramatically. Because keeping up with all ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Author
5/6/2014 | 1:28:09 PM
Re: Away from home.
I wasn't able to find any indication either way, aside from some online Military-focused articles. Maybe someone out there reading this has some more insight?
Randy Naramore
Randy Naramore,
User Rank: Ninja
5/5/2014 | 3:37:41 PM
Re: Away from home.
Agree totally, protecting our military servicemen and servicewomen's livelihood while they are deployed is the least we can do for all they do for us.
Robert McDougal
Robert McDougal,
User Rank: Ninja
5/5/2014 | 2:39:37 PM
Re: Away from home.
Do you happen to know what if any security awareness training is offered to our soldiers?  Personally, other than in your article, I have never heard of the "Active Duty" credit freeze.  If there isn't any training, on this all too important topic, offered to our soldiers then I am ashamed of our government.

User Rank: Author
5/5/2014 | 12:40:30 PM
Re: Away from home.
With the "Active Duty" alert, they get something stronger to protect themselves, as it not just monitors but freezes credit. But right now, it's "opt-in" rather than "opt-out" and many service members may not know about the option at all. I heartily agree it would be beneficial to all of us if there was something stronger available to protect people in the military. At least more education and encouragement to use the options that are already out there.
Robert McDougal
Robert McDougal,
User Rank: Ninja
5/5/2014 | 11:54:28 AM
Away from home.
Another issue that makes it easier for a soldiers identity to be stolen is the fact that many of them are outside the country for months at a time.  During this time an attacker can use the soldiers identity to perform a large variety of fraud that could go undetected for months or even years.

As a result, I propose that the federal government enlist the services of credit monitoring services for our deployed service men and women.  I know this is a cost, but what is the cost of not protecting them when they are out of the country?
More Blogs from Commentary
Internet of Things: Security For A World Of Ubiquitous Computing
Endpoint security is hardly dead, and claiming that it is oversimplifies the challenges corporations face now and in the not-very-distant future.
CEO Report Card: Low Grades for Risk Management
Dark Reading's latest community poll shows a stunning lack of confidence in chief execs' commitment to cyber security.
A New Age in Cyber Security: Public Cyberhealth
The cleanup aimed at disrupting GameOver Zeus and CryptoLocker offers an instructive template for managing mass cyber infections.
Passwords & The Future Of Identity: Payment Networks?
The solution to the omnipresent and enduring password problem may be closer than you think.
Payment Card Data Theft: Tips For Small Business
For small businesses looking to reduce their exposure to data theft the good news is the advantage of being small.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-07-21
Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter.

Published: 2014-07-21
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.

Published: 2014-07-21
Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via (1) the pid attribute to the getAttribute_json function to application/controllers/admin/participantsaction.php in CPDB, (2) the sa parameter to appl...

Published: 2014-07-21
SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to admin/participants/sa/getParticipants_json, related to a search parameter...

Published: 2014-07-21
Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.