Vulnerabilities / Threats
5/5/2014
11:00 AM
Lysa Myers
Lysa Myers
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Defending Against Identity Theft In The Military

Our military troops are twice as likely to be victims of identity theft as the general population. The reason is in the structure of military culture.

People in the military knowingly agree to put their lives in danger when they enlist, but there’s something else they’re putting on the line that they have not agreed to risk. More people reporting identity theft are members of the military than of any other demographic in the US. While this is shocking, upon further analysis, it is not particularly surprising.

According to a 2013 Federal Trade Commission study, people in the military report identity thefts at twice the rate of the rest of the population. Why is it that their identities are at greater risk? The answer is in the structure of military culture itself.

Peril is all in a day’s work
Historically, the military has had a culture of identifying each soldier by an assigned service number as much as with a given name. Since 1974, this number has ceased to be a separate, assigned service number; it was changed to be the Social Security Number (SSN) by all branches of the military.

In 2008, the federal government acknowledged the danger of the overuse of SSNs for the civilian population, yet this practice is still very much in place for members of the military. It wasn’t until two years later that the government even acknowledged the issue for service members. While most people are becoming increasingly sensitive about the use of this identifier, in the military, people are still trained to give their SSNs in the course of daily life.

My own awareness of this culture began while researching the use of SSNs in the context of healthcare: Federal interactions are some of the last remaining places where SSNs are still required for identity verification. This means that people who are dependent on the government for employment or financial assistance are required to provide their SSNs, to people and on forms, much more frequently than the general population. 

And government ID is far from the only time military members are obligated to disclose parts of their SSNs: If they want to get their laundry done, or even check out sports equipment at the gym, it’s customary to offer up the last four digits of their SSNs like a sort of password or a membership number. This all leads to a culture of devaluing this identifier in the minds of service members, which is very much at odds with its value to cyber criminals.

The silver lining here is that use of the SSN as an ID number is slowly being phased out both in visible data on ID cards and on their magnetic stripes. But identification “dog” tags for various branches of the military still visibly display this data.

Extra criminal motivation
Aside from the ID theft buffet created by the rampant overuse of SSNs in military culture, cyber criminals also have an extra advantage to help them put the screws to service members: Having bad credit can seriously limit soldiers' careers, whether it’s due to their own mistakes, predatory lenders, or ID fraud.

Criminals have historically viewed soldiers (especially those who are new, young, or about to deploy overseas) as "money delivery machines." Laws have been enacted to try to curb some of the more egregious instances of criminals taking advantage of soldiers, especially around so-called “payday loans.” But the unfortunate fact is, because creditors can report delinquent credit to commanding officers and put a soldier’s future career at risk, those creditors have more leverage to compel payment, regardless of how sketchy the terms of the loan are. Online loan scams in particular can be a big source of military identity theft.

In recent years, a number of sites have also sprung up offering “group ID verification”, for different groups with their own unique membership numbers, such as military members and students. It is common for these sites to offer deep discounts to these groups in exchange for their ID numbers. Those ID verification sites can frequently be a data grab, where criminals turn right around and use the data for ID theft and fraud.

Service members can protect themselves
While service members are at greater risk for identity theft, they also have extra means to protect themselves. In a document specific to military personnel, the FTC website has a number of great resources for how to tell if an ID has been stolen and what to do if it is. Note in particular that service members, when deployed, can make use of an “Active Duty Alert” that can help prevent unauthorized accounts from being created.

The single best thing service men and women can do to protect their credit is to regularly run a free credit check report. Beyond that, they should secure any documents or files that display their SSNs, and shred those documents they do not need to keep. While the system as it currently exists is imperfect, our military can still protect and defend individual identities.

Lysa Myers began her tenure in malware research labs in the weeks before the Melissa virus outbreak in 1999. She has watched both the malware landscape and the security technologies used to prevent threats from growing and changing dramatically. Because keeping up with all ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
LysaMyers
50%
50%
LysaMyers,
User Rank: Author
5/6/2014 | 1:28:09 PM
Re: Away from home.
I wasn't able to find any indication either way, aside from some online Military-focused articles. Maybe someone out there reading this has some more insight?
Randy Naramore
100%
0%
Randy Naramore,
User Rank: Ninja
5/5/2014 | 3:37:41 PM
Re: Away from home.
Agree totally, protecting our military servicemen and servicewomen's livelihood while they are deployed is the least we can do for all they do for us.
Robert McDougal
100%
0%
Robert McDougal,
User Rank: Ninja
5/5/2014 | 2:39:37 PM
Re: Away from home.
Do you happen to know what if any security awareness training is offered to our soldiers?  Personally, other than in your article, I have never heard of the "Active Duty" credit freeze.  If there isn't any training, on this all too important topic, offered to our soldiers then I am ashamed of our government.

 
LysaMyers
50%
50%
LysaMyers,
User Rank: Author
5/5/2014 | 12:40:30 PM
Re: Away from home.
With the "Active Duty" alert, they get something stronger to protect themselves, as it not just monitors but freezes credit. But right now, it's "opt-in" rather than "opt-out" and many service members may not know about the option at all. I heartily agree it would be beneficial to all of us if there was something stronger available to protect people in the military. At least more education and encouragement to use the options that are already out there.
Robert McDougal
100%
0%
Robert McDougal,
User Rank: Ninja
5/5/2014 | 11:54:28 AM
Away from home.
Another issue that makes it easier for a soldiers identity to be stolen is the fact that many of them are outside the country for months at a time.  During this time an attacker can use the soldiers identity to perform a large variety of fraud that could go undetected for months or even years.

As a result, I propose that the federal government enlist the services of credit monitoring services for our deployed service men and women.  I know this is a cost, but what is the cost of not protecting them when they are out of the country?
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3594
Published: 2014-08-22
Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.