By Claudette Roulo
American Forces Press Service
WASHINGTON, April 22, 2013 – The loss of personally identifiable
information -- such as Social Security numbers -- is a concern
throughout the Defense Department, the director of the Defense Privacy
and Civil Liberties Office said last week.
"When people lose control of the Social Security number and other
personally identifiable information, they really are susceptible to
identity theft," Michael E. Reheuser said during an April 19 interview
with American Forces Press Service and the Pentagon Channel.
The department’s Social Security number reduction program is intended to help protect the privacy of DOD employees, he said.
"We're asking every component to look at the way it uses Social
Security numbers and see if they can voluntarily reduce [that],”
Reheuser said.
As that effort goes on within DOD’s components,
Reheuser said, his office will be working in the coming years to help in
reducing the use of Social Security numbers in systems that work across
multiple components. One way that reduction will occur is through the
use of DOD identification numbers, he said.
Similar to the
service numbers issued to military personnel until 1969, 10-digit
Electronic Data Interchange Personal Identifier numbers will be used to
replace Social Security numbers in record tracking systems whenever
possible.
"There are certain times where we have to use the
Social Security number -- for example, when we're dealing with the
Internal Revenue Service and other tax issues,” Reheuser said. “But,” he
continued, “there are plenty of times when we need an identifier, but
we don't need that Social Security number, and that's where the new
EDIPI will come in."
Everyone entitled to a common access card will get an EDIPI, Reheuser said.
As CACs expire, they will be replaced with cards containing the EDIPI,
he said. "The idea is that we keep it limited to uses within the
Department of Defense, so we don't create a new Social Security number
and have the same issues with identity theft in the future."
Developed by the Defense Manpower Data Center, EDIPI numbers are
assigned for life and have numerous uses. For example, medical
activities use them to track patients and patient records and to comply
with the Health Insurance Portability and Accountability Act. They also
are part of DOD's public-key infrastructure certificates, which are
encoded into the Common Access Card and -- in combination with a
password -- grant access to DOD information systems.
The
department intends to implement technology to prevent Social Security
and credit card numbers from leaving DOD networks via email, Reheuser
said. A blocking tool would identify those numbers and let senders know
they need to encrypt the email or take out the numbers, he added.