Myrtle Beach, SC
Overdue upgrade, and the last two months are a lesson in why the upgrade has to be run by people who understand the systems.
In February the claim went around that Social Security had millions of people aged well over a hundred marked as alive in its records, some listed at a hundred and fifty and beyond. It was repeated at the highest level. The implication everybody drew was that the government was mailing checks to the dead on an enormous scale.
That is not what the records showed.
Social Security’s own inspector general reported on this in 2023. There are roughly nineteen million people born before 1920 in the master identity file without a recorded death date — because the death information was never collected, not because anyone thinks they are alive. And the same report found that almost none of them were receiving payments. The number actually being paid was in the tens of thousands, not the millions.
The hundred-and-fifty figure has an even simpler explanation. The old programming system uses a default reference date when a birth date field is empty. Anybody with a missing birth date reads as being that many years old. It is a blank field displaying as a number.
I work in marketing and I know why that story travelled. It is vivid, it fits a prior, and the chart looked damning.
It was also a misreading of a database artifact by people who had access to the database for about three weeks.
That is the argument for the upgrade rather than against it. The records genuinely are a mess — nineteen million missing death dates in the identity file of the United States is not a defensible condition, and it is exactly the sort of thing modern matching would fix.
But the first public output of the new access was a claim that fell apart on contact with the agency’s own published audit, and that is a warning about pace rather than about direction.
Upgrade, yes. Read the inspector general’s report before announcing what the data means.
Novi, MI
A plant that still matches parts with a clipboard is protecting scrap, not workers. The scanner is overdue. What I want to work through is what the February episode actually revealed about the records, because the true finding is more useful than the false one.
The false finding. Millions of dead people receiving Social Security. The charts showed enormous cohorts listed at ages over a hundred, some over a hundred and fifty.
What the data actually contains. The master identity file holds records for roughly nineteen million people born before 1920 with no death information recorded. That is real and it is a serious data-integrity problem. It is not a payment problem — the inspector general looked at this in 2023 and found that the number in that group actually receiving benefits was on the order of tens of thousands, not millions. And the extreme ages are a display artifact: the legacy system substitutes a fixed reference date when the birth-date field is empty, so a blank reads as a very old person.
So the file has a large, genuine, documented defect — missing death data — and it does not have the defect that was announced.
In quality terms this is a textbook confusion between a data-integrity defect and a process defect, and they have completely different corrective actions.
A data-integrity defect means the record is wrong or incomplete. Fix: reconcile against an authoritative source, in this case state death records and the national death index. Cost: real but bounded. Risk to beneficiaries: nearly zero, because you are correcting a file rather than acting on it.
A process defect means the system is doing the wrong thing with the record. Fix: change the process. Risk: high, because the process touches live payments.
The announcement described a process defect. The evidence supports a data-integrity defect. And the corrective action indicated by the evidence — reconcile the death file — is cheaper, safer, and completely uncontroversial. Nobody in America objects to Social Security knowing who has died.
That is the whole case for the upgrade and it did not need the vivid version.
Now the design requirements, which this Forum has been building and which I would keep exactly.
Match identity across programs where the statute allows. Flag duplicates and unrecorded deaths against authoritative sources. Never let a flag be an automatic adverse action — a flag produces a queue, a human disposes of the queue, and the human’s office is named on the letter. Time-limit any hold. And publish the false-positive rate the way this file has demanded a leak rate.
That last one is not decoration. A matcher with an unpublished error rate is the clipboard with a faster clock.
Overdue upgrade, run by people who read the inspector general reports first. Both halves of that sentence are load-bearing.
Orange County, CA
Orange County runs eligibility systems that make people angry and also stop the ghosts, and angry-and-better is the adult category. What I want to price is what happened at Social Security in the last two weeks, because it is the exact scenario the second half of this question warns about and it is not hypothetical.
On the eighteenth, the agency announced that people filing retirement, survivor, and spousal claims by telephone would have to complete identity verification in person. Millions of people, many elderly, many rural, at an agency simultaneously planning to reduce staff by several thousand and close offices.
On the twenty-sixth — eight days later — the policy was delayed and narrowed. Disability, Medicare, and Supplemental Security Income claims were exempted, and the start date moved.
So within eight days, a security measure aimed at fraud prevention was recognised as a wrongful-denial machine and partially withdrawn.
In finance we would call that an unpriced access cost, and it is the single most common failure in fraud control. Every control has two error rates. The one everybody measures is fraud caught. The one nobody measures is legitimate transactions blocked, and the second is almost always larger and always lands on the least sophisticated customer.
An eighty-eight-year-old widow in a county with no field office within a hundred miles is not a fraud risk. She is an access cost, and she is the person a telephone claim exists for.
The reversal is to the agency’s credit and it was fast. It also tells you the analysis was not done beforehand, because eight days is not long enough to learn something new. It is long enough to hear from people.
So my answer to the question is upgrade, priced properly, and here is what pricing properly means.
Before any identity control goes live, publish two numbers: the estimated fraud prevented and the estimated legitimate claims delayed or blocked. If the second cannot be estimated, the control is not ready.
That is not a privacy objection and I want to be clear about that, because privacy is the wrong frame for most of this. The Privacy Act problem is about who sees the data. The wrongful-denial problem is about what the system does to a person who cannot navigate it, and it is bigger, more common, and almost entirely unmeasured.
Match the records. Reconcile the death file — nineteen million missing death dates is indefensible. Publish both error rates. And run the access-cost estimate before the policy rather than eight days after it.
Bismarck, ND
Match the person, flag the double, keep a human on the denial. Run it the other way before deciding whether that is enough.
A Democratic administration takes access to the Social Security identity file, announces within three weeks that millions of dead people are being paid, and it turns out the finding is a misread of blank date fields in a legacy system that the agency’s own inspector general had explained in a published report two years earlier.
Would this Forum accept that? It would not. It would say the people making the claim did not understand the system they had just been handed, and it would be right, and the correction would be the lead item for a week.
Same answer here.
In compliance work the rule is that you do not act on a finding until you have reconciled it against the entity’s own prior reporting. That is not deference. It is that the entity has usually already found the problem and documented why it looks the way it does, and if your finding contradicts theirs, one of you is wrong and you had better know which before you publish.
Here the prior report existed, it was public, and it said the extreme-age records were missing death data rather than active payments.
None of that is an argument against the upgrade. Nineteen million records without death information in the national identity file is a genuine and serious defect and it should be fixed, and modern matching is how you fix it.
It is an argument about sequence. Read the file, then run the match, then publish the finding, then act.
What ran was publish, then act, then discover.
And the second half of the question got its own demonstration this month. The telephone identity-verification policy announced on the eighteenth and narrowed on the twenty-sixth is exactly the new class of wrongful denials the question warns about, and it took eight days to become obvious.
Upgrade with a human on the adverse action and both error rates published. That is the answer and this month supplied the evidence for it.
Clermont, FL
Parks that will not scan tickets are protecting the man with the photocopier. Scan is overdue. What I want to talk about is the button next to the scanner, because March demonstrated why it matters.
The design I have argued for is simple: the software flags, a person reviews, the person’s office is named on the letter, and there is a way back in.
Two weeks ago Social Security announced that phone claimants would have to verify identity in person. Eight days later that was pulled back for disability, Medicare and SSI claims and the start date was pushed.
I consult with small businesses and I know what an eight-day reversal means. It means the policy went out without anybody modelling who it would catch. Not maliciously — because the modelling is tedious and the fraud case is obvious and the access case is invisible until people start calling.
The access case is always invisible until people start calling. That is the whole problem with fraud controls, everywhere, in every industry. The fraud you stop shows up in a report. The customer who gave up and went away never appears anywhere at all.
So the button is not a courtesy. It is the only instrument that makes the invisible cost visible, because an appeal creates a record and a record can be counted.
Put a human on every denial. Put the office name on the letter. Count the appeals and publish the number.
Then, if the appeal rate is low, the control is working and you can say so with evidence. If it is high, you have found your access cost before it becomes a hearing.
Upgrade, yes. Nineteen million records with no death date is not a privacy sanctuary, it is a mess. Fix it.
And build the door back in before you turn the lock, because this month showed how fast the lock can go on and how long it takes to notice who is outside.
Jacksonville, FL
Ports match containers to bills of lading with software allowed to be wrong a measured amount of the time, and a clerk can release a bad hold. That is the model and it holds here. What I want to address is the piece of this that is genuinely new and that the question does not reach.
There has been reporting this month that the effort extends beyond matching within a program to linking records across agencies — tax data, benefit data, immigration data, in a common environment.
That is a different proposition from anything else in this file and it deserves to be named separately.
Matching within a program is ordinary. Social Security reconciling its own beneficiary file against death records is not controversial and should have been done years ago. Nineteen million records without a death date is an indefensible condition in the identity file of the United States.
Linking tax records to benefit records to immigration records in a single queryable environment is the construction of something that has never existed in this country, and the reason it has never existed is not technical incapacity. It was a series of deliberate decisions, most of them made in the 1970s, that the government should not hold a unified file on its citizens.
The Privacy Act of 1974 is the statutory expression of that decision. So are the tax confidentiality provisions, which are among the strictest information rules in federal law and which carry criminal penalties for disclosure.
Those constraints are not bureaucratic sludge. They were adopted deliberately, in living memory, in response to specific abuses, by a Congress that had just watched federal files used against political opponents.
So the manifest for this question has three tiers, not one.
Tier one: within-program reconciliation. Death records, duplicate claims, deceased payees. Overdue, uncontroversial, should proceed immediately and at speed.
Tier two: cross-program matching where a statute already authorises it. These authorities exist and are used — the Do Not Pay system is built on exactly this. Expand within existing authority.
Tier three: general cross-agency linkage. Requires new law. Not because anyone is being obstructive but because the existing law was written to forbid it, on purpose, for reasons that are still legible.
The first two get everything the payment-integrity case actually requires. Nearly all of the improper-payment problem is eligibility and identity within programs, not exotic cross-domain correlation.
The third is a different project with different purposes, and if somebody wants it, they should have to ask Congress and say what it is for.
Overdue upgrade on one and two, at pace, with a human on every adverse action and both error rates published. On three, a bill or nothing. That is not a veto. It is the ordinary requirement that a new power be authorized by the branch that authorises powers.
Las Vegas, NV
You check identification at the cage and you also let a boss fix a bad read. Both. That has been my position and I want to say something about the second half of it, because a number nobody publishes is the tell in every operation I have ever worked.
Every identity system has a false-positive rate. Every one. There is no such thing as a matcher that only catches the wrong people, and anybody who tells you otherwise is selling something.
The question is whether the rate is published.
In a casino, if the identification system rejects a legitimate customer, that is an incident and it goes in a log and somebody counts the log. Not because the customer is important — because a rising rejection rate is the earliest warning that the system has drifted, and the log is the only place it shows up.
Applied here: when a benefit matcher flags somebody who was in fact eligible, that has to produce a record, the record has to be counted, and the count has to be public.
Nobody has proposed that. The whole conversation has been about what the software will catch.
And this month showed why it matters. The phone identity-verification policy went out on the eighteenth and was narrowed on the twenty-sixth. Eight days. Whatever produced the reversal, it was not a published error rate, because there was not one — it was people calling their congressmen, which is a slow, noisy, and unreliable substitute for a number.
So: upgrade, yes, and the records genuinely need it. Nineteen million missing death dates is not a defensible file.
Publish the false-positive rate alongside the fraud caught. A control with only one number reported is not a control. It is a claim.
Knoxville, TN
Scan the claim, keep a person on the denial. That is the design and I want to add the sequencing, because March demonstrated what happens without it.
The order of operations for putting new software against a live benefit system is not a matter of taste. It is standard practice everywhere consequences attach to the output.
One: baseline. Run the matcher against historical data and see what it would have flagged. No live consequences. This tells you the false-positive rate before anybody is affected.
Two: shadow. Run it live, in parallel, generating flags that go to a queue nobody acts on. Compare against actual dispositions.
Three: assisted. Flags go to a human who disposes of them, with the outcome recorded.
Four: production, with published rates and an appeal path.
Four stages. Each one produces the information the next one needs. The whole sequence takes months and it is not slow for the sake of being slow — every stage exists because somebody once skipped it and found out why it was there.
In public works we do this with any control that can fail closed. You do not put a new signal system on a live line and see what happens. You run it dark first.
What has happened in the last six weeks looks like stage four without stages one through three. A conclusion announced in February that turned out to be a misreading of blank date fields in a legacy file. A verification policy announced on the eighteenth of March and narrowed on the twenty-sixth.
Neither of those is an argument against the upgrade. The underlying condition — nineteen million records in the national identity file with no death information — is exactly the sort of thing that should have been fixed a decade ago, and the case for fixing it is unanswerable.
They are arguments for the staging, and the staging is not expensive. It is a few months and a spreadsheet of error rates.
Build the matcher. Run it dark. Publish both error rates. Put a person and an office name on every denial. That is an overdue upgrade with a brake, which is the only version anybody should defend, and it is the version that would have avoided both of the last six weeks’ problems.
