(This post originally published on 47 Watch)
Recent administrative changes at the Social Security Administration (SSA) reveal a concerning pattern of decisions that disproportionately impact vulnerable populations while being implemented in ways that limit public awareness and oversight. Two specific policy reversals highlight this trend: the reinstatement of 100% benefit withholding for overpayments and the termination of “Enumeration at Birth” contracts in several states.
The Overpayment Recovery Rate Reversal
On March 7, 2025, the SSA quietly announced it would revert to withholding 100% of monthly benefits from recipients with overpayments, effective March 27, 2025. This reverses a significant reform implemented just one year prior, in March 2024, when the agency reduced the default withholding rate from 100% to 10% of monthly benefits.
The 2024 reform had been implemented specifically to prevent vulnerable beneficiaries from facing homelessness or inability to pay for basic necessities when their entire benefit was withheld. As former Commissioner Martin O’Malley stated, the previous practice was “unconscionable” when it left people “facing homelessness or unable to pay bills, because Social Security withheld their entire payment for recovery of an overpayment.”
Data from the SSA showed the 2024 policy change had measurable positive impacts:
- The number of people newly placed in full withholding plummeted from 6,771 in February to just 51 in September 2024
- Approximately 200,000 beneficiaries were able to maintain 90% of their benefits during repayment
While beneficiaries can still appeal for hardship waivers to reduce the withholding rate, the appeals process now faces significant delays — reportedly up to 200 days due to staffing shortages at SSA offices. This administrative bottleneck creates a de facto policy of 100% withholding for extended periods, even for those who would qualify for reduced rates.
Acting Commissioner Lee Dudek has framed the reversal as fulfilling the agency’s “significant responsibility to be good stewards of the trust funds for the American people,” estimating the change would increase overpayment recoveries by approximately $7 billion over the next decade.
The Enumeration at Birth Contract Terminations
In a separate but similarly concerning move, the SSA terminated “Enumeration at Birth” contracts with several states, including Maine, in February 2025. These contracts, which had been operating efficiently since 1980, allowed parents to register newborns for Social Security numbers through a simple automated hospital process.
The termination means parents must now physically visit Social Security offices with their newborns and documentation to apply for numbers — a significant burden in rural states like Maine with sparse populations and limited SSA offices. After public backlash and pressure from congressional representatives, Acting Commissioner Dudek issued an apology and claimed he would “reinstate” the contracts.
However, as numerous administrative experts have pointed out, federal contracts cannot simply be “reinstated” after termination. The entire contracting process must start over, which is:
- More expensive than maintaining the original contracts
- Time-consuming, especially with reduced SSA staff
- Creates unnecessary burdens for new parents in the meantime
Notably, the contracts were terminated in six states, all of which have Democratic representatives in Congress, suggesting potential political targeting. Maine’s governer — Janet Mills — is also embroiled in a fight with Trump and his administration over rights of transgender citizens.
The terminations were supposedly conducted to save money (approximately $77,000 for a five-year contract base), but will likely result in higher administrative costs, less efficient service delivery, and more work for already-strained Social Security offices.
The Pattern of Administrative Weaponization
Both policy changes share several concerning characteristics:
- Quiet implementation: Both were announced with minimal publicity, with the overpayment policy change released late on a Friday, a classic tactic to minimize media coverage.
-
Disproportionate impact on vulnerable populations: Both changes primarily affect those least equipped to navigate bureaucratic hurdles — elderly and disabled beneficiaries in the case of overpayments, and new parents in rural areas for the Enumeration at Birth terminations.
-
Administrative roadblocks to relief: While both policies theoretically offer pathways for relief (appeals for overpayment withholding, visiting SSA offices for birth enumeration), administrative realities like extended processing times and limited office locations create de facto barriers.
-
Questionable fiscal justifications: Both changes are justified as fiscal responsibility measures, yet both may ultimately cost more in administrative overhead and downstream social costs than they save.
-
Appearance of political targeting: The pattern of states affected by the Enumeration at Birth terminations, along with reports of partisan “hotlines” to expedite certain cases, suggests potentially politically motivated implementation.
These administrative changes highlight how consequential policy shifts can occur not through legislative action but through bureaucratic decisions that receive little public attention or congressional oversight. As these policies take effect in the coming weeks, their impact on vulnerable Social Security beneficiaries and new parents will become increasingly apparent.
Xitter Hit by Major Cyberattack
On March 10, 2025, Xitter experienced major service disruptions throughout the day. Users couldn’t access the platform on both mobile apps and the website. Here’s what happened and why it matters.
What Happened?
X suffered multiple waves of outages starting early Monday morning:
People trying to use Xitter saw loading symbols, error messages saying “Something went wrong. Try reloading,” or couldn’t access the service at all.
Who Was Behind It?
A pro-Palestinian hacking group called Dark Storm Team claimed responsibility for the attack. They posted on their Telegram channel: “Twitter has been taken offline by Dark Storm Team,” along with screenshots showing connection failures from different global locations.
Dark Storm Team has been active since around 2023 and is known for targeting organizations in Israel, Europe, and the United States. According to security experts, the group specializes in DDoS attacks and has a pro-Palestinian orientation.
What Did Elon Musk Say?
Elon Musk, Xitter’s owner, acknowledged the attack several hours after it began: “There was (still is) a massive cyberattack against Xitter. We get attacked every day, but this was done with a lot of resources. Either a large, coordinated group and/or a country is involved.”
Later, in an interview with Fox Business, Musk made a controversial claim connecting the attack to Ukraine: “We’re not sure exactly what happened but there was a massive cyberattack to try and bring down the Xitter system with IP addresses originating in the Ukraine area.” He provided no evidence to support this claim.
What Was the Reaction?
Cybersecurity experts expressed significant skepticism about Musk’s Ukraine claim:
Ukrainian officials firmly denied any involvement. Oleksii Merezhko, chairman of Ukraine’s parliamentary Foreign Affairs Committee, stated that the Ukrainian government had “absolutely” no part in the alleged cyberattack on Xitter.
Ed Krassenstein, who claimed to have communicated with Dark Storm’s leader, contradicted Musk’s assertion. According to screenshots shared online, the group responded to the Ukraine claim by saying: “Elon Musk must provide evidence for his claim, and we will provide evidence for ours.” They allegedly threatened further attacks, warning “We can attack again. A stronger attack this time, not only on Xitter but Tesla and others.”
What Type of Attack Was It?
The incident was a distributed denial-of-service (DDoS) attack. These attacks work by:
– Overwhelming a platform’s servers with excessive traffic
– Causing slowdowns or complete outages by exhausting available resources
– Using compromised devices (forming a “botnet”) to send overwhelming amounts of data
Cybersecurity experts described this attack as “far beyond simple DoS attempts,” involving “full-scale DDoS assaults, combined with sophisticated botnet activity, credential stuffing, API abuse, and targeted application-layer attacks designed to cripple operations.”
How Did Xitter Respond?
Xitter implemented Cloudflare’s DDoS protection services to mitigate the impact. This defensive measure introduced captcha verification for suspicious IP addresses generating too many requests. By evening, the platform had largely recovered, though some users continued to experience intermittent issues.
I’m not surprised Cloudflare helps protect Nazis, but it’d be nice to live in a universe where they all crawled back under their rocks for good.