Colleges & Universities: Another Break in the Social Security Dike

I found an article on MSNBC recently about a stolen laptop computer with personal information on more than 98,000 California university students and applicants. “Stolen Berkeley laptop recovered; arrest made,” reported by Reuters, states that the university is “uncertain whether the information had been tapped…” Berkeley officials also confirmed a man was arrested and charged with possession of stolen property, which was allegedly bought over the Internet.

There’s more, but my first question would be, what is this sensitive data doing on a laptop? The second question is, why does the California university system require Social Security numbers for identification?

I searched for over a half-hour for Berkeley’s Privacy Policy with no success. I was able to find something from Long Beach, a part of the California university system, stating that CA Code (Section 41201, Title 5) and the Internal Revenue Code (Section 6109) “require you to provide the university with your correct Social Security number.” The Long Beach policy states further, “The university uses your Social Security number to identify your academic records and to collect any debts you may owe to (the school) CSULB.”

I am not familiar with the California Code, but I did check the IRS Code 6109 on the Department of the Treasury site, and in its summary it clearly states that the “regulations affect individual preparers who elect to identify themselves using a number other than their SSN.” It appears to be concerned with tax refunds more than anything else and almost always refers to the “preparer” as the subject of attention.

It’s hard to understand the state of California, one that is probably the most consumer-oriented in the nation, still requiring Social Security numbers in their universities for identification. The state of Arizona, certainly not a leader in consumer rights, enacted law in 2002 prohibiting universities and colleges from using Social Security numbers to identify students or faculty. This was the result of an earlier data breach at the University of Arizona in Tucson. It also refutes California’s IRS requirement.

There is also another site, “Social Security Numbers and Student Privacy,” that debates the issue of protecting students from the fraudulent use of Social Security numbers. It discusses the increasing number of students that are revolting against using this information for identification, with students knowing full-well that their personal data is already plastered throughout databases all over the country. The feedback is interesting and worth your time if you are a college student or his/her parents.

And, once again, Privacy Rights Clearinghouse provides the best information for students and faculty in protecting their personal data. Their page, “My Social Security Number: How Secure Is It?” is a huge aggregation of pointers about the nine digits and how to keep them safe. It includes a section, “How Can a School Use My Social Security Number,” that explains compliance with the Family Education Rights and Privacy Act, which “requires written consent for the release of educational records or personally identifiable information…”

On another page, “A Chronology of Data Breaches Reported Since the ChoicePoint Incident,” details thirty-nine colleges and universities, and one high school, that have experienced personal data breaches in the amount of 1.7 million individuals. ALL IN THE YEAR 2005. And one, Georgia Southern University, not included in this number, reported “tens of thousands.” Most were the result of hacking, some stolen laptops, and one “dishonest insider.”

Folks, we’re talking about this country’s largest and most prestigious schools of higher learning, and even one high school. Institutions like Berkeley, Boston College, Northwestern, Carnegie Mellon, Michigan State, Oklahoma State, Purdue, Stanford, Duke, U. of Connecticut, Ohio State, USC, U. of Colorado and the U. of Florida, to name only a few.

According to the National Center for Education Statistics, there are approximately 16.7 million students attending college in 2005. Based on the Privacy Rights Clearinghouse figures, above, over ten percent of the students have had a breach of their personal data. The students also represent over three percent of the total data breaches since ChoicePoint. A small figure to some, perhaps, but still yet another tragic statistic that needs immediate attention.