Colleges leaking confidential data
Students compromised by Internet intrusions
Tanya Schevitz, Chronicle Staff Writer
Monday, April 5, 2004

URL: sfgate.com/cgi-bin/article.cgi?file=/c/a/2004/04/05/MNGGP60LNV1.DTL

Colleges across the country, through computer security failure and human error, have exposed confidential information about hundreds of thousands of students and employees over the Internet, and experts say they expect the problems to continue.

In addition to being targeted by some very savvy hackers, college computer systems have been made vulnerable by the schools themselves through inadequately trained employees who have access to the files.

"It is not an arena where anything stands still,'' said security consultant Cedric Bennett, emeritus director of Information Security Services at Stanford University. "You might be doing great work (training people and securing your system); meanwhile, the laws are changing and the bad guys are getting more sophisticated."

Daniel Updegrove, vice president for information technology at the University of Texas at Austin, said advances such as around-the-clock access to administrative services and digital library resources have come with a down side.

"While popular and valuable, not all of these services have been rigorously tested for their ability to withstand intrusion from a sophisticated or persistent attacker," said Updegrove.

The problem has been highlighted in recent months by some high-profile breaches of computer-stored records including names, addresses, Social Security numbers and, in some cases, even credit cards, for applicants, students, alumni and staff.

-- San Diego State University reported in March that hackers broke into a server in the Office of Financial Aid and Scholarships, gaining access to names and Social Security numbers for more than 178,000 former and current students, applicants and employees.

-- The University of California notified 2,156 applicants a few weeks ago that an overloaded server may have allowed Social Security numbers, test scores and other personal details to be shared over the Internet with competing applicants.

-- Some 2,800 applicants of the California State University at Monterey Bay were informed in February that their names, addresses and Social Security numbers were made available on the Internet by an employee who moved the data to a computer folder that was not secure. The data was accessed more than 100 times from around the world before the error was discovered.

-- At the Georgia Institute of Technology, a hacker downloaded information that could have included names, addresses, phone numbers, e-mail addresses and credit card numbers for about 57,775 patrons from the campus arts center box office in March.

-- At the University of Texas at Austin, 55,200 names and Social Security numbers were downloaded by hackers in March after a similar incident in October.

-- At New York University, it was discovered in January that several mailing lists with names, birth dates, addresses, phone numbers, e-mail addresses and some Social Security numbers for at least 2,100 students, alumni and professors were inadvertently posted on a campus Web site, according to the campus newspaper, the Washington Square News.

Computer experts say that data erroneously posted on the Internet could have been copied or accessed before the problem was discovered, leaving individuals vulnerable for years.

"We live in an age now when anything that goes into a database has the potential to be compromised intentionally or unintentionally,'' said Chuck Haupt of Pleasanton, whose son was one of the applicants whose data was compromised at CSU Monterey Bay.

"My son's confidential information is out there,'' said Haupt, who works in the software industry. "People could wreck his credit history or cause identity theft ... Somebody can apply for a credit card with my son's data a year or two years from now, or maybe they will wait until these kids graduate and get jobs. Who knows how long we have to worry about this?"

According to the Federal Trade Commission, reports of identity theft increased 574 percent in three years, from 31,117 in 2000 to about 210,000 in 2003, with the majority of victims -- 28 percent -- between the ages of 18 and 29.

Although the problem of computer security is not limited to colleges and universities, academic institutions thrive in a culture of openness and the sharing of information, and some see the tightening of security procedures as a threat to that culture, said Bennett, the expert from Stanford.

"At a corporation where, for the most part, they want to keep the information inside the corporation, they put up big fences," Bennett said. "Universities, because they tend to be relatively open and invite inspection, tend not to put up fences. So it makes it even harder to manage the data which by law needs to be protected."

But the challenge may be human as well as technical. That was the case at CSU Monterey Bay.

"The good news is that the system itself is secure. It wasn't hacked into, " said Stephen Reed, associate vice president of CSU Monterey Bay. "The question is, do we in fact audit the training and retrain often enough? Probably the answer is no, and in this case, definitely not. We need to intercept those few employees who have access to sensitive data and train them quicker and train them better and retrain them more often."

Privacy experts and college administrators agree that the most sensitive piece of information exposed on campus networks is a student's Social Security number, and efforts are under way to protect that, at the very least.

State Sen. Debra Bowen, D-Redondo Beach (Los Angeles County), authored legislation that requires government agencies, including the state's colleges and universities, to stop using Social Security numbers on student ID cards and public postings as of January 2004.

"Social Security numbers were on ID cards, they were on library cards, they were used in the gym, in every activity on campus,'' Bowen said. "Grades were posted by Social Security number. Items with the Social Security number went to students in the mail. If they have their Social Security number plastered everywhere, they will be at risk."

Eliminating the use of Social Security numbers as an identifier is vital, because many campus systems remain porous, said Mark Durham, spokesman for Identity Theft 911, a San Francisco company that specializes in identity-theft defense and consumer education.

To guage the vulnerability of colleges and universities, employees from his company used a public search engine to scrutinize the education domain and found numerous documents posted by universities, often class lists put up by professors, with names and Social Security numbers.

"You couldn't really ask for more. Any identity thief would be pretty happy with what they had done," Durham said. They informed universities of the holes but then found that they could still find sensitive documents when they went back again later.

"You don't have to target or suspect that somebody has a lax system. You just have to do a search and whatever vulnerabilities they have will bubble up, " Durham said..

For more information on ID theft, visit the Federal Trade Commission Web site at www.consumer.gov/idtheft/.

E-mail Tanya Schevitz at tschevitz@sfchronicle.com.

©2004 San Francisco Chronicle