What Can I Do About Poorly Handled Data Theft?

Embarrassed UTA Alumnus writes "My former college, the University of Texas at Arlington, just made the now-all-to-common announcement that student data — including Social Security numbers, e-mail addresses, grades, and other information — were on several recently stolen personal computers. The computers were from the home of a Computer Science lecturer, and perhaps more worrisome was the fact that they were the only stolen items in the incident. I had the displeasure of taking one of the lecturer's courses a few years ago, and anyone from his courses since the year 2000 is affected. In response, UTA is providing free 90-day 'fraud monitoring' (not full credit reports), and no disciplinary action has been taken against the lecturer who lost the data." In situations like this, what can a student do when a large institution loses critical private information, makes only a token effort to fix the problem, and lets the people involved continue in practices that may make a similar, or more serious breach occur in the future?

"The data was not encrypted. The lecturer in question is one of the CS faculty at UTA who all conveniently guarded one another, so I guess I shouldn't expect more from him in that area. More importantly though, no one should have had this data on their personal computers, and Social Security numbers should not have been included at all. Furthermore, even without the concern of theft, I seriously question the need for years-old private student data. It is suspicious at the very least.

The UTA PR department is already trying to bury the issue with vague claims of new efforts to hire a system-wide CIO who would be responsible for all 15 UT system campuses. The lecturer in question responded to the student newspaper with 'no comment' each time they attempt to interview him.

I feel like the university should do more, including seeking disciplinary action against all involved. What can I do, short of keeping an eye on my credit and letting the school get away with yet another blunder?"

Why do professors need SSN?

[kabocox]

Um, Joe Random PHd Professor should only need your name and student ID number, which shouldn't be your SSN. I'd be more ticked off that the university was handing out your SSN to all the professors of the classes that you've taken. I wouldn't trust my major field advisor, I wouldn't trust many general ed. professors that I had to take. They don't need that information. They need your name and a university assigned ID number. Only a few people in admin. really need your SSN and they should be able to look it up by your Student ID number.

IANAL but...

[rueger]

... would suggest that you hire a lawyer. You can bet that the college did.

Common sense

[uab21]

I'm waiting for the inevitable "You shouldn't do any business with those careless assholes! Transfer immediately!" replies. Unfortunately there doesn't seem to be anyplace that actually implements indentity security correctly (Thanks USGov/Financial System/Educational System for making the sole key to my identity something anyone can find out for $19.95 or less!). If you're really concerned, pay for a credit monitoring service yourself. Chalk it up to yet another random fee that you have to pay to get an education.

Figure out what you want and then ask for it

[Slashdot Parent]

What, exactly, do you want the school to do? You keep asking for more, but you don't mention what.

The professor can't retroactively encrypt the data, nor can anybody unsteal the computers that contained it.

The only thing you mention is that you want to see the professor disciplined. Will this bring your data back? Will you benefit from the discipline of a professor whose class you took years ago?

What more do you want the school to do for you? You mentioned that you felt 90 days of credit monitoring was insufficient. Of course, now you can personally monitor it yourself [annualcreditreport.com] free of charge.

Just decide what it is you want and ask the school for it. You never know. If your request is reasonable, you just might get it.

Why give them your SSN?

[TheCabal]

This is exactly why I don't give my college my SSN. Data theft from schools is becoming way too common for me to be comfortable. Colleges don't need your SSN, they use it as a convienent way to generate your StudentID. Most colleges accept out-of-country students, who don't have SSNs, and have a system for generating StudentID numbers for them. My college gives me the option to use either my SSN or have a number generated for me, you can guess which one I chose.

Seriously. Nobody but your bank and employer need your SSN, and it's not supposed to be used for non-Social Security identification purposes anyway. Why people insist on using it as such, and why people still freely give it away just boggles my mind.

credit agencies are at fault here

[epine]

The fundamental problem here is the credit reporting system itself. I suppose after being subjected to the education system for twelve to twenty years or so, that learned helplessness with respect to the contents of a report card or GPA is deeply engrained.

The contents of the average credit report amount to unsubstantiated slander. It's tremendously easy for smudges to accumulate, with little effective recourse. In any other life circumstance, the same poor, fragmentary, and unsubstantiated quality of information about a person's status and character would be open to action as libelous.

I think the credit reporting agencies should be made libel for reporting negative information about any person as a result of criminal credential fraud. Even our terminology is wrong: we are talking about the theft of credentials not personal identity. An identity can't be stolen. Only the credentials are subject to third party manipulation. The institutions who choose to accept credentials as evidence of an identity should be prepared to bear the cost of their own mistakes.

And the worst of it is that our existing credentials are designed by baboons. It's not humanly possible to protect credentials you hand to every teenage till monkey five times a day.

We all know the truism that when you hear one person criticize another, it says as much about the person making the criticism as it does about the person being criticized. Yet the credit reporting agencies are somehow given a free pass which I've never understood. Might it be that a bad credit report reflects bad credit reporting practice? I guess we're so overwhelmed by our powerlessness in that relationship (my god, even more powerful than Miss Wormwood) that you rarely hear it suggested that perhaps the credit agencies themselves are no better than ICANN or VeriSign.