What? The Udvar-Hazy is free (though parking is $10 or $15 per car), but the Intrepid museum and the Kennedy Space Center Museum are both definitely not free, and are both, in fact, private organizations. Kennedy is here: http://www.kennedyspacecenter.com/buy-tickets-admission-hours.aspx Intrepid's site seems not to be responding. I don't know anything about the LA location. But having taken the family to Intrepid, Kennedy, Udvar-Hazy, and Air Force museum; I can assure you that 'free' had nothing to do with the site selection. In fact, as the museums must now pay NASA $28m (except for the Smithsonian), I'd say that the free museums were at a disadvantage.

Well, I can tell you that at Ohio State University, this is exactly what has happened. Effectively, every single machine that _may_ have ever had 'sensitive' (FERPA or HIPAA or Grant-defined) data on it must be encrypted. If it is lost & not encrypted, then it is the owner's burden of proof to prove that no sensitive data was on the machine; which is only possible if you have a complete & recent backup.

So, it can be done, but it is very expensive (though much cheaper now--BitLocker is really nice on Win7, FileVault on Mac) in terms of software and time. When we had to implement this ('08, I think) it cost our department of 25 faculty about $10,000-$15,000 to implement in software & time.

"Scanning for credit card data and SSN is quite easy and simple"

Sure, if you don't mind a false positive rate of 99%, which is what a colleague of mine got when he ran an automated tool on his machine that contained hundreds of GBs of particle physics data. Shocking, but its not hard to find 9 digit numbers (SSNs) or 15-18 digit numbers (CC) when you look at large repositories of quantitative data.

So the problem is, if you are mandated to run such software, and you get 1 million possible #s, what do you do then? If you are a typical clueless IT lackey (which luckily, we have dept-level IT, so ours are quite good & clued-in) he tells you to delete all of the dangerous data, or _prove_ that its not dangerous. (This has happened to a number of fellow profs at my Uni, which is one of the largest in the US).

The reality is that (a) the Uni should've stopped giving access to such info to anybody w/o a strict need-to-know decades ago. But they didn't. Now its everybody else's problem.

It depends on the field of research. Medical researchers will often have 'sensitive' (HIPAA in the US) data on their test subjects. My university, like many others, until recently, indexed all students with SSNs, and if I downloaded a roster for use in Excel, I got the SSNs with no option to delete them. That's what really angered me; I didn't want or need the data, but they (the Uni) shoved it down my throat & then threw a fit years later and pushed the cost of fixing the problem down to the departments.

Further, it depends on your definition of student data. I am a professor at a Big10 uni in the US, and our institutional definition of student records (which are declared sensitive by federal law) includes things as inane as emails from a student stating that the grader mis-added their score & they should've gotten an 80 on a quiz instead of a 75. So pretty much every communication to/from a student must be protected.

Your solution is entirely inadequate. I am a professor at a Big10 university. I have 41GB of files and data in my Docs directory. The point is, how do I know which of these files are protected? Your quip of "Anything you need saved goes on removable storage" is ridiculous. How do you protect the removable medium? What happens if you lose it? It was the loss of a removable disk 4 years ago that caused our state (and ergo our university) to attempt this same exercise. All of the tools are pretty useless. Its really hard to scan for SSNs without hitting false positives (what person engaged in empirical research doesn't have at least some 9 digit numbers hanging around?)

  Our final solution? Encrypt everything under the assumption that there is sensitive data on all machines. Its not pretty. In fact, its really annoying, but it provides political & economic cover.

That is, until you, as a professor, go to the slopes of Mt. Kilimanjaro for a month to do research. At that point, the assumption of 'always connected' is incorrect, and you must carry data with you. Frequently, you must also carry some forms of student information, too, in order to respond to emails that you get from students when you are in town at the internet cafe once per week.

CENTURION: What's this, then? 'Romanes Eunt Domus'? 'People called Romanes they go the house'?

BRIAN: It-- it says, 'Romans, go home'.

CENTURION: No, it doesn't. What's Latin for 'Roman'? Come on!

BRIAN: Aah!

CENTURION: Come on!

BRIAN: 'R-- Romanus'?

CENTURION: Goes like...?

BRIAN: 'Annus'?

CENTURION: Vocative plural of 'annus' is...?

BRIAN: Eh. 'Anni'?

CENTURION: 'Romani'. 'Eunt'? What is 'eunt'?

BRIAN: 'Go'. Let--

CENTURION: Conjugate the verb 'to go'.

BRIAN: Uh. 'Ire'. Uh, 'eo'. 'Is'. 'It'. 'Imus'. 'Itis'. 'Eunt'.

CENTURION: So 'eunt' is...?

BRIAN: Ah, huh, third person plural, uh, present indicative. Uh, 'they go'.

CENTURION: But 'Romans, go home' is an order, so you must use the...?

BRIAN: The... imperative!

CENTURION: Which is...?

BRIAN: Umm! Oh. Oh. Um, 'i'. 'I'!

CENTURION: How many Romans?

BRIAN: Ah! 'I'-- Plural. Plural. 'Ite'. 'Ite'.

CENTURION: 'Ite'.

BRIAN: Ah. Eh.

CENTURION: 'Domus'?

BRIAN: Eh.

CENTURION: Nominative?

BRIAN: Oh.

CENTURION: 'Go home'? This is motion towards. Isn't it, boy?

BRIAN: Ah. Ah, dative, sir! Ahh! No, not dative! Not the dative, sir! No! Ah! Oh, the... accusative! Accusative! Ah! 'Domum', sir! 'Ad domum'! Ah! Oooh! Ah!

CENTURION: Except that 'domus' takes the...?

BRIAN: The locative, sir!

CENTURION: Which is...?!

BRIAN: 'Domum'.

CENTURION: 'Domum'.

BRIAN: Aaah! Ah.

CENTURION: 'Um'. Understand?

BRIAN: Yes, sir.

CENTURION: Now, write it out a hundred times.

BRIAN: Yes, sir. Thank you, sir. Hail Caesar, sir.

CENTURION: Hail Caesar. If it's not done by sunrise, I'll cut your balls off.

BRIAN: Oh, thank you, sir. Thank you, sir. Hail Caesar and everything, sir! Oh. Mmm!

Finished!

ROMAN SOLDIER STIG: Right. Now don't do it again.

They will simply become Swedish Sperm Savings and Loans.